For: people who have (or had) an Asoview! member account, and people who run booking or member sites. This article explains Asoview Inc.'s official notice and does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who have (or had) an Asoview! member account, and people who run booking or member sites.
- Confirmed so farSee the table ↓
- Unauthorized access to the vendor's email-delivery service by a third party
- Scale
- Email address
3 more
- Member ID and number, name, gender, date of birth, registration date, last login date
- Phone number, postal code, area of residence
- Ticket purchase date and time, type, quantity, facility used, date of use, participants, cancellation
- Not yet confirmed
- Whether you are affected (identifying the members)
- How and when individuals are notified
- Cause and period of the unauthorized access
3 more
- Whether the company's own systems were accessed
- Whether any misuse occurs
- When email delivery resumes
- What to do nowSee the steps ↓
- Do not open links in messages claiming to be Asoview!, and check your booking in the official site or app that you open yourself
- Do not follow a link in a message saying ‘you are affected’ either
- Never give a password or card number to whoever contacted you. If you entered a card number on a fake page, call your card issuer
2 more
- Stay alert to unknown calls and texts for a while
- Use the dedicated contact published in the notice
- Where to verify (source)All sources ↓
- Asoview Inc., "Apology and notice regarding unauthorized access to an entrusted email-delivery service" (Japanese, November 3, 2026)
- Last checked
- As of November 5, 2026
Follow-up plans and what we checked
The company says that once it receives the list of affected people from the vendor, it will match it against members and contact them individually. It says it will update the notice page promptly when new facts emerge. We checked the company's notice page on November 5; its last update is still November 3 and no second report has been published.
What Asoview! members should do today
Leaked: email, name, phone, date of birth, gender, postal code, area
Can fuel emails, texts and calls with the right name. Do not open links
Leaked: purchase time, ticket type, quantity, facility, date of use, participants, cancellation
Can fuel fake refund or cancellation notices that match a real booking
Not included: passwords and credit card information (not entrusted to the vendor)
Nothing in the notice calls for a password change over this incident
Do not open links in messages claiming to be Asoview!, and check your booking in the official site or app that you open yourself
The leaked items include name, phone number and email address together with the ticket purchase time, the facility used, the date of use and the number of participants. A message that follows a real booking can get your name, the facility and the date right. The company also warns that this information could be abused for emails, texts and calls impersonating it, and asks you to delete unfamiliar emails and texts without opening the URL in them and to avoid answering suspicious calls.
If you get a message saying "your booking was cancelled", "enter your bank account for a refund" or "you won", do not open the link in it. Open the app or the official site yourself and look at the state of your booking. A booking that exists, with the right date, is still not proof that the message is genuine (see what is phishing?).
Do not follow a link in a message saying ‘you are affected’ either
The company says it will contact affected members individually once they are identified, but the notice does not say how (by email or otherwise). So if an email or text arrives saying "you are affected, confirm here", do not proceed through its link. The company says it will contact affected members individually once they are identified, so until then check the company's notice page for updates. The dedicated contact number is given below.
Never give a password or card number to whoever contacted you. If you entered a card number on a fake page, call your card issuer
The company says passwords and credit card information were not entrusted to the vendor and are not part of the leak. It also says it never asks you, by email, text or phone, to enter or tell it a password or card information. If you are asked, treat the message as fake.
If you have entered card information on a fake page, contact your card issuer promptly, as the company advises. If you have entered a password, change it on every service where you use it (password manager, how to check if your password was leaked).
Stay alert to unknown calls and texts for a while
Your phone number, postal code and date of birth are hard to change. In general, scam calls and texts can reach a leaked number under names other than Asoview! (our view). Turning on your phone's spam call and spam text filters reduces how many arrive (smartphone security basics).
Use the dedicated contact published in the notice
The company gives a dedicated line for customers (people who made bookings): 0120-30-3521 (10:00 to 19:00 JST, weekdays and weekends/holidays; a Japanese freephone number). Take the number from this notice on the company's official site, not from a message sent to you.
