For: workers (users) registered with Sharefull, especially people who registered a bank account, an emergency contact or residence status. This article is an explanation based on Sharefull's official notices; it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
workers (users) registered with Sharefull, especially people who registered a bank account, an emergency contact or residence status.
- Confirmed so farSee the table ↓
- Occurrence, detection, blocking
- Cause
Listed as possibly affected
- Count
- Name and name in kana
- Phone number, email address, address, date of birth
5 more
- Bank account information for salary payments
- URL of the face photo
- Emergency contact
- Residence-status-related information
- Registration date, number of jobs worked, preferences
- Not yet confirmed
- Cause (how the access happened)
- Confirmed items and final count
- How affected users will be contacted
2 more
- Whether face photo data was affected
- Whether the data has been misused
- What to do nowSee the steps ↓
- Do not respond to contact that uses Sharefull's or an agency's name
- Check the deposits and withdrawals on your salary account
- Tell the family members you listed as emergency contacts
3 more
- Be careful of contact about your residence status (foreign nationals)
- If you are worried, use the official contact point
- If you entered details or sent money, get help right away
- Where to verify (source)All sources ↓
- Sharefull, "To our users: apology and notice about the possible leak of personal information due to unauthorized access to the internal management system" (November 9, 2026, in Japanese)
- Last checked
- As of November 11, 2026
Follow-up plans and what we checked
The company says no new unauthorized access or further leak has been confirmed. It says it is proceeding with its notification to the Personal Information Protection Commission and has reported the matter to the police. When we checked the company's notices on November 11, 2026, we found no follow-up after the November 9 notices.
What workers should do today
Do not respond to contact that uses Sharefull's or an agency's name
The company says suspicious emails, text messages and calls pretending to be the company or related agencies may arrive. If you get contact you do not recognize, do not open the URL, do not open attachments, and do not enter PINs or personal information. Delete suspicious emails.
The company says it never asks for bank PINs or passwords by phone or email. To check on a job, open the app yourself rather than following a link in a message. For how to spot fakes, see What is phishing?.
Check the deposits and withdrawals on your salary account
The information that may have leaked includes bank account information for salary payments. The company says PINs and passwords are not included, but someone who knows your account details can more easily make a message that looks like a transfer notice (this site's view). Check your statement in your bank's app or passbook.
If an unexpected deposit arrives and you are told "I sent it by mistake, please send it back" or "I paid your wages, please confirm", do not send money yourself. Contact your bank first and ask about having the transfer reversed. The notice does not ask users to change their accounts; if you are worried, talk to your bank.
General warnings are available from the Japanese Bankers Association and the National Police Agency (both are general warnings in Japanese, not about this incident). For a similar case involving bank details, see the Lashinbang incident.
Tell the family members you listed as emergency contacts
The information that may have leaked includes emergency contacts (the relationship to the user and a phone number). The relationship is given with examples such as parent or spouse. In general, once someone has a family member's phone number and relationship, they can target the family with a call such as "This is Sharefull, there has been an accident" or "There is a problem and money is needed urgently".
Tell the family members you listed that even if someone calls in Sharefull's name, they should not hand over money or information until they have checked with you directly. Agreeing on a code word also helps. The notice does not say how the company would contact emergency contacts.
Be careful of contact about your residence status (foreign nationals)
The information that may have leaked includes residence-status-related information. The notice does not detail what this covers. In general, there are scams in which callers claiming to be immigration or police officers say "there is a problem with your residence status" or "you must pay a fee or you cannot stay", and ask for money or personal information by phone or text.
Public agencies do not, in general, ask for money transfers by phone or text. Hang up and contact the Immigration Services Agency or your local government yourself through their official contact points. You can also call the police consultation line (#9110). If a call in Japanese worries you, ask a colleague or a support organization you trust to sit with you.
