For: people who used road service, or hold a contract that includes it, through a Japanese car insurance or car lease, and staff at companies that outsource work to a contractor. This article is based on the official notices of Prestige International, Sony Sonpo, AXA Direct Insurance and ENEOS, and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who used road service, or hold a contract that includes it, through a Japanese car insurance or car lease, and staff at companies that outsource work to a contractor.
- Confirmed so farSee the table ↓
- Personal data taken out of the company
- Names, addresses, phone numbers, email addresses
- Vehicle information (registration number, chassis number and similar)
5 more
- Accident and breakdown reception information
- Bank account information
- Count
- Credit card information (card numbers)
- Contacting customers whose card numbers were taken
Listed as possibly affected
- Information about partner companies
- Not yet confirmed
- Number of unique people (duplicates removed)
- Cause and full scope
- How affected customers will be individually notified (for the 3 card numbers, after talks with the card issuers)
1 more
- Effect on the forecast for the fiscal year ending March 2027 (under review)
- What to do nowSee the steps ↓
- Check your own insurer's or lessor's official notice
- Do not open links in messages posing as an insurer or road service
- If you used a credit card, check your statement
2 more
- If a bank account was involved, check your statements, and treat any request for a PIN as fake (our advice)
- Keep the receipt if you arranged road service yourself
- Where to verify (source)All sources ↓
- Prestige International Co., Ltd., second report of November 6, 2026 (timely disclosure, Japanese)
- Last checked
- As of November 7, 2026 (Japan time)
Follow-up plans and what we checked
In its second report of November 6, the company said 3 credit card numbers were among the data taken. It is investigating the cause and scope with an external specialist and will guide affected customers after talks with client companies. The effect on its results is under review, and it will announce promptly if it decides its earnings forecast needs revising or if new facts emerge. On November 7 we checked the November 6 second report.
What insurance and lease customers should do today
Check your own insurer's or lessor's official notice
The company describes those affected as customers who used road service entrusted by client companies. Those customers have a contract with an insurer or lessor, not with the company. So the way to find out whether you are in scope is your own provider's notice.
The notices we could read are in the table below. If your provider is not listed, that does not mean you are not affected. Open your provider's official site yourself and look in its news section. Do not use links in emails or texts.
Do not open links in messages posing as an insurer or road service
Names, addresses, phone numbers and email addresses were taken together with vehicle registration and chassis numbers and the content of accident and breakdown reports. With that, a convincing message can start from correct facts, such as the accident you reported or your registration number.
The company asks people to beware of suspicious calls, emails and texts posing as the company, group companies or insurers, and not to open unfamiliar URLs. Correct details are not proof of authenticity. Call back using a number on your contract or in your official app. See what phishing is for how to tell fakes apart.
If you used a credit card, check your statement
According to the company's second report of November 6, 3 credit card numbers were among the data taken. It has told the issuers of those cards and says it will contact the customers concerned after talks with the issuers. It says no secondary harm such as misuse has been confirmed so far.
The company asks customers who use credit cards to check their statements for charges they do not recognise, and to contact their card company if there is a suspicious charge. As our advice, call the number on the back of the card or in the official app.
If a bank account was involved, check your statements, and treat any request for a PIN as fake (our advice)
The company says bank account information is included for part of the records. If you used a bank account in connection with road service (our assumption, for example settling costs or a refund), check your statements for anything you do not recognise.
The company says it does not ask for passwords or bank PINs by phone or email in connection with this incident. In our view, whoever asks for a PIN or a one-time password should be treated as fake. If something looks wrong, talk to your bank and the police. The Japanese Bankers Association has general advice (in Japanese). None of the notices we could read asks people to open a new account. A similar case is covered in the Lashinbang article.
Keep the receipt if you arranged road service yourself
Sony Sonpo says calls to its reception desk are hard to get through and asks customers who could not get through and arranged help themselves to keep the receipt and contact its road service desk later. It says cases taken by phone are being dispatched without delay. We could not confirm a similar request from other providers, so check your own provider's notice.
Am I affected? What each client company says
You: contract with an insurer or lessor
Check that company's official notice yourself
Insurer / lessor: entrusts road service work
Sony Sonpo, AXA Direct Insurance, ENEOS and others
Prestige Core Solutions (group company of Prestige International): reception and dispatch system
Up to about 5.5M records taken, duplicates included
These are the contents of notices each company published on its own site. Only what each says about its own customers is included. The numbers are separate, so they are not added up.
