For: people who use ultra pay Card, Azul Claro Numazu Pay (アスルクラロ沼津Pay), Kamigami Kon Pay (巫神こんPay) or Toshiba Brave Lupus Tokyo Pay (東芝ブレイブルーパス東京Pay), or used one and later left. This article is an explanation based on the official notice from Yeny, Inc. and does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who use ultra pay Card, Azul Claro Numazu Pay (アスルクラロ沼津Pay), Kamigami Kon Pay (巫神こんPay) or Toshiba Brave Lupus Tokyo Pay (東芝ブレイブルーパス東京Pay), or used one and later left.
- Confirmed so farSee the table ↓
- Phone number
- Member ID (the company's own)
- Affected count
2 more
- Cause
- Report to authorities
- Not yet confirmed
- Whether items other than phone numbers and member IDs are included
- Per-service breakdown of the count
- Period of the leak and who obtained the data
2 more
- When affected users will be notified, and how former members are handled
- Whether the data has been misused
- What to do nowSee the steps ↓
- Do not respond to SMS or calls in the name of ultra pay or the teams
- Check the app's notices to see whether you are affected
- Do not call back the number in an SMS. Contact the company through official channels
2 more
- Look over your card and account statements as a precaution
- If you opened a link or entered information, get help right away
- Where to verify (source)All sources ↓
- Yeny, Inc., "Apology and notice about the leak of member information due to unauthorized access" (November 12, 2026)
- Last checked
- As of November 14, 2026
Follow-up plans and what we checked
The company says the notice is based on information as of 15:00 on November 12, 2026, and may be updated after further investigation. It says it will announce new information in each app and on its site as it becomes available. When we checked the company's notices on November 14, 2026, we found no follow-up after the November 12 notice.
What users should do today
Do not respond to SMS or calls in the name of ultra pay or the teams
The company warns about SMS and calls that pretend to be from it. It says it never asks users to enter passwords or card information by SMS or phone. If you get an SMS you do not recognize, do not open the URL, do not enter personal information, and delete it.
When your phone number is known, believable SMS and calls such as "confirm your ultra pay use", "a campaign from your team's Pay" or "confirm unauthorized use" are easier to make (this site's view). See What is phishing? for how to tell them apart.
Check the app's notices to see whether you are affected
The company says affected users will be notified in the notice section of the app. Do not use a link in an SMS or email. Open the official app on your phone yourself and read its notices.
Four services are covered. If you use more than one app, check each one. If you cannot find a notice, you can ask through the dedicated inquiry form listed in the notice.
Do not call back the number in an SMS. Contact the company through official channels
When a suspicious contact arrives, use the official app or the contact point on the company's official site, not the phone number or URL in the SMS. The company takes inquiries about this matter through a dedicated form. The notice does not list a separate email address or phone number.
Look over your card and account statements as a precaution
The company says payment information leaks have not been confirmed and that this information alone cannot be used for payments. If you are still worried about suspicious charges, check the statements of your registered payment source (card company or bank) for charges you do not recognize.
If you opened a link or entered information, get help right away
If you entered a card number or password at the link in a suspicious SMS, contact your card company or bank right away and change the password of any service where you use the same one. In Japan you can also call the police consultation line (#9110) or the Consumer Hotline (188). To check for suspicious activity on an account, see How to check for unauthorized access.
What happened (from Yeny, Inc.'s notice)
On November 12, 2026, Yeny, Inc. posted "Apology and notice about the leak of member information due to unauthorized access" on its website. Everything below comes from that notice.
Oct 31
A specific connected business told the company of suspicious API calls. The company began an initial investigation.Nov 2
The same business told the company that phone numbers may have leaked. The company confirmed a configuration flaw and responded with emergency maintenance.Nov 3-4
The company investigated the cause and impact in detail.Nov 5
The company confirmed the fact that member information (phone numbers and its own member IDs) had leaked.Nov 6
The company reported to the Kanto Local Finance Bureau and the Personal Information Protection Commission.Nov 12
The company published the notice (information as of 15:00).
