Unauthorized access at Snow Peak (reuse buyback 24,948, event reservations 5,923, community app 21,553): bank transfer details and more may have leaked — what affected customers should do

The information that may have leaked in the reuse buyback service includes bank account information for payouts (bank name, branch, account type, account number, account holder name). The company says bank PINs and internet banking login details are not included. Still, someone who knows your account number and name can more easily make contact that looks like a transfer (our view). Check the transaction history in your banking app or passbook.

If a deposit you do not recognize arrives and someone contacts you saying "we sent it by mistake, please return it," do not send money yourself. Contact your bank first and ask about reversing it. The notice does not ask you to change your account. If you are worried, talk to your bank.

More on these scams is in the Japanese Bankers Association warning and the National Police Agency notice (both in Japanese, general warnings and not about this incident). A similar case involving bank account details is the Lashinbang incident.

The company asks you to be careful of suspicious contact by email, SMS, phone or mail that pretends to be the company or a financial institution. If you get a suspicious email or SMS, do not open attachments or visit the URL; discard it.

The company says it never asks for passwords, credit card numbers, bank PINs or login passwords by email, SMS, phone or mail. Do not respond to contact that asks for them. The company's individual notices are likely to arrive by email or similar, so do not open links in them; check services in an app or official site you open yourself (our view). How to tell the difference is in What is phishing?.

Unauthorized logins using IDs and passwords that appear to have been obtained elsewhere were confirmed on up to 445 online store and member app accounts. The company says no passwords leaked from its own systems. It asks for your understanding of the stronger login checks, and asks you to avoid reusing passwords from other services and to avoid guessable ones such as a date of birth or sequential digits.

If you use the same password on other services, change it (our view). To check reuse, see How to check if your password has leaked; for two-step login, see Setting up multi-factor authentication. A screen showing the card type and part of the card number may have been viewed, so check your card statement as a precaution.

The information that may have leaked in the event reservation system includes the applicant's name, address, phone number, email address and date of birth, a companion's name, age and gender, and application details such as event name, date, lodging, amount, vehicle type and remarks. Leakage of credit card information and passwords has not been confirmed so far.

Generally, someone who knows your booking can more easily make contact that pretends to confirm a reservation or charge a cancellation fee (our view). Check anything about a booking through the official booking page you open yourself or by phone, not through links in an email. Because companions' details are included, it also helps to tell the family or friends who came with you not to respond to suspicious contact.

The information that may have leaked in the community app is the member number, display name (your name if you registered it), self-introduction text and cover image. The company says addresses, phone numbers, email addresses, passwords and credit card information are not included.

The notice does not describe any immediate action based on this data alone. If a stranger contacts you in the app and asks for personal information or money, do not respond.

The contact point in the notice is Snow Peak User Service by phone: 0120-010-660 (9:00 to 17:00, Monday to Friday, excluding weekends and holidays; a Japanese toll-free number). If the line is busy, you can use the company's inquiry form.

Use the contact point in the official notice, not one written in an email or SMS.

If you entered bank details or personal information on a suspicious link or sent money, contact your bank or card company right away. You can also call the police advice line (#9110 in Japan) or the Consumer Hotline (188). To check an account for suspicious activity, see How to check for unauthorized access.