IDARE data breach (129,659 people): balances, transaction history and some ID document numbers leaked — what users should do

Everyone who registered for IDARE by September 27, 2026 is affected, including people who have closed their accounts. Which items leaked depends on how each person used the service, and the company says it will tell each person by email.

Do not act through the links in that email. Open the IDARE app yourself, or reach the official website from a bookmark or a search. Inquiries go through Contact in the app or the contact form on the website.

The company warns that suspicious emails, text messages and calls posing as the company or IDARE may arrive. It says it never asks for passwords, PINs, security codes or multi-factor authentication codes by email, text message or phone.

Because balances and transaction history leaked, a fake message may state your real balance or recent purchases. Correct details are not proof that a message is genuine. Do not open links or attachments in unexpected messages, and do not enter personal information (how to spot fakes: What is phishing?).

According to the company, logging in requires multi-factor authentication using the method you registered (a second check on top of your password). Giving that code to someone else switches this protection off.

For some people, the first 6 and last 4 digits of a credit card registered for top-ups, and the last 3 digits of a registered bank account, also leaked. The first 6 digits of a card number generally reveal which company issued the card and which brand it is.

That makes realistic-looking messages possible, such as "Suspicious use has been detected on your card ending ××××". Do not use the phone number or link in the message. Contact the company through the number on the back of your card, your bank book, or the official app of your bank or card company. The company says it does not hold full numbers, expiry dates, security codes or PINs, so they could not have been obtained.

The company says that as of October 13 no fraudulent transactions had been confirmed and balances were protected. Even so, it is worth looking once through your transaction history in the app for payments you do not recognise.

IDARE's help centre page on its compensation policy says that if you notice fraudulent use, you should first lock your card in the app, then choose "transaction I do not recognise" under Contact in the app and give the date and time, amount and merchant. Compensation only covers losses reported to the company and to a police station within 30 days of the date the loss occurred.

The same page says transactions made by the user, including those made under coercion by a third party, are not covered. Do not send money or make payments yourself because a caller or message tells you to.

For some people, the name, address, gender and purpose of use submitted for identity verification, and the ID document number, leaked. The notice does not say which documents (such as driver's licences) the numbers come from. Images of ID documents and faces, and My Number (Japan's individual number), did not leak, the company says.

Even without images, a document number combined with a name, address and date of birth can be used in applications made in someone else's name. As a precaution, consider registering a self-declaration with Japan's credit bureaus (CIC, JICC and the Japanese Bankers Association's credit information centre). Costs, how long the alert lasts, and how to check your own credit file are covered in If your Japanese driver's license data was leaked: what to do.

Also, from April 2027, online identity checks for opening bank accounts and similar services will in principle stop accepting photos of documents and move to reading the IC chip, which needs the physical card and its PIN (Japan's online ID checks move to IC-chip reading).

Among people who registered by October 2021, those who entered annual income, employer and similar details to use LADDER, a lending service that closed in October 2021, had that data leaked too.

Do not respond to contacts offering loans or financial help that rely on knowing your income or employer. Separately from this incident, Fivot warned in an announcement on April 7, 2026 about fake loan solicitations by people using the names of its employees or services. In it, the company says it never sends devices to customers asking them to enter and return personal or bank details, and lists fivot.co.jp, idare.jp and flex-capital.jp as its official websites.

If you sent money, shared an authentication code or PIN, or entered card details in response to a suspicious message, lock your card in the IDARE app and contact your card company or bank as well.

In Japan you can also call the police consultation line (#9110) or the consumer hotline (188). If you entered a password on a fake page, change it straight away, along with any other service where you used the same password (How to choose a password manager).

Customer-support tools such as ticketing and chat systems are often connected to member and transaction screens so staff can see a customer's situation. Start by listing, for each outside tool, which fields it can read and which credentials it uses (API keys or database accounts).

For data that day-to-day support never needs to read in bulk, such as ID document numbers or transaction history, either block the tool from reading it or limit access to one-record-at-a-time lookups.

The company says images of ID documents and faces, login passwords and similar data could not have been obtained, because they were managed so that the compromised system could not read them, or were not held at all.

Keeping sensitive data in a separate store with separate permissions limits what can be taken when one system is breached. Not holding data you do not need, such as full card numbers, is the most reliable protection of all.

This incident included annual income and employer details entered for a lending service that closed in October 2021. The notice does not say why that data was still held, and lending records can be subject to legal retention requirements.

In general, split data from closed services into what the law requires you to keep and what it does not; delete what you do not need, and move what you keep somewhere that day-to-day systems cannot read.

The notice says the unauthorized access happened multiple times between August 10 and September 27. The company's prevention measures include ongoing monitoring of software vulnerability information and monitoring and alerting on access logs.

An easy first step is to set, for each database account or API key used by an outside tool, a limit on records read per hour, and alert staff when reads exceed several times the usual level. Follow vulnerability information for the outside tools you use by subscribing to their providers' announcements and security notices.