- Services
- ultra pay Card, Azul Claro Numazu Pay (アスルクラロ沼津Pay), Kamigami Kon Pay (巫神こんPay), Toshiba Brave Lupus Tokyo Pay (東芝ブレイブルーパス東京Pay)
- Count
- 1,332,505 records (including former members)
- Leaked information
- Phone numbers, the company's own member IDs
- Not included
- Leaks of payment information such as credit card numbers have not been confirmed. The company explains that the leaked information alone cannot be used for unauthorized login to its app or for payments
- Cause
- A flaw in the company's API connection setting
- Notice to affected users
- The notice section of the app
- Inquiries
- A dedicated inquiry form for this matter
What is known and what is not
This table is based on the company's notice of November 12, as of November 14, 2026. When follow-up notices appear, we will update the status column.
| Item | What the notice says | Status |
|---|---|---|
| Phone number | Included in the leaked information | Leak confirmed (company) |
| Member ID (the company's own) | Included in the leaked information | Leak confirmed (company) |
| Affected count | 1,332,505 records (including former members) | Leak confirmed (company; records, not people) |
| Per-service breakdown of the count | Not stated | Not stated |
| Payment information such as credit card numbers | Leak not confirmed | Not included (company, at this time) |
| Use for unauthorized login or payments | The company explains the leaked information alone cannot be used | Company's explanation |
| Name, email address, address | Not listed as items | Not stated |
| Cause | A flaw in the company's API connection setting | Leak confirmed (company) |
| Who obtained the data, method, period | Only that a specific connected business reported suspicious API calls | Not stated |
| Report to authorities | Reported to the Kanto Local Finance Bureau and the Personal Information Protection Commission on Nov 6 | Leak confirmed (company) |
| Notice to affected users | The notice section of the app | Planned (company) |
| Notice to former members | Included in the count, but the way they are notified is not stated | Not stated |
| Misuse | No confirmed misuse found in the notice. It warns about SMS and calls pretending to be the company | Not stated |
What phone numbers and member IDs can be used for
The table below describes what can generally happen with this combination of items. It does not mean this has happened in this incident.
| Leaked item | What can generally happen | What users should do |
|---|---|---|
| Phone number | Believable fake contact by SMS or phone | Do not open URLs in unfamiliar contact; check in the official app |
| Member ID (the company's own) | Contact posing as an inquiry or usage check that quotes the ID to build trust | Being quoted an ID does not make it genuine; do not call back, use official channels |
| Phone number + member ID | Contact that uses "account check" or "unauthorized use check" to get passwords or card information | The company says it does not ask for passwords or card information by SMS or phone |
What the leaked information can lead to
- Believable SMS and calls in the name of ultra pay or the teams' Pay services
- Fake sites reached through "usage check" or "unauthorized use check" messages
- Impersonating inquiries that quote the member ID to build trust
What is not confirmed, within the notice
- Leak of payment information such as credit card numbers (at this time)
- Unauthorized login or payments using only the leaked information (company's explanation)
What operators should review: settings of APIs shared with outside businesses
The cause has not been disclosed in detail, so this section only covers what follows from the published facts.
- Narrow what an externally shared API returns: the company says a flaw in an API connection setting caused member information, including phone numbers, to leak. In general, an API for an outside business is safer when it is set up to return only the items that business needs, which limits the impact of a misconfiguration.
- Watch for unexpected API calls: in the company's notice, the first report of suspicious calls came from a connected business. Monitoring call volume and which parties call, and having a procedure to stop abnormal calls, can shorten the time to notice. The company also says it will review its monitoring and detection.
Sources (public record)
The facts in this article are based on the official notice below. We do not speculate about details of the cause that have not been disclosed.
- Yeny, Inc., "Apology and notice about the leak of member information due to unauthorized access" (November 12, 2026) — yeny.jp
Update history
2026-11-14: First published, based on Yeny, Inc.'s notice of November 12. We checked the official notice the same day and found no follow-up.
Read next
- A similar type of incident (payment and prepaid card leaks): Unauthorized access to Value Design's Value Card (card numbers, PINs, balances)
- How to spot fake contact: What is phishing? / Smartphone security basics
- Suspicious activity on an account: How to check for unauthorized access
- Other incidents in 2026: Data breaches and cyberattacks (Japan and overseas)