Notices from the client companies
| Company | Notice date | What it says about its customers | Contact for customers |
|---|---|---|---|
| Sony Sonpo (Sony Assurance) | November 2, 2026 | It entrusts motor insurance road service to Prestige Core Solutions. It was told at about 11:00 on October 30 that the contractor's system had been accessed without authorisation. Only cases it entrusted to the contractor may be affected. Whether policyholder data was taken is being checked by the contractor, and it plans to announce the result on its website. | 0120-278-300 (9:00-18:00, weekends and holidays included) |
| AXA Direct Insurance | November 2, 2026 | Unauthorised access was found at a partner it entrusts road service to. The partner's system holds its customers' data, and it is investigating whether it leaked. Whether it leaked and the scope are not yet confirmed. Published as a first report; it will announce promptly if new facts affecting customers emerge. | 0120-577-546 (weekdays 9:00-17:00) |
| ENEOS (ENEOS Car Lease) | November 2, 2026 | Unauthorised access hit the system of Prestige Core Solutions, to which part of its car lease administration is entrusted, on October 29-30. It says its own systems were not accessed. It says its customers' data was found to have leaked; up to 8,500 contracts may be affected. Items: name, date of birth, address, phone number, vehicle information (model, registration number and similar) and contract details (plan, lease term and similar). It says credit card information, bank account information and login passwords are not included. Because its notice covers only its own customers, it says its figures and scope differ from the contractor's announcement. Affected customers will be notified in sequence. | Inquiry form on its site under 'other inquiries'; a dedicated phone line is being prepared |
| KDDI (au Bicycle Support) | November 5, 2026 | It entrusts to Prestige Core Solutions the handling of customer data needed to receive and arrange bicycle road service for "au Bicycle Support". It was told by the contractor on November 2 and says part of that service's customer data may have leaked. No count is given. The data KDDI gives the contractor does not include passwords, credit card information, bank account information or identity documents such as a driver's licence. No impact on KDDI's communications or service facilities. No secondary harm confirmed. Customers who may be affected will be told individually, in turn | KDDI Customer Center: 157 from an au mobile phone (free) or 0077-7-111 from other phones (free), 9:00-20:00, open every day |
How to read it: the companies do not describe the same scope
Prestige International says bank account information is included for part of the records. ENEOS says bank account information is not included in its customers' data (its notice covers only its own customers). Sony Sonpo says the contractor is checking whether policyholder data was taken. AXA Direct Insurance says it has not been able to confirm whether data leaked or its scope. KDDI says the data it gives the contractor does not include credit card or bank account information. Prestige International does not say which provider's customers the 3 card numbers in its second report belong to. Check your own provider's notice to see which items apply to you.
What happened (per Prestige International's notice)
The following is based on the company's notice of November 2, 2026, titled 'Notice and apology regarding personal information leakage due to unauthorized access to our group's business systems'.
October 29, 2026
The company detected unauthorised access to a group business system and took measures including invalidating the misused credentials.October 30
It confirmed the access was continuing and stopped the system. According to Sony Sonpo, it was told by the contractor at about 11:00 that day.November 2
The company published its notice. Sony Sonpo, AXA Direct Insurance and ENEOS published their own notices the same day.November 5
KDDI announced that part of the customer data of "au Bicycle Support" may have leaked from its contractor Prestige Core Solutions (it was told by the contractor on November 2).November 6
The company published a second report (timely disclosure): 3 credit card numbers were among the data taken.
- System concerned
- A business system used for road service reception and dispatch that group company Prestige Core Solutions handles for client companies
- Information taken
- Customers' names, addresses, phone numbers, email addresses, vehicle information (registration number, chassis number and similar), accident and breakdown reception information, and bank account information (part of the records). The second report adds credit card information (card numbers) in 3 cases, recorded in part of the reception records
- Response
- Invalidated credentials, stopped the system, and is investigating cause and scope with an external specialist. A report to the Personal Information Protection Commission and consultation with the police are in progress. In the second report it says it has told the issuers of the 3 cards and will contact the customers after talks with the issuers
- Operations
- Road service continues through an alternative operation while the system is stopped
- Next
- Guidance to affected customers after talks with client companies; system fixes and stronger monitoring; the effect on results is under review, and it will give prompt notice if the earnings forecast needs revising (second report)
- Contact
- Public Relations and IR Department, Group Management; phone 03-5213-0826 (weekdays 10:00-18:00), email inquiry@prestigein.com
What is known and what is not
The state as of November 7, 2026. We will rewrite the status column when more is published.
