For: people who registered a phone number and other details in a store's member app (stamp cards, coupons and so on) when that app uses Toypo. This article is based on the official notices of Toypo Inc. and the stores that use its app and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 29, 2026Not yet known
- Full list of stores and companies involved
- Details of the cause
- Result of the third-party assessment
- Whether the data has been misused
- Whether there is compensation
Toypo says it will announce any important new facts promptly on its notice page and elsewhere. It gives no schedule. On October 29 we checked both of Toypo's notice pages (the one dated October 14 and the undated one) and the notices of the stores that use the app (JR Kyushu Food Service, Nishitetsu Wellness and Mannoya) and found no new announcement.
What store app users should do today
Check whether you are covered, in your app's notices
Toypo provides member apps (customer-management apps) for stores, and runs behind each store's app. The look and name of the app differ from store to store, so the app's name alone may not tell you. As far as this site has found, Toypo has not published a list of the stores that use it.
Toypo's October 14 notice explains how to tell whether you are covered:
- It has identified those covered, and since October 13 has been contacting them one by one, including by in-app push notification from the official Toypo account
- If a notice about this incident has arrived in the notices section of your app, you are covered. If none has arrived, you are not
- To check individually, contact Toypo
A store may not be able to answer. Nishitetsu Wellness says the incident happened in Toypo's system, so it cannot answer the details and asks people to contact Toypo.
Do not use links or phone numbers in messages claiming to be a store or Toypo
The items that may have leaked include phone number, email address and name. Toypo and Nishitetsu Wellness warn that suspicious emails, texts, calls and phishing could be carried out using this information.
If you get a message about "confirming member details", "coupon expiry" or an "apology refund", do not use the links or phone numbers in it. Check through the in-app contact or the contact listed in the notice. Toypo says it does not ask you to enter passwords, authentication codes or credit card numbers.
Decide what to do about passwords
Toypo says login credentials such as passwords are not included, so no password change or other action in the app is needed because of this incident, and the app, points and coupons can be used as before. Its FAQ asks you to consider changing a password if you use the same one on other services or see suspicious logins.
This site recommends that if you use the same password on several services, you take this chance to separate them (how to check if your password was leaked / choosing a password manager).
If you get an unexpected message, tell Toypo
Toypo says it cannot tell whether a given message is caused by this incident, but to check the connection it asks you, if you can, to tell its contact the sender's phone number, the date and time received, and what it said. If you opened a URL or entered information, change the password quickly, and contact your card company if you entered a card (what is phishing?).
Delete the account of an app you no longer use
Toypo says you can delete your account from the app, at the bottom of the My Page screen. Deleting removes all data including your registered details, and it cannot be restored. It takes about a week to take effect, and logging in again during that time cancels it. It cannot be done with an active subscription or an order not yet received. Check that no stamps or coupons you want remain before you do it.
1. Email / text / call claiming to be a store or Toypo
Name and phone number are correct → do not decide here
↓
2. Do not use its links or numbers: use the in-app contact or the listed contact yourself
Toypo customer contact 0120-546-030 (weekdays 9:00 to 18:00 Japan time)
↓
3a. A request you cannot confirm
Password, authentication code or card number, or a payment → do not respond
3b. The contact gives the same guidance
Follow the official guidance
What happened (according to Toypo and the stores)
The following is based on two notice pages from Toypo Inc. and the stores' notices. One is "Apology and notice regarding personal information leak caused by unauthorized access" (dated October 14, 2026, with the number of people; "the October 14 notice" below). The other is "Apology and notice regarding personal information leak caused by unauthorized access to the Toypo app" (no date, no number of people; "the other notice page" below). The October 14 notice says information "may have leaked"; the other page states that it "leaked". Toypo provides a customer-management app, the Toypo app, to stores.
Oct 4, 2026 (Sun)
Toypo confirmed unauthorized access to its system by a third party. Part of its system had an access-control flaw that let an authenticated user obtain other users' information they were not entitled to see, and its logs show a third party used it to obtain user information.Oct 7 (Wed)
Toypo told one of the stores using the app (JR Kyushu Food Service) (that store's notice).By Oct 13
Toypo completed suspending the account used in the access and fixing the flaw, and reported to the Personal Information Protection Commission (both per the company; no dates given).Oct 13 (Tue)
A dedicated contact opened at 13:00, and Toypo began contacting those covered one by one through in-app push notifications (per the company). JR Kyushu Food Service and Nishitetsu Wellness also posted notices.Oct 14 (Wed)
In its notice dated October 14, Toypo gave the number of users covered as 697,209 (information may have leaked). Mannoya also posted its notice.Oct 28
ScanNetSecurity reported that the registration information of 697,209 users may have leaked.