What happened (according to Asoview)
Asoview Inc. posted "Apology and notice regarding unauthorized access to an entrusted email-delivery service" (title translated; the original is in Japanese) on its official site on November 3, 2026. Everything below is based on that notice.
According to the company, the email-delivery service of a vendor it used was accessed without authorization by a third party, and part of the member data it had entrusted to that service leaked. The company says the incident originates in the vendor's service, not in its own systems. The vendor's side and its wider scope are covered in unauthorized access to an email-delivery service (the vendor's disclosure).
November 2, 2026
The company received a report from the vendor that the data taken in the unauthorized access included information the company had entrusted to it.Same day
The company stopped all email delivery through that service and invalidated its credentials (admin-console password, API key and so on). It asked the vendor to identify and report the leaked items and number, and began checking whether its own systems had been accessed.November 3
The company received the leaked number and items from the vendor and published this notice the same day. It planned to file a preliminary report that day with the Personal Information Protection Commission and the Japan Institute for Promotion of Digital Economy and Community (JIPDEC).Next
Once it receives the list of affected people from the vendor, the company says it will match email addresses against members, identify the affected members and contact them individually.As of November 5
The last update of the company's notice page is still November 3. No second report was found.
- Where the data leaked from
- The service of the vendor the company used to send email (the company says it is not its own system)
- Scale
- 15,821,184 records. The scope is members to whom the company sent email through that service
- Email address
- Leaked
- Member information
- Member ID and number, name, gender, date of birth, registration date, last login date, and others
- Contact details
- Phone number, postal code, area of residence (note: the item table lists these three; the text asking members to be careful says address is included, and whether the full address is included cannot be determined from the notice)
- Ticket purchase and use information
- Purchase date and time, ticket type, quantity, facility used, date of use, number of participants, whether cancelled, and others
- Not included
- Passwords and credit card information (not entrusted to the vendor)
- Harm
- No harm from misuse of the leaked information had been confirmed at the time of the notice
- Actions taken
- Stopped all email delivery through the service, invalidated credentials, asked the vendor to identify items and number, started checking its own systems, preliminary report to the Personal Information Protection Commission and others (planned)
- Planned next
- Ask the vendor for prompt reporting of results and reliable preventive measures; review criteria for selecting outsourced vendors and external services; limit the information entrusted to vendors to the minimum necessary
What is known and what is not
Status as of November 5, 2026. We will update this table as the company publishes more.
| Item | What the notice says | Status |
|---|---|---|
| Unauthorized access to the vendor's email-delivery service by a third party | Part of the entrusted member data was found to have leaked | Confirmed (company) |
| Scale | 15,821,184 records | Confirmed (company; the unit is records, not stated as people) |
| Email address | Listed as leaked information | Leak confirmed (company) |
| Member ID and number, name, gender, date of birth, registration date, last login date | Listed as leaked information (with ‘etc.’) | Leak confirmed (company) |
| Phone number, postal code, area of residence | Listed as leaked information | Leak confirmed (company) |
| Full street address | The item table lists postal code and area of residence, but the text asking members to be careful says address is included. Whether the full address is included cannot be determined from the notice | Not stated |
| Ticket purchase date and time, type, quantity, facility used, date of use, participants, cancellation | Listed as leaked information (with ‘etc.’) | Leak confirmed (company) |
| Items other than those listed | The notice says ‘etc.’ but gives no breakdown | Not stated |
| Passwords | Not entrusted to the vendor; not included | Not included (company) |
| Credit card information | Not entrusted to the vendor; not included | Not included (company) |
| Harm from misuse | None confirmed at the time of the notice | Not confirmed (company) |
| Which members the leaked email addresses belong to | Not yet identified; the vendor is investigating | Under investigation |
| Individual notification | Planned once affected members are identified; no method given | Planned (company) |
| Unauthorized access to the company's own systems | Investigation started | Under investigation |
| Route and period of the intrusion | Not in the company's notice | Not stated |
| Resumption of email delivery | Stopped; no date for resumption | Not stated |
Note: 15,821,184 is a count of records, not members
The notice's ‘count’ column is the number of leaked records. It does not say people, and the company has not yet identified which members the leaked email addresses belong to. It also does not say whether the same member is counted more than once, so we have not converted it to a number of people. Some news reports give it as 15.82 million records; that is the same count, taken from the company's notice.
