For: people who were registered with Toku-Kai, the perks service for Credit Saison cardholders provided by Benefit One (including people who have withdrawn), and businesses that outsource work to contractors. This article is based on Benefit One's official notice and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 30, 2026Not yet known
- Cause (how the attacker got in)
- Final number of people affected
- Whether any misuse occurs later
- Completion of individual notices
- When Toku-Kai reopens
The company wrote in its October 28 notice that the investigation continues, that the number may change, and that it will announce additional findings promptly on its website. As of October 30, no follow-up notice (second report) on this matter appears in the company's news list.
What former and current Toku-Kai members should do today
Check whether you are affected (people who withdrew are included)
According to the notice, those affected are people registered with Toku-Kai, 29,465 of them, and the figure includes some people who have withdrawn. The company says it will contact affected members one by one at their registered email address. For people it cannot reach, for example because they withdrew, it says the announcement and the contact desk replace individual notice.
The notice says you can ask the Benefit One contact desk (email security-support@benefit-one.co.jp) whether you are affected. To check whether an email you received is genuine, do not use links in it; compare it with the company's announcement on an official site you find and open yourself.
Do not open links in messages posing as the company or its partners
With name, date of birth, gender, postal code, email address and customer number together, someone can write a convincing fake message with the right name and numbers. The company warns about suspicious emails, calls and text messages posing as the company, its partners or its contractors, and says it never asks members for credit card numbers or passwords.
Since the company plans to email affected members, a fake "confirm whether you are affected" or "re-register your card" message made to look similar is conceivable. Treat any message that asks for a card number or password as fake and check on an official site you open yourself (how to spot them: What is phishing?).
The notice does not ask for a card-number change. Check your statement as a precaution
The company says it does not hold credit card numbers, expiry dates or security codes in the company or the affected system. A payment processor manages them, and the processor's system was not reached, so, it says, no card data leaked. The notice does not advise changing card numbers.
The company also says some of its authentication-related information for linking to the payment system may have leaked, and that combined with the management number, fraudulent processing of membership-fee payments had been possible. It changed that information on October 26 and says that route is no longer usable for fraud. As a precaution, check your statement for Toku-Kai membership-fee charges you do not recognize.
The notice does not ask you to change your password
Passwords are not among the leaked items listed, and the company's notice does not ask members to change them. If you want to use this as a chance to review weak or reused passwords on other services that use the same email address, a password manager is worth considering, but it is not a required step for this incident.
A contractor was breached, and a partner's members' data leaked
According to the announcement, the leaked data came from a system run by a contractor for a service Benefit One provides to a partner's members. The company states that the data did not leak from a system managed by Credit Saison.
From a member's point of view, a card company, the company that provides the service, and the contractor that does its work are all involved, and this unauthorized access happened in the contractor's system. A past example of the same type is the JR East, VIEW Card and JR Kyushu email leak, where several organizations announced separately about the same cause. This case may not follow the same course.
Credit Saison
Offers the service to its cardholders. Data did not leak from its systems
↓→
Benefit One
Provides Toku-Kai
↓→
Contractor's system
Where the unauthorized access happened
Members' data leaked from a system run by the contractor (company's announcement).
What happened (from Benefit One's announcement)
The following is based on Benefit One's October 28, 2026 announcement (PDF) and Credit Saison's notice of the same day.
October 14, 2026, 13:45
The unauthorized access occurs at the contractor and is repeated intermittently until October 20 at 14:05.October 21
The contractor detects part of the unauthorized access (10:30). Benefit One receives the report from the contractor (11:40) and temporarily suspends the service (17:00).October 23
Reported to the Personal Information Protection Commission (preliminary report).October 24 to 25
The contractor detects additional unauthorized access that had not been identified as of the 21st. Benefit One receives a second report on the 25th at 18:50.October 26
To prevent further harm, Benefit One changes the authentication-related information used to link to the payment system.October 27
At 19:00, receives a third report from the contractor and recognizes that part of the authentication-related information may have leaked.October 28
Benefit One confirms that, because of the October 26 change, fraudulent processing through that route is no longer possible. Publishes its apology and notice.