- Information that may have leaked
- Phone number and user ID or similar identifiers. Where registered: name, name in kana, email address, date of birth, gender and address (which items are registered differs by person, and not everything leaked for everyone)
- Not included (per the company)
- Passwords and other login credentials, credit card numbers and other payment data, points, store-visit history, purchase and usage history (the other notice page also lists password hashes, authentication tokens and session information)
- Not held (per the company)
- ID document images, My Number and the like are not held by its service
- People who had left
- No leak has been confirmed for people who had already withdrawn when the leak occurred (per the company)
- Response so far (per the company)
- Fixed the flaw. Checking for similar problems elsewhere, reviewing access control and strengthening monitoring and detection. A third-party security assessment is being arranged. Reported to the Personal Information Protection Commission. The other notice page also lists suspending the account used in the access and preserving logs
- Contact
- Toypo Inc. customer contact: 0120-546-030, weekdays 9:00 to 18:00 Japan time. The call center takes calls until 18:00 on Friday, October 30, then the in-app contact (per the company)
Notices from stores that use the app
The app is used as each store's member app, and each store has published its own number of people covered. The following are from the official notices we opened ourselves. The numbers are separate per store and have not been added together; no announcement says whether they add up to Toypo's 697,209.
| Store / company | What the notice says | Status |
|---|---|---|
| JR Kyushu Food Service (Oct 13) | Information of about 26,900 of about 61,500 members registered at its 24 target stores may have leaked. New member recruitment stopped | Possible (company) |
| Nishitetsu Wellness (Nishijin Palace Dome, Oct 13) | Part of the user information of the member app "Toypo" leaked. No number of people given | Leak confirmed (as notified by Toypo) |
| Mannoya (Oct 14) | Registration information of 12 of 212 members of the "Kineya Mannoya" official app, a brand it helps develop, is covered. New member registration temporarily suspended | Covered (company) |
Toypo's notice does not say which other stores or companies use the app.
What is known and what is not
Status as of October 29, 2026. We will update this table as more is published.
| Item | What the notice says | Status |
|---|---|---|
| Unauthorized access occurred | Confirmed on October 4. Logs show a third party used the flaw to obtain user information | Confirmed (company) |
| Phone number, user ID or similar identifiers | Leaked | Possible (Toypo, October 14 notice). The other notice page says "leaked" |
| Name, name in kana, email, date of birth, gender, address | Leaked where registered | Possible (Toypo, October 14 notice). The other notice page says "leaked" |
| Passwords and other login credentials | Not included (the other notice page also lists password hashes, authentication tokens and session information) | Not included (company) |
| Credit card numbers and other payment data | Not included | Not included (company) |
| Points, store-visit history, purchase and usage history | Not included | Not included (company) |
| Number of people covered | 697,209 people (October 14 notice). ScanNetSecurity reports the same figure. Not on the other notice page | Announced (company) |
| How to tell if you are covered | A notice about this incident in your app's notices means you are covered; no notice means you are not (October 14 notice) | Confirmed (company) |
| Stores and companies involved | No overall list. JR Kyushu Food Service, Nishitetsu Wellness and Mannoya posted their own notices | Not stated |
| Cause | Access-control flaw (an authenticated user can obtain other users' information). No further detail | Confirmed (company, outline only) |
| Fix of the flaw | Completed. Information can no longer be obtained that way | Confirmed (company) |
| Whether similar problems exist elsewhere | Additional checks under way | Under investigation |
| Third-party assessment | A third-party security assessment is being arranged (October 14 notice) | Being arranged (company) |
| Misuse or secondary harm | No specific secondary harm confirmed. Warns that suspicious contacts may occur | Not confirmed (company) |
| Compensation | Not stated | Not stated |
Note: 697,209 counts people, not records, and they are people whose information may have leaked
Toypo's October 14 notice says "the number of users covered by this unauthorized access is 697,209" and that information "may have leaked". The unit is people, not records. The other notice page (undated) gives no number and states that the information "leaked". This site writes "may have leaked" in light of that difference. No announcement says whether the per-store numbers (such as JR Kyushu Food Service's about 26,900) add up to the overall 697,209.