| Item | What the notice says | Status |
|---|---|---|
| Personal data taken out of the company | Confirmed that it was taken out | Leak confirmed (company) |
| Names, addresses, phone numbers, email addresses | Customers who used road service | Leak confirmed (company) |
| Vehicle information (registration number, chassis number and similar) | Same | Leak confirmed (company) |
| Accident and breakdown reception information | Same | Leak confirmed (company) |
| Bank account information | Included for part of the records; which details is not stated | Leak confirmed (company, part) |
| Count | Up to about 5.5 million; a maximum including duplicates | Confirmed (company, maximum) |
| Unique people | Being checked | Under investigation |
| Credit card information (card numbers) | 3 cases among the data taken, recorded in part of the system's reception records (second report of November 6). Not confirmed at the time of the November 2 notice | Leak confirmed (company, 3 cases) |
| Contacting customers whose card numbers were taken | The issuers of those cards have been told. Customers will be contacted after talks with the issuers | Confirmed (company; method under investigation) |
| Information about partner companies | Some may be included; being checked | Possible (company) |
| Secondary harm such as misuse | None confirmed so far | Not confirmed (company) |
| Cause | Under investigation with an external specialist; misused credentials are mentioned but not the route | Under investigation |
| Effect on results | Being examined (the same in the second report); it will announce if the forecast published on October 29, 2026 needs revising | Under investigation |
| Individual notice to customers | To be done after talks with client companies (for the card numbers, the card issuers) | Under investigation |
How to read it: up to 5.5 million records does not mean 5.5 million people
The company says the count is a maximum including duplicates and that the unique number is still being checked. The same person may be counted several times across requests, so the number of people may be lower. This is our reading of the company's wording; the actual number has not been published.
What the combinations of leaked items can lead to
In general, these combinations can be used as follows. It does not mean this has happened here. The company says it has confirmed no secondary harm so far.
- Name, phone number, email address and address together: convincing calls, texts and emails with correct names and addresses can be made
- Registration and chassis numbers with the content of an accident or breakdown report: a message can start from a real event, such as 'about your recent accident'. A registration number is hard to change, so the caution lasts
- Bank account information (part) with a name: it can be used in messages that pretend to confirm an account or PIN under the cover of a refund or procedure. Which account details are involved has not been published
For companies that use contractors: what the disclosed timeline lets you check
In this case the system is used for work that Prestige Core Solutions takes on from client companies. The cause has not been published, so this section sticks to what the timeline shows. It is not an assessment of the company's response.
Check that you know which data items and how many records you have handed to contractors
Some clients count their own customers separately from the contractor's announcement. A client that does not know what it has handed over cannot explain the effect on its own customers. Make a list of the items you pass to each contractor today.
Decide who receives a contractor's incident call and how a customer notice gets approved and published
Naming the person who takes the call and agreeing how a customer notice is drafted, approved and posted shortens the time from call to notice.
Prepare what you will tell customers if the reception desk goes down
Sony Sonpo explains that calls to its desk are hard to get through and how receipts for self-arranged help are handled. Decide beforehand what you would tell customers if a contractor's system stops: alternative contacts and how costs are treated.
Sources (public record)
The facts in this article are based on the following public information. We have not guessed at the route or method of entry, which have not been published.
- Prestige International Co., Ltd., second report of November 6, 2026 (timely disclosure, Japanese) — prestigein.com
- Prestige International Co., Ltd., notice of November 2, 2026 (Japanese) — prestigein.com
- Sony Assurance (Sony Sonpo), notice posted November 2, 2026 (Japanese) — from.sonysonpo.co.jp
- AXA Direct Insurance, notice of November 2, 2026 (Japanese) — axa-direct.co.jp
- ENEOS, notice of November 2, 2026 (Japanese) — eneos.co.jp
- KDDI Corporation, notice on the possible leak of "au Bicycle Support" customer data through unauthorized access to its contractor Prestige Core Solutions (November 5, 2026, Japanese) — au.com
Update log
2026-11-07: Reflected the company's second report of November 6: 3 credit card numbers were among the data taken (not confirmed in the November 2 notice). It also records that the issuers have been told, that customers will be contacted after talks with the issuers, that no secondary harm is confirmed, that road service continues, and that the effect on results is under review, and adds KDDI's November 5 notice on au Bicycle Support to the client table.
2026-11-04: First version, based on Prestige International's notice of November 2, 2026 and the notices of Sony Sonpo, AXA Direct Insurance and ENEOS. The count is a maximum including duplicates; the unique number, the cause and how affected customers will be notified are not yet published, and we will update when they are.
Read next
- Similar cases: Times Car unauthorized access / Carsensor net unauthorized access
- A case that included bank account data: Lashinbang unauthorized access
- Scam follow-ups: What is phishing?
- Other 2026 incidents: Data breaches and cyberattacks (Japan and overseas)