For: anyone who has requested Treasure Factory's (Trefac's) home buyback service or Trefac Moving in Japan, and anyone who runs a system that takes service requests. This article is based on the company's official notices and does not cover attack or scam techniques.
Developing: this article will be updated as the organisation publishes more
As of October 24, 2026Not yet known
- Detailed cause
- Findings of the outside investigation
- When and how individual notices will be sent
- Dedicated help line
- Number of people behind the record count
In its October 23 notice, the company said it is investigating the detailed cause and scope with an outside security firm. A dedicated help line is being prepared, and the company says it will announce it on its website as soon as it is ready.
What home buyback and Trefac Moving customers should do today
Check whether you are affected: store and app data are excluded
According to the company, the system that was accessed is the case-management system used to take and handle requests for home buyback and Trefac Moving. Customer data held at stores and customer data managed in the company's app are kept in separate systems and were not affected.
If you only sold items over the counter at a store, or only use the app, you are outside the scope the company has announced. If you have ever requested home buyback or Trefac Moving online or by other means, assume your email address may be included and follow the steps below.
Do not open links in emails or texts claiming to be from Trefac
The company says the email addresses taken "could be used for phishing emails and other fraudulent contact." People who requested home buyback or a move would not be surprised to receive messages about appraisals, quotes, visit scheduling or a service restart, which makes fake messages on those topics harder to spot.
To check anything, use the official site or app that you open yourself, not a link in an email (see What is phishing?).
Do not enter card numbers or passwords
The company says the customer data taken did not include card numbers or other payment information. Nothing in the notice asks customers to re-register card details or "verify their identity" because of this incident. If an email asks you to, do not respond.
The company itself asks people not to enter passwords or card details on suspicious sites.
If someone calls, hang up and call the official number
The company advises that after a suspicious call, you should look up the official contact details yourself for the organisation the caller named and contact it. Do not call back a number given to you on the phone; use the one on the official website.
Wait for individual notices and the help-line announcement
The company says it plans to contact affected customers individually about the incident and the precautions to take. A dedicated help line is being prepared.
As of October 24, the company had not said how the notices will be sent (email, post or otherwise). If you receive something that looks like a notice, do not follow any steps through its links; compare it with the announcements on the official site.
About the 11 records that also include name and address
According to the company, 11 of the 746,277 customer records include a name and address as well as an email address. It has not said who they belong to. Post or email that uses your name and address looks more convincing, so wait for the company's individual notice and check its content on the official site.
What happened (from Treasure Factory's notices)
On October 23, 2026, Treasure Factory Co., Ltd. published a notice about a personal data leak caused by unauthorized access, both as a timely disclosure on the Tokyo Stock Exchange and on its consumer reuse site. Everything below is from the company's notices.
October 20, 2026, early morning to morning
An outside party exploited a vulnerability in the company's system and took customer and other data (confirmed by the company through an access-log review).October 20, 10:30
The company cut off outside access to the case-management system.October 20, 11:05
It stopped accepting requests through the home buyback, Trefac Moving and other request forms.October 23
The company announced the incident in a timely disclosure and on its website, together with a notice that some services were suspended for security work. It said it is reporting to Japan's Personal Information Protection Commission and consulting and reporting to the police and other authorities.October 28 (planned)
The system and request forms are scheduled to restart around this date, after the necessary safety measures and checks.
- System
- The case-management system used to take and handle requests for home buyback and Trefac Moving
- Customer data
- 746,277 records. The item is email address; 11 records also include name and address
- Partners and employees
- 750 records of names and email addresses of business partners, employees and others
- Device data
- 1,000 records of names and device identifiers for devices used by business partners, employees and others
- Not included
- Credit card numbers, security codes and other payment information (confirmed by the company). Customer data held at stores and in the company's app (managed in separate systems)
- Cause
- The company believes a vulnerability related to database access was exploited. It says it has confirmed the incident is not related to a recently disclosed PHP vulnerability
- Secondary harm
- None confirmed as of October 23
- Response
- Outside access stopped and passwords for related accounts changed, among other steps. Work under way on fixing the exploited vulnerability, strengthening login security and monitoring suspicious access
- Reporting
- Reporting to the Personal Information Protection Commission; consulting and reporting to the police and other authorities
- Contact
- A dedicated help line is being prepared (to be announced on the official site)
Case-management system
Home buyback and Trefac Moving requests. Accessed on October 20
Store customer data
Separate system. Not affected (company)
App customer data
Separate system. Not affected (company)
↓ data confirmed as taken
746,277 customer email records
11 also with name and address. No payment data (company)
↓ what can generally follow
Emails and texts claiming to be from Trefac
Posing as appraisals, quotes, visit dates or restart notices
↓ do not use the links
Open the official site or app yourself to check
What can happen when only an email address leaks
An email address alone does not let anyone sign in to an account or take money. The issue is that it is known together with the fact that this person has requested Trefac's home buyback or moving service. In general, the following can happen (the company has not reported any of it in this case).