What the combination of leaked items could be used for
The following is what can generally happen with this combination of items. It has not been announced that any of it happened in this incident. Toypo says no specific secondary harm has been confirmed.
- Phone number + name: texts or calls claiming to be a store or service that use your name to pass as someone who knows you
- Email address + name and address: fake "update your member details" or "your points are expiring" emails that look genuine
- Date of birth + name + address: could be used to answer identity-check questions at other services. Toypo also asks people to watch for identity checks at other services
- User ID + phone number: Toypo says passwords and similar items are not included, so this information alone does not let anyone log in to its service right away
In general, most fake messages built on phone numbers and email can be defeated by not using the links or numbers in them and checking for yourself.
What operators should review
What Toypo has disclosed is an access-control flaw that let an authenticated user obtain other users' information. Details have not been published, so this section covers only the disclosed course of events and what can generally be said.
- In general, being logged in is not enough: the server must check on every request not only "is this user logged in" but "is this person entitled to see this data" (what is IDOR?). This is a general point; it has not been announced that this incident's cause is the same.
- Many stores' users sit on one platform: a flaw in one platform reaches users of many stores and companies at once. In this incident each store published its own notice, while inquiries were centralised at Toypo. Stores can help themselves by deciding in advance whether the platform provider will tell them as soon as it detects something, and who notifies users, by what route.
- Data you do not hold cannot leak: Toypo says passwords and other login credentials, card numbers, visit history and ID documents were not in the leaked set (or are not held). Collecting only the items a feature needs narrows the scope when something goes wrong.
Sources (public records)
The facts in this article are based on the public information below. We have not guessed at details of the cause or the full set of stores, which have not been announced.
- Toypo Inc., "Apology and notice regarding personal information leak caused by unauthorized access" (Japanese, dated October 14, 2026, 697,209 users covered; checked October 29) — toypo.notion.site
- Toypo Inc., "Apology and notice regarding personal information leak caused by unauthorized access to the Toypo app" (Japanese, no date and no number of people shown; checked October 29) — toypo.notion.site
- Toypo Inc., "Questions and answers about unauthorized access to the Toypo app" (Japanese; linked from the page above)
- JR Kyushu Food Service Co., Ltd., "Leak of customer information in connection with unauthorized access at Toypo Inc." (Japanese, October 13, 2026) — jrfs.co.jp / notice text (PDF)
- Nishitetsu Wellness Co., Ltd., "Notice of possible personal information leak and a warning, regarding unauthorized access to the member app Toypo of Nishijin Palace Dome" (Japanese, October 13, 2026) — nishitetsu-wellness.com (notice list)
- Mannoya Co., Ltd., "Leak of member information of the 'Kineya Mannoya' official app, following unauthorized access to Toypo" (Japanese, October 14, 2026) — mannoya.com
- ScanNetSecurity, "Unauthorized access to the behavioral data platform Toypo app; registration information of 697,209 users may have leaked" (Japanese, October 28, 2026, media report; 697,209 people) — scan.netsecurity.ne.jp
- Nishinippon Shimbun, report on about 697,000 people's information possibly leaked from the customer-management app operator (Japanese; publication date not confirmed, paywalled and only the opening read; reports about 697,000 people) — nishinippon.co.jp
Update history
2026-10-29: First version, based on Toypo's two notice pages (one dated October 14, one undated; both checked October 29), the notices of three stores that use the app, and two media reports. We will update when details of the cause, the result of the third-party assessment or compensation are announced.
Read next
- Japanese incidents with the same items (name, phone, email): MrMax / The TEMAIRAZU accommodation booking system incident
- A Japanese case from the same period: Unauthorized access at Joshin (formerly Joshin Denki)
- Preparing for fake messages: What is phishing? / Smartphone security basics
- The access-control type of flaw: What is IDOR?
- Protect your accounts: Choosing a password manager / Choosing multi-factor authentication
- Other 2026 incidents: Data breaches and cyberattacks in 2026 (Japan and worldwide)