Security Guides

#data breach #e-ticket #phishing #incident response #Japan

Unauthorized access to the e-ticket service teket: names, email addresses and other member data leaked — what buyers and organizers should do

teket says unauthorized access leaked all members' names and email addresses, plus addresses, phone numbers and ticket codes for buyers. Service is stopped.

Published 2026-11-12 Updated 2026-11-12 Last verified 2026-11-12 11 min read

On this page

For: people who bought tickets or registered as members on the e-ticket service teket, and event organizers who use teket. This article is an explanation based on teket Inc.'s official notice (first report); it does not cover attack methods.

Bottom line

be ready for contact in teket's name, and keep your purchase confirmation email for events during the outage

According to teket, the name and email address of all members leaked. For members who registered or purchased, date of birth, address, phone number and ticket codes are included as well. Passwords and card information are not listed among the leaked items. With the whole service stopped, realistic-looking "ticket reissue" or "refund" messages are likely (our view).

Do not open links or attachments in emails, texts or calls in teket's name; check on an official site you opened yourself
For events held during the outage, have your purchase confirmation email ready
Watch for fake contact on other services that use the same email address and phone number
Organizers should wait for the purchaser list the company will send and tell attendees how entry will be checked

Developing: this article will be updated as the organisation publishes more

Who is affected: people who bought tickets or registered as members on the e-ticket service teket, and event organizers who use teket.
Confirmed so farSee the table ↓: Unauthorized access
Name, email address
Date of birth, age, gender, address, phone number
1 more
Ticket information
Not yet confirmed: Number of people affected
Cause (how the access happened)
How and when affected users will be contacted
2 more
When the service will restart
Whether the data has been misused
What to do nowSee the steps ↓: Do not respond to contact in teket's name
Have your purchase confirmation email ready for events during the outage
Check whether you are affected, and use the dedicated contact if needed
2 more
Review other services that use the same email address and password
Do not show or send your ticket codes to others
Where to verify (source)All sources ↓: teket Inc., "[Important] Apology and notice regarding information leak due to unauthorized access (first report)" (November 8, 2026, in Japanese)
Last checked: As of November 12, 2026

Follow-up plans and what we checked

The company says it is investigating the cause and the scope of impact, and will promptly announce any new facts or progress on its corporate site. It says the restart date is still being examined and will be announced on its corporate site and official social media accounts once decided. When we checked the company's news list on November 12, 2026, we found no follow-up after the first report of November 8.

What buyers and members should do today

Do not respond to contact in teket's name

The company says emails, text messages and calls pretending to be teket may arrive taking advantage of this incident. Do not open links or attachments in contact you do not recognize. The company says it does not ask for passwords or credit card information by email, text or phone.

Leaked names, email addresses, phone numbers and addresses give the material for convincing messages such as "your ticket is invalid", "you must buy again" or "refund procedure" (this site's view). Check on an official site you opened from a bookmark. For how to spot fakes, see What is phishing?.

Have your purchase confirmation email ready for events during the outage

According to the notice, QR tickets already bought on teket cannot be displayed while the service is stopped. For events during the outage, bring the purchase confirmation email sent when you bought the ticket and show it at reception. If you do not have the email, tell reception the name of the person who bought the ticket.

Searching for "teket" in your email service makes the purchase confirmation email easier to find. Organizers may give details for each event, so check those too.

Check whether you are affected, and use the dedicated contact if needed

The company says it will guide customers confirmed as affected in turn, after it identifies the scope. The notice does not say how or when individual contact will be made. All members are affected for name and email address. Members who registered or purchased are also affected for date of birth, age, gender, address, phone number and ticket information.

Use the dedicated contact form listed in the notice. Replies are made in turn, and answers may take time if inquiries are concentrated. Use the form on the official notice, not a link in an email or text.

Review other services that use the same email address and password

The notice's list of leaked items does not include passwords. However, the count and scope are still being examined. If you use the same password as teket on other services, this is a good time to change it. For checking, see How to check if your password has leaked; to reduce reuse, a password manager and multi-factor authentication help.

Do not show or send your ticket codes to others

The confirmed items include the code used to issue the ticket and the serial code issued by the organizer. The notice does not say how these codes could be used. In general, when identifying information for a ticket leaks, there is a concern that someone may try to enter with it or resell it (this site's view). Do not post the ticket screen or codes on social media or in replies to inquiries. If you are told at entry that the ticket "has already been used", tell the organizer's reception on the spot and show your purchase confirmation email.

What event organizers should do today

The company's notice gives organizers the following guidance.

Entry for upcoming events: while the service is stopped, logging in to the organizer admin screen and QR ticket scanning are unavailable. For events held during the outage, check entry by having attendees show their purchase confirmation email. The company says it will send organizers the purchaser list needed for this individually.
Payment of sales proceeds: payment is planned on the usual schedule. How sales fees will be treated given the outage will be announced separately.
Report to the Personal Information Protection Commission: the company reported to the Commission on November 6. If organizers need to take any action on purchasers' personal information, it says it will notify them individually.

What happened (from teket's notice)

teket published its first report on its corporate site on November 8, 2026. Everything below comes from the company's notice.

November 5, 20:30
The company judged that unauthorized access to the server from outside was highly likely, stopped the service and blocked the access.
November 6
Investigation confirmed unauthorized access to the system managing member information and that part of the customer information stored there had leaked to a third party. It reported to the Personal Information Protection Commission.
November 8
First report published. All services are stopped while the cause and scope are investigated. The restart date is being examined.