If you are worried, use the official contact point
The contact points in the notice are the dedicated inquiry form about the unauthorized access and the dedicated phone line 050-5794-2002 (weekdays 9:00 to 18:00 Japan time). The form accepts inquiries on weekdays 9:00 to 18:00 and on weekends and holidays 10:00 to 18:00.
Use the contact points on the official notice, not a number written in an email or text message.
If you entered details or sent money, get help right away
If you entered bank or personal details on a page linked from a suspicious message, or sent money, contact your bank immediately. In Japan you can also call the police consultation line (#9110) or the consumer hotline (188). If you are worried about misuse of ID documents, see What to do when a driver's license or ID document leaks; for suspicious activity on an account, see How to check for unauthorized access.
What happened (from the Sharefull notices)
On November 9, 2026, Sharefull posted three notices on its website: one for users, one for corporate clients (employers), and a news release covering both. Everything below comes from those notices.
November 4, around 23:30
A third party gained unauthorized access to the internal management system.November 5, around 09:45
The company detected the unauthorized access. It blocked the access route around 14:00 the same day.November 6 to 8
The company investigated the scope. It says no new unauthorized access or further leak has been confirmed.November 9
The notices were posted. The company says it is proceeding with its notification to the Personal Information Protection Commission and has reported the matter to the police. After confirming the route was blocked, it continues to provide the service as usual.
- Occurrence
- Around 23:30 on November 4, 2026 (unauthorized access by a third party to the internal management system)
- Accounts affected
- Up to about 7.5 million individual accounts (may have leaked)
- Information that may have leaked
- Name and name in kana, phone number, email address, address, date of birth, bank account information for salary payments, URL of the face photo, emergency contact (relationship to the user, phone number), residence-status-related information, other account attributes (registration date, number of jobs worked, preferences)
- Not included
- Bank PINs and passwords. Pay and points information (no improper viewing or operation confirmed), contract and work data, images of ID documents. The company does not hold My Number or credit card information
- Cause
- Unauthorized access by a third party to the internal management system (route and method not disclosed)
- Contact
- Dedicated form; dedicated phone line 050-5794-2002 (weekdays 9:00 to 18:00 Japan time)
What is known and what is not
This table is based on the company's notices of November 9, as of November 11, 2026. The company presents the items listed here as "information that may have leaked". When follow-up notices appear, we will update the status column.
| Item | What the notice says | Status |
|---|---|---|
| Occurrence, detection, blocking | Occurred around 23:30 on Nov 4, detected around 09:45 on Nov 5, route blocked around 14:00 the same day | Confirmed (company) |
| Count | Up to about 7.5 million individual accounts | Possible (company; upper figure) |
| Name and name in kana | Among the information that may have leaked | Possible (company) |
| Phone number, email address, address, date of birth | Among the information that may have leaked | Possible (company) |
| Bank account information for salary payments | May be included. PINs and passwords are not included | Possible (company) |
| Bank PIN and password | Not included | Not included (company) |
| URL of the face photo | The URL of the server where it is stored may be included | Possible (company) |
| Face photo data (the photo itself) | Managed on a separate server; access has been blocked. The notice does not say whether it leaked | Not stated |
| Emergency contact | Relationship to the user (parent, spouse, etc.) and phone number may be included | Possible (company) |
| Name of the emergency contact | Not listed as an item | Not stated |
| Residence-status-related information | May be included. No detail on what it covers | Possible (company) |
| Registration date, number of jobs worked, preferences | Among the information that may have leaked | Possible (company) |
| Pay and points information | Not included. No improper viewing or operation confirmed | Not included (company) |
| Contract and work data | Not included | Not included (company) |
| Images of ID documents | Not included | Not included (company) |
| My Number and credit card information | Not held | Not included (company) |
| Cause | Unauthorized access by a third party to the internal management system | Confirmed (company) |
| Route and method of access | Not stated | Not stated |
| Misuse | No confirmed misuse found in the notice. It warns about suspicious contact | Not stated |
| Further leak | No new unauthorized access or further leak confirmed | Not confirmed (company) |
| Individual notices | Not found in the notice for users. The notice for employers says affected users will be contacted in turn, such as by email | Planned (stated in the business notice and news release) |
Notice for employer companies (a separate count)
The corporate notice of the same day says that for up to about 7,500 companies, the company name, phone number, address, postal code, and the contact person's name, department and title, email address and phone number, plus part of the sales management data, may have leaked. This is separate from the 7.5 million individual accounts, and the two cannot be added together.
