For: people with a GETTIIS account, which is used to buy tickets for concerts, stage shows, sports and events in Japan. This article is based on Linkstation Inc.'s official notices on gettiis.jp. It does not cover how attacks work.
Developing: this article will be updated as the organisation publishes more
As of October 31, 2026Not yet known
- Number of people affected (counts are per item)
- Period and range of members covered, including former members
- Details of the cause
- Results of the investigation and any compensation
This is a late first report on our side: the company announced the incident on October 19 and published a second report on October 20, and we only began covering it on October 31. As of October 31 we found no notice newer than the second report on the company's notice list (later notices there concern maintenance and withdrawal). The company says it is still investigating the cause and scope and will announce further findings on its site.
What GETTIIS members should do today
Change the GETTIIS password
The company asks all members to change their password even though it says passwords were stored as hashes. Steps from its notice: log in, open the member-information edit page from the button at the right edge of the screen, choose password edit, and enter the new password. In an update on October 20 at 20:00 it said passwords can be 8 to 64 characters of half-width letters and numbers, with symbols optional, and that those who already changed theirs can keep them. A longer password is better; a password manager makes that easy.
Change the same password everywhere else
A leaked email address plus a password from another site is a common way for accounts to be taken over. If you reused your GETTIIS password anywhere, change it there to a different one and turn on two-step verification. How to choose is in choosing multi-factor authentication, and how to check if your password leaked explains the checks.
Treat messages with your name, phone number or email as suspect
The leaked items include name, phone number and email address (each about 310,000 records). A message that uses them looks genuine, but it is also exactly what someone with this data could send. For anything that says "GETTIIS", "your tickets" or "your card", do not use the link in the message; open the site from a bookmark and check the notices page. The company says it will not ask for passwords, card numbers or PINs by email, phone or SMS. Background: what phishing is.
Check your card statement
If you registered a card, the company says the leaked data is encrypted partial information (the first and last four digits, the cardholder name and the expiry date) and cannot be used for a card payment on its own. Even so, look through your statement for charges you do not recognize. If you see one, or if you typed card details into a page you reached from a message, call your card issuer and ask about stopping and reissuing the card.
See what you had registered, and decide whether to keep the account
The company says you can check your own registered items by logging in, opening MENU and then the registration-edit page: profile (member ID, name, phone number, email address, postal code, gender, date of birth) and card registration. The items you see there correspond to what leaked, but if you changed them after the access, they may differ from those at the time of the leak. If you will not use the account, the company's notice of October 24 explains withdrawal. Check your ticket purchase history first, then withdraw; the page says registered member information is deleted on completion.
What happened (from Linkstation Inc.'s notices)
The company posted the first report on October 19, 2026 and the second report on October 20. The dates and numbers below are from the second report.
October 18, 2026
The company noticed suspicious access to its systems and began an investigation. It found that from about 0:00 to about 7:00 that day a third party exploited a vulnerability in the Gettii-Lite program and obtained GETTIIS member data.October 19
First report published. It listed the items that had leaked or might have leaked (member ID, name, phone number, email address, postal code, gender, date of birth, hashed password, partial card information), gave no counts, and said the range was still being investigated. The first report used wording such as "leaked or may have leaked"; the second report on October 20 confirmed the leak. A page on how to change the password was posted the same day.October 20
Second report published, with counts per item and a way to check your own registered items. The company said the server was switched and the vulnerability dealt with, and that individual emails had gone to the affected members. At 20:00 the password rules page was updated to 8 to 64 characters.October 24
A notice on how to withdraw from GETTIIS was posted.
- Service affected
- GETTIIS, a ticket-purchase service for customers. The access was to the server of Gettii-Lite, a performance-registration service for organizers; the company says Gettii and Gettii-EC run in a different environment and no effect has been confirmed there
- Leaked items (counts per item)
- Member ID 317,971; hashed password 311,451; email address 311,426; name 309,759; phone number 309,668; card-related information 29,515; gender 5,900; date of birth 5,192; postal code 489. The company states these are counts per item, not a total number of people
- Card-related information
- The first four and last four digits of the number, the cardholder name and the expiry date, in encrypted form. The company says it does not store full card numbers or security codes, and that the leaked data alone cannot be used for card payments
- Passwords
- Stored as hashes; the company says plaintext passwords did not leak. How they were hashed is not published
- Cause
- Exploitation of a vulnerability in the Gettii-Lite program by a third party (company). Details not published
- Response
- Server switched, vulnerability dealt with, affected members emailed individually, reports to the relevant bodies made, consultation with the police continuing (company)
- Other leaks
- None confirmed apart from the items above, as of the October 20 report
- Contact
- The company's personal-information desk (PMS), pms@linkst.jp, handled 24 hours a day in turn (as written in its notice)
Gettii-Lite (organizers)
A third party exploited a vulnerability (about 0:00 to 7:00, Oct 18)
GETTIIS (ticket buyers)
Member data was obtained
Gettii / Gettii-EC
Run in a separate environment; no effect confirmed (company)
The notices do not describe how the two are connected, so no path is drawn.