What can generally happen
- Fake appraisal results, quotes or schedule changes claiming to be from Trefac
- Emails posing as an apology, compensation or a "restart campaign" that lead to another site
- The address being added to spam lists, increasing spam overall
What you can do
- Check your requests on the official site or app
- Ignore any contact that asks for card or bank details in the name of an apology or compensation
- Use spam reporting and filters, and do not open links from unknown senders
For another case where email addresses leaked, see the JR East, View Card and JR Kyushu email leak. In the same month, the major reuse chain Bookoff also announced a member data breach. The two incidents are unrelated.
What is known and what is not
Based on the company's notices as of October 24, 2026 (the October 23 timely disclosure and the website notice). The status column will be updated as follow-ups appear.
| Item | What the company said | Status |
|---|---|---|
| Customer email addresses | 746,277 records confirmed as taken | Leak confirmed (company) |
| Customer names and addresses | 11 of those records include name and address | Leak confirmed (company) |
| Partner and employee data | 750 names and emails; 1,000 names and device identifiers | Leak confirmed (company) |
| Card numbers and other payment data | Confirmed not included in the customer data taken | Not included (company) |
| Store and app customer data | Managed in separate systems; not affected | Not included (company) |
| Phone numbers and passwords | Not listed among the data taken | Not stated |
| Number of people | Published as a record count; number of people not given | Not stated |
| Date and time of access | Early morning to morning on October 20 | Confirmed (company) |
| Cause | Believed to be an exploited vulnerability related to database access; details under investigation | Under investigation |
| Link to the PHP vulnerability | Confirmed not related to a recently disclosed PHP vulnerability | Confirmed (company) |
| Secondary harm | None confirmed (as of October 23) | Not confirmed (company) |
| Individual notices | Planned for affected customers; timing and method not given | Planned (company) |
| Dedicated help line | Being prepared | In preparation (company) |
| Service restart | Planned around October 28, 2026 | Planned (company) |
| Impact on earnings | Under review (timely disclosure) | Under investigation |
Difference between the timely disclosure and the website notice
The breakdown of the customer data (746,277 records, 11 with name and address, no payment information) appears in the October 23 timely disclosure. The website notice of the same day lists the 750 and 1,000 partner and employee records, but we could not find the customer record count in it (checked October 24). The figures in this article are from the timely disclosure.
In August 2026, a personal data leak caused by unauthorized access was also announced at Kindal, a consolidated subsidiary of the group (listed in this site's list of 2026 breaches and cyberattacks). Treasure Factory says the earlier case involved staff account credentials taken through phishing, while this one involved an exploited vulnerability related to database access, so the causes and entry routes differ. The company says that since August it has been reviewing and strengthening authentication and access rights across the group.
For those who run request-intake systems
The detailed cause has not been published, so this section sticks to what the announced facts support. We do not guess at the type of vulnerability or claim that closing a particular hole would have prevented it.
List the back-office systems behind your request forms that are reachable from outside
The system involved was the case-management system used for taking requests and related work. To prevent a recurrence, the company lists vulnerability management and testing of externally exposed systems and defences such as a WAF (web application firewall, which filters attacks on web applications).
List which of your case-management and customer-management systems behind your request forms can be reached from the internet, and assign an owner and an update procedure to each. For admin screens that do not need outside access, restricting where connections can come from is the first step.
Separating systems limits how much can leak
The company says customer data held at stores and in its app is managed in separate systems, so it was not affected. Being able to explain that store and app data are outside the scope cuts down on inquiries and worry.
Not concentrating every business line's customer data in one place is one of the things that decides the size of the damage when an intrusion is not stopped.
Decide how long to keep contact details from finished cases
More than 740,000 customer email records were taken. In general, decide how many years to keep contact details collected for requests and quotes after a transaction ends, and once that period passes, delete them or remove the contact details and keep only the numbers needed for reporting; that limits the damage if something goes wrong (how long the company kept such data has not been disclosed).
Keep access logs in a form you can read the same day
The company says it confirmed the data theft through an access-log review on the day of the access and cut off outside access by 10:30. Having logs that exist and can be read is what makes scoping and a fast shutdown possible. Decide where logs are kept and who reviews them when. To reduce fake emails that use your own domain, see Email spoofing and SPF, DKIM and DMARC.
Sources (public record)
The facts in this article come from the public sources below. Undisclosed details of the intrusion and the number of people affected are not speculated on.
- Treasure Factory Co., Ltd., notice on a personal data leak due to unauthorized access to its system (October 23, 2026, timely disclosure, Japanese) — nikkei.com (timely disclosure PDF)
- Treasure Factory Co., Ltd., apology and notice on a personal data leak due to unauthorized access (October 23, 2026, Japanese) — treasure-f.com
- Treasure Factory Co., Ltd., notice of partial service suspension for security work (October 23, 2026, Japanese) — treasure-f.com
Update history
2026-10-24: First version, based on Treasure Factory's October 23 timely disclosure and website notices. Will be updated when the detailed cause, individual notices or the help line are announced.
Read next
- Email address leaks: The JR East, View Card and JR Kyushu email leak
- A reuse-industry case from the same period: The Bookoff breach
- Preparing for fake emails: What is phishing?
- Another Japanese case from the same period: The Abahouse data breach
- Other 2026 incidents: list of breaches and cyberattacks (Japan and worldwide)