Under review

Number affected (company, as of the first report)

All members

Name and email address are affected (company)

Fully stopped

Since 20:30 on Nov 5. No restart date

Not confirmed

Secondary harm such as unauthorized logins or misuse of leaked data (company)

Key points of the notice (November 8, 2026, first report)

Occurrence: On November 5, 2026 the company judged unauthorized access to the server from outside to be highly likely. On November 6 it confirmed a leak from the system managing member information
Information leaked (all members): Name, email address
Information leaked (members who registered or purchased only): Date of birth, age, gender, address, phone number, ticket information (the code used to issue the ticket, the serial code issued by the organizer)
Count: Under examination
Cause: Unauthorized access by a third party (route and method not disclosed). The cause is under investigation
Contact: Dedicated contact form listed in the notice (replies in turn)

What is known and what is not

This table is based on the company's first report of November 8, as of November 12, 2026. When follow-up notices appear, we will update the status column.

Item	What the notice says	Status
Unauthorized access	Unauthorized access to the system managing member information. Confirmed on Nov 6	Leak confirmed (company)
Name, email address	All members are affected	Leak confirmed (company)
Date of birth, age, gender, address, phone number	Members who registered or purchased only	Leak confirmed (company)
Ticket information	Code used to issue the ticket and serial code issued by the organizer (members who registered or purchased only)	Leak confirmed (company)
Count	Under examination	Under investigation
Password	Not listed among the leaked items	Not stated
Credit card information	Not listed among the leaked items	Not stated
Cause	Unauthorized access by a third party. The cause is being investigated	Under investigation
Route and method of intrusion	Not stated	Not stated
Secondary harm	Unauthorized logins and misuse of leaked data have not been confirmed	Not confirmed (company)
Further unauthorized access	No new unauthorized access or spread of harm confirmed	Not confirmed (company)
Individual notices	To be made in turn after the scope is identified	Planned (company)
Service restart	All services stopped. Restart date under examination	Under investigation

What the leaked items can be used for

The table below describes what can generally happen with combinations like these. It does not mean these things happened in this incident.

Leaked items	What can generally happen	What users should do
Name + email address	Realistic fake emails about tickets or refunds	Do not open links; check on the official site
Phone number + address + date of birth	Fake texts or calls; attempts to extract more information under the pretext of identity checks	Do not answer if someone recites your date of birth
Ticket issue code and serial code	Attempts at entry or resale using the identifying information (no misuse has been announced)	Do not show the codes to others; tell reception if there is a problem at entry

Information confirmed as leaked

Name and email address of all members
Date of birth, age, gender, address and phone number of members who registered or purchased
The code used to issue the ticket and the serial code issued by the organizer

Not listed among the leaked items (the notice does not say they are excluded)

Passwords
Credit card information

What operators and organizers should review: a way to admit attendees even when the service is down

The cause has not been disclosed in detail, so this covers only what the published facts imply.

A fallback for checking entry: the company says that while the service is stopped, QR tickets cannot be displayed, and asks attendees to show a purchase confirmation email or give a name. Organizers who use a ticketing service can reduce confusion by deciding in advance how to check entry on a day the service is down, for example by getting a purchaser list beforehand.
Time from stopping the service to confirming the leak: according to the notice, the company stopped the service at 20:30 on November 5 after judging unauthorized access highly likely, and confirmed the leak on November 6. That means it stopped and blocked access before the leak was confirmed. Setting in advance a standard for when to stop without waiting for confirmation makes the decision faster.
Handling of purchasers' personal information: the company says it will tell organizers individually if they need to take action on purchasers' personal information. Organizers should check where the purchaser lists in their hands are kept and who can access them.

Sources (public record)

The facts in this article are based on the official notice below. We have not speculated about details of the cause that have not been disclosed.

teket Inc., "[Important] Apology and notice regarding information leak due to unauthorized access (first report)" (November 8, 2026, in Japanese) — corporate.teket.jp
teket Inc. news list — corporate.teket.jp/news

Update history

2026-11-12: First version. Based on teket's first report of November 8. We checked the company's news list the same day and found no follow-up.

Latest breaking reports

All breaking reports →

FAQ

QWhat leaked in the teket incident?

According to teket Inc.'s notice of November 8, 2026 (first report), it has confirmed that the name and email address of all members leaked. For members who registered or purchased, it also includes date of birth, age, gender, address, phone number and ticket information (the code used to issue the ticket and the serial code issued by the organizer). The number of people affected is still being examined.

QHow can I find out whether I am affected?

The notice says that guidance to customers confirmed as affected will be given in turn after the scope is identified. The notice does not say that individual contact has begun. To check, use the dedicated contact form listed in the notice. The company says it will reply in turn, and that answers may take time if inquiries are concentrated.

QDid passwords or credit card information leak?

Neither passwords nor credit card information appear in the notice's list of leaked items. However, because the company is still examining the count and scope, this means they are not mentioned, not that the notice says they are excluded. The company says it does not ask for passwords or credit card information by email, text or phone.

QIs the cause known?

The notice says the company judged that unauthorized access to its server from outside was highly likely, and that there was unauthorized access to the system managing member information. How the access happened has not been disclosed. The company says it is investigating the cause.

QWhat should I do if someone contacts me in the name of teket?

The company says emails, text messages and calls pretending to be teket may arrive taking advantage of this incident. It asks you not to open links or attachments in contact you do not recognize. It says it does not ask for passwords or credit card information by email, text or phone.

QCan I still get into an event with a ticket I already bought while the service is stopped?

According to the notice, tickets already bought on teket (QR tickets) cannot be displayed while the service is stopped. The company asks you to bring the purchase confirmation email sent when you bought the ticket and show it at reception, or, if you do not have it, to tell reception the name of the person who bought the ticket. Organizers may give details for each event.