What is known and what is not
State as of October 31, 2026 (reflects the second report of October 20 and the notices of October 20 and 24). This table will be rewritten when the company publishes more.
| Item | What the company says | Status |
|---|---|---|
| Unauthorized access | Third party exploited a vulnerability in the Gettii-Lite program, about 0:00 to 7:00 on October 18 | Confirmed (company) |
| Leak of GETTIIS member data | Confirmed leaked | Confirmed (company) |
| Member ID | 317,971 | Confirmed (company) |
| Name, phone number, email address | 309,759 / 309,668 / 311,426 | Confirmed (company) |
| Gender, date of birth, postal code | 5,900 / 5,192 / 489 | Confirmed (company) |
| Hashed password | 311,451. Plaintext not leaked | Confirmed (company) |
| Card-related information | 29,515. First and last 4 digits, name and expiry date, encrypted | Confirmed (company) |
| Full card number, security code | The company does not store them | Not included (company) |
| Items other than the above | None confirmed so far | Not stated |
| Number of people affected | Counts are per item and not a total | Number not published |
| Period of membership covered, former members, non-members | Not stated | Not stated |
| Gettii and Gettii-EC | Different environment, no effect confirmed | Not confirmed (company) |
| Details of the cause | Vulnerability in Gettii-Lite program. Details not published | Partly published |
| Organizers and venues involved | Not stated in the notices | Not stated |
| Abuse of the leaked data | The company asks members to watch for messages that take advantage of the incident. No actual case published | Not stated |
On venues: GETTIIS is used by many organizers and venues to sell tickets, but the company's notices do not name any. We looked for official notices from organizers and venues and found none that we could open and confirm, so none are listed here. If you bought through an organizer, look at that organizer's own site.
What name, phone number and email together can be used for
The company lists name, phone number and email address as leaked for about 310,000 records each. In general, that combination makes a message look like it came from a company you deal with. It can be used for:
- messages that say "your ticket purchase" or "your account" needs action, sent in your name to your own phone number or email
- impersonation of the ticket service asking you to re-enter your card for a refund or a "verification"
- attempts to log in to other services with your email address and a reused password
This does not mean any of these have happened for this incident; the company has not published an abuse case. The lines to hold are the ones in the steps above: use a bookmark, and nobody asking for your password or card number by message is the company.
What other ticketing and membership services can take from it
This part is general and does not claim anything about the cause. The company wrote that the access was to a server of the organizer-facing service and that member data of the customer-facing service was obtained, while two other services in a separate environment were not affected. For anyone who runs a service that has both a seller side and a buyer side:
- list which systems can reach the buyers' member data, including the seller-side tools, and who can reach them
- keep the buyer data in as few places as possible, and keep partial and encrypted card data only if you need it
- decide how you will answer the first question members ask: "am I in this, and what exactly did you have on me?" The company here gave members a way to see their own registered items
More on the same set of items: skyticket (reservation data and passwords), PhotoGoods card skimming.
Sources (public record)
Facts in this article rest on the following public notices. Items that were not published are not guessed.
- Linkstation Inc., "Apology and notice of leak of GETTIIS member information through unauthorized access (second report)" (October 20, 2026; title translated) — gettiis.jp
- Linkstation Inc., first report (October 19, 2026) — gettiis.jp
- Linkstation Inc., how to change your password (October 19, updated October 20) — gettiis.jp
- Linkstation Inc., how to withdraw from GETTIIS (October 24) — gettiis.jp
- Notice list on GETTIIS (checked October 31) — gettiis.jp
Update history
2026-10-31: First version. Based on the company's first report (October 19), second report (October 20), the password notice (October 19, updated October 20) and the withdrawal notice (October 24). No newer report was found on October 31. This article was written after the announcement, so it is later than the company's notices.
Read next
- Reservation data and passwords: skyticket data breach
- Card data on a checkout page: PhotoGoods card skimming
- Protect your accounts: choosing multi-factor authentication / choosing a password manager
- Why hashing matters: password hashing
- Other incidents in 2026: list of data breaches and cyberattacks