- Service affected
- Toku-Kai (a service for Credit Saison Co., Ltd. cardholders). The company says the data did not leak from Credit Saison's systems
- Leaked items
- Name, furigana, date of birth, gender, postal code, email address, customer number, enrollment and withdrawal information, and a management number used for membership-fee payment processing. Which items apply varies by member, depending on what they registered
- About the management number
- A number used to link member information to payment information; it is not a credit card number
- Possibly leaked, separate from member data
- Some of the company's authentication-related information used to link to the payment system. Combined with the management number, fraudulent membership-fee payment processing had been possible; it was changed on October 26
- Said not to be included
- Card information such as card numbers, expiry dates and security codes (managed by a payment processor, whose system was not reached)
- Misuse status
- Checking the period until the authentication information was changed, no fraudulent payment attributable to this incident was found. No harm from misuse of this data has been confirmed
- Actions taken
- Temporary suspension of the service, blocking of the known unauthorized access routes, change of the authentication-related information
- Ongoing actions
- Joint investigation with related parties and the contractor, investigation by a third-party specialist firm, reporting to the Personal Information Protection Commission, consultation with the police, investigation of the scope and cause
What is known and what is not
The state as of October 30, 2026. When there is a follow-up, the status column of this table will be rewritten.
| Item | What the announcement says | Status |
|---|---|---|
| Period of unauthorized access | Intermittently from October 14, 2026, 13:45 to October 20, 14:05. Additional access not identified as of the 21st was detected on October 24 to 25 | Confirmed (company) |
| Number of people | 29,465 (includes some who withdrew). May change as the investigation continues | Confirmed (for now; may change) |
| Name, furigana, date of birth, gender, postal code, email address | Varies by member (depends on registration) | Leak confirmed (company) |
| Customer number, enrollment and withdrawal information | Same | Leak confirmed (company) |
| Management number for membership-fee payment processing | Not a credit card number | Leak confirmed (company) |
| Authentication-related information for linking to the payment system | Some may have leaked. Changed on October 26 | Possible (company) |
| Card number, expiry date, security code | Not held; no leak | Not included (company) |
| Passwords | Not listed among the leaked items | Not stated |
| Fraudulent payment processing | None attributable to this incident has been found | Not confirmed (company) |
| Harm from misuse | Not confirmed at this time | Not confirmed (company) |
| Cause and intrusion route | A contractor's system received unauthorized third-party access. Details under investigation | Under investigation |
| Individual notices | Sent one by one to registered email addresses | Planned |
| Toku-Kai reopening | After the cause is identified and prevention measures are completed; timing to be announced on the company's website | Not set |
How to read this: 'not confirmed' does not mean 'did not happen'
The company writes that fraudulent payments and harm from misuse have "not been confirmed". It says the investigation continues and the number may change. Names, birth dates and email addresses have already leaked and can be used later in fake messages, so the fact that card data is not included and the need to be wary of messages are separate matters.
What combinations of leaked items can lead to
In general, combinations like the following can lead to abuse of this kind. This does not mean it has happened here.
- Name + date of birth + email address + customer number: a convincing "please confirm" or "procedure notice" email with the correct name and numbers can be written
- Email address + the service name (Toku-Kai): an entry point for messages posing as "Toku-Kai fees", "withdrawal procedures" or "card re-registration"
- Enrollment and withdrawal information: people who have withdrawn can also receive messages posing as "withdrawal confirmation"
For businesses that use contractors: what the disclosed timeline lets you check
The cause has not been disclosed. This section does not assess the company's or the contractor's response; it limits itself to what businesses that use contractors can check on their own side, based on the disclosed timeline.
- A contractor can find more unauthorized access later. In the timeline, additional access not identified as of the 21st was found on October 24 to 25, and the reports came in three parts. Ask whether you can agree in the contract, in advance, that one report may not be the last and how often you will receive interim updates.
- Keep the authentication information for payment integrations replaceable. The notice says the company changed the integration's authentication information to prevent further harm and later received a report from the contractor that part of it may have leaked. In general, if you hand integration credentials to a contractor, knowing the steps to change them at any time, and what would be affected when you do, shortens the time to contain harm.
- Take inventory of what the contractor holds. Here the contractor's system held items from member names to enrollment and withdrawal information and the payment management number. Review regularly whether the items the contractor holds are within what the work needs, and whether information on withdrawn members needs to be kept.
Sources (public records)
The facts in this article are based on the public information below. Intrusion routes and methods that have not been disclosed are not speculated about.
- Benefit One Inc., "Apology and notice regarding the leak of partner members' personal information due to unauthorized access to our outsourcing contractor" (October 28, 2026, PDF, in Japanese) — corp.benefit-one.co.jp
- Credit Saison Co., Ltd., "Regarding the personal information leak in Toku-Kai provided by Benefit One Inc." (October 28, 2026, in Japanese) — saisoncard.co.jp
- ITmedia NEWS (October 29, 2026, in Japanese). Used to confirm consistency with the official announcement — itmedia.co.jp
Update history
2026-10-30: First version. Based on Benefit One's October 28 announcement (PDF) and Credit Saison's notice of the same day. Confirmed that, as of October 30, no follow-up (second report) on this matter appears in the company's news list. The company says it will announce additional findings, and this article will be updated when they are published.
Read next
- Same type of case: JR East, VIEW Card and JR Kyushu possible email leak
- Spotting follow-on scams: What is phishing? / How password managers work and how to choose one
- Other 2026 incidents: Data breaches and cyberattacks of 2026 (Japan and worldwide)