What the combination of leaked items could be used for
The following is what can generally happen with this combination of items. The company has not announced that any of it has happened in this incident, and says no harm from misuse had been confirmed at the time of the notice.
- Name + phone number + email address: real-looking emails, texts and calls with the right name and contact details
- Facility used + date of use + quantity + participants: fake notices that match a real booking, such as "cancelled because of the facility" or "a refund procedure is needed". They appear to know your booking, so they are harder to doubt
- Whether cancelled: material for a message posing as a refund for a cancelled booking
- Date of birth + gender + postal code: an impersonation inquiry that appears to know the answers to identity-check questions
- Member ID and number + name: a message posing as an inquiry to push an identity check. Quoting a member number is not proof that it is genuine
- Passwords, card information: the company says they are not included, so direct misuse of them is not expected within the scope of the notice
What operators of booking and member sites should review
The cause has not been published. This section does not judge the company's response; it sticks to what you can check on your own site from the facts in the notice.
Check how much information you entrust to your email-delivery vendor
According to the notice, the entrusted information included, beyond the email address, date of birth, member number and the history of ticket purchases and use. Passwords and card information were not entrusted, so they were not part of the leak. In our view, data that is not entrusted cannot leak from the vendor, which limits the harm. On your own site, line up what delivery really needs (an address and a name, about that much) against what you have entrusted, and check the gap. The company also says it will limit what it entrusts to vendors to the minimum necessary.
Check that you can invalidate the vendor's credentials the same day
According to the notice, the same day it received the vendor's report, the company stopped all email delivery and invalidated the admin-console password, API key and so on. List today where your vendor's console password, API keys and integration settings are, and who can invalidate them and when.
Decide who will confirm items and numbers when the vendor reports
According to the notice, the vendor's first report came on November 2, the report of the leaked number and items on November 3, and the company published the same day. Decide in advance who will ask the vendor, and by when, what was entrusted and how many records, if the vendor tells you data was taken. That shortens the time to disclosure.
Sources (public records)
The facts in this article are based on the public information below. We have not guessed at the cause, the period or the route of the intrusion, which have not been published.
- Asoview Inc., "Apology and notice regarding unauthorized access to an entrusted email-delivery service" (Japanese, November 3, 2026) — asoview.co.jp
- Asoview Inc., news list (Japanese, checked November 5, 2026) — asoview.co.jp/news
- Press (used only to check that the count and items match the company's notice): ITmedia NEWS (Japanese, November 4, 2026) — itmedia.co.jp
Update history
2026-11-05: First version, based on the company's notice of November 3 and its notice page checked on November 5 (last updated November 3). We found no follow-up newer than November 3. We will update when the affected members and the method of individual notification, the cause and period, whether the company's own systems were accessed, or the resumption of email delivery are announced.
Read next
- Similar cases (unauthorized access to email-delivery services): Unauthorized access to an email-delivery service (the vendor's disclosure) / Blastmail unauthorized access / Unauthorized access to the Cuenote FC email-delivery service
- Another incident at an email delivery contractor in the same period: Unauthorized access to the Hotto Motto newsletter delivery service (up to about 7 million records)
- Booking and ticket cases: skyticket unauthorized access / GETTIIS ticket buyer data leak
- Telling fake messages apart: What is phishing? / Smartphone security basics
- Other 2026 incidents: Data breaches and cyberattacks (Japan and abroad)