The company says My Number, pay and points, contract and work data, credit card information, images of ID documents and payment data managed by payment agencies are outside the scope because it does not hold them on the system. It says no leak has been confirmed for "Sharefull Shift" so far. It says all functions, including job postings, matching, attendance management and face photo display, are available as usual. Employer contacts should check any sales contact or billing in Sharefull's name through their account manager or an official contact point.
What bank details, emergency contacts and residence status can be used for
The table below is what can generally happen with these combinations of items. It does not mean it has happened in this incident.
| Item that may have leaked | What can generally happen | What workers should do |
|---|---|---|
| Name + phone number + email address | Genuine-looking Sharefull messages, texts pretending to check a job or pay | Do not open links; check in the app |
| Salary bank details + name | Messages made to look like a transfer; requests to return a "mistaken" transfer | Do not send money yourself; ask your bank |
| Emergency contact (relationship and phone number) | Calls to family members pretending there is trouble | Tell your family; have them check with you directly |
| Residence-status information + name + phone number | Demands for money or information citing your residence status | Do not comply; check with a public agency yourself |
| Address + date of birth | Contact that asks for "identity verification" to get the remaining details | Do not answer, even if they state your date of birth correctly |
What information that may have leaked can be used for
- Genuine-looking emails, texts and calls in the name of Sharefull or an agency
- Requests to return or confirm money, using a deposit into your account
- Impersonation calls to the family listed as emergency contacts
- Demands for money citing residence status
What the notices say is outside the scope
- Bank PINs and passwords
- Images of driver's licenses and other ID documents
- Pay and points information (no improper viewing or operation confirmed)
- My Number and credit card information (not held by the company)
What operators should review: how much one admin system can show
The details of the cause have not been disclosed, so this section only covers what follows from the published facts.
- Keep fields separate. The company says the face photo data was managed on a server separate from other personal information. The information that may have leaked still includes bank details, emergency contacts and residence-status information. In general, for fields where misuse does the most harm, such as bank details and residence status, limiting what an admin screen can list and splitting permissions makes less leak from a single compromise.
- Review the time from occurrence to blocking. In the company's notice, it was about 10 hours 15 minutes from occurrence (around 23:30 on November 4) to detection (around 09:45 on November 5), and about 4 hours 15 minutes from detection to blocking (around 14:00). Deciding in advance how to watch for overnight access to admin systems, and the steps for cutting the route once detected, can shorten both.
Sources (public record)
The facts in this article are based on the official notices below. We have not speculated about details of the cause that have not been disclosed.
- Sharefull, "To our users: apology and notice about the possible leak of personal information due to unauthorized access to the internal management system" (November 9, 2026, in Japanese) — sharefull.com
- Sharefull, "Apology and report about the possible leak of information due to unauthorized access to the internal management system" (for corporate clients, November 9, 2026, in Japanese) — sharefull.com
- Sharefull, news release (for both users and corporate clients, November 9, 2026, in Japanese) — sharefull.com
Update history
2026-11-11: First version. Based on Sharefull's notices of November 9 (for users and for corporate clients). We checked the company's notices the same day and found no follow-up.
Read next
- When ID documents or bank details leak: What to do when a driver's license or ID document leaks / The Lashinbang incident (ID documents and bank details)
- How to spot fake contact: What is phishing? / Smartphone security basics
- Suspicious activity on an account: How to check for unauthorized access
- Other incidents in 2026: Data breaches and cyberattacks (Japan and overseas)