World subsidiary Tin Pan Alley (RAGTAG operator, per press) breach (about 1.2 million records in total): names, addresses and phone numbers may have leaked — what members should do

The data that may have leaked can include records with name, address, phone number and email address together (the notice does not say every record has all six items). With such records, someone can write a message that gets your name and address right.

If a message about a "coupon as an apology", "re-confirming your member information" or "payment for a buyback" arrives, do not open its links. Open the official site or app yourself and check there. The same goes for fake texts (smishing). See What is phishing for how to tell them apart.

The notice says no leak of credit card or other payment data has been confirmed. Passwords do not appear among the items that may have leaked, but the notice does not state that they are excluded.

Someone who gets your name and address right is not proving anything, because that is exactly what may have leaked. If you are asked for a card number or password in the name of an apology or refund, treat it as fake right away.

Unlike an email address, a date of birth cannot be changed. Many banks, shops and mobile carriers use it as the answer when you contact them or reset an account.

Check that you have not used your birth date as a password or secret-question answer, and replace it if you have. Turn on multi-factor authentication instead of relying on a password alone, so an attacker who knows your birth date still has a harder time.

Passwords are not among the items in the notice, so there is nothing to change because of this incident alone. But email addresses are often used as login IDs, and a reused password lets one leak spread to other services.

A password manager is the realistic way to take stock. You can check whether a reused password appeared in past leaks with how to check if your password has leaked.

Phone numbers and addresses are hard to change. Scam calls, texts and mail may reach you for some time, under names other than this incident.

Turning on your phone's spam call and spam text filters reduces how many get through (see smartphone security basics).

The company says it is preparing individual emails to members, but the notice gives no sender address or timing. Sender names can be faked, so even if an email arrives, do not log in or type anything through its link. Compare it with the notice on World's official website.

The contact listed in the notice is World Co., Ltd. (tel. +81-3-6887-1300). That is the contact printed on the notice, and as of November 1, 2026 the notice does not say whether a dedicated desk for members has been set up. Use a contact listed on an official site, not a number or URL written in a message you received.

According to the notice, the access was on October 17 and detection on October 28, about 11 days apart. The route was blocked the same day as detection. The longer detection takes, the more data can be extracted, so first set up records and alerts that notice large amounts of data being read from a business server.

A first step: record how many rows are read and how much is transferred from the server that holds member data every hour, and alert someone's phone when it differs a lot from normal (see rate limiting and abuse control).

The notice says the affected members and the details of a count of about 1.2 million records are still being confirmed. When several services' member data sits on the same server, one breach widens the range and makes it slower to work out who is affected.

Decide in advance not to keep items the business can run without, such as date of birth or gender, and to delete data after members withdraw. That keeps the range of a leak smaller.