Who this is for: people who hold a store prepaid card (in-house electronic money) such as MOS Card, the prepaid card of the MOS Burger chain in Japan, and businesses that outsource such a card system. This article is based on the official announcements of PayCloud Holdings, Value Design and MOS Food Services and does not cover how the attack worked.
Developing: this article will be updated as the organisation publishes more
As of October 26, 2026Not yet known
- Which other issuers and cards were affected
- How the MOS Card figure relates to the Value Card total
- How cardholders can set a new PIN
- How unissued and uncirculated cards will be handled
- Which vulnerability was exploited
PayCloud Holdings said in its October 23 announcement that it will promptly announce any newly found facts. MOS Food Services also said it will promptly post any new facts that should be disclosed on its website. When we checked each company's news list on October 26, no follow-up had been published.
What cardholders should do today
Check your MOS Card usage history
MOS Food Services asks cardholders to check for unknown use, such as balance being deducted. If you find any, contact the dedicated MOS Card help line.
The help line is open 9:00 to 22:00. The number is 03-3496-8322 until Monday, October 26, and 0120-395-126 (toll-free in Japan) from Tuesday, October 27.
If online balance checks stop working, call the help line
According to the company, the PINs linked to the leaked card numbers have been forcibly reset. Using the card in store, in online orders and with "order at your table" is not affected.
The company asks you to contact the help line if you cannot do any of the following:
- Check your balance online
- Register the card in the official app
- Use MOS Card for a guest purchase in online ordering
The help line may ask simple identity questions, such as which store you use or your balance.
Do not answer anyone who asks for your PIN or card number
No names or contact details leaked this time. Even so, once an incident is in the news, it is common for people to receive calls or messages that pose as the company or a card company and ask for numbers to "reset your PIN" or "protect your balance".
If someone asks for your PIN or card number by phone, email or text, do not answer. Call the number in the official notice yourself to check (how to spot fakes: What is phishing?).
For other store prepaid cards, check the issuer's notices
Value Card is a system that Value Design provides to many card issuers. Value Design says it is reporting progress to some client companies where unauthorized access was confirmed, but which issuers other than MOS were affected has not been disclosed.
If you hold a store prepaid card, check the notices on the official site of the shop or company that issued it, and follow its guidance on whether to reissue the card or change the PIN. As of October 26, MOS Food Services had not announced card reissues.
Why a card number plus PIN matters
Many prepaid cards identify the holder by card number and PIN rather than by name. MOS Food Services' notice lists online balance checks, app registration and guest purchases in online ordering as the functions affected by the PIN reset. The company says it reset the PINs to prevent misuse. In general, even without names or addresses, a card number and PIN can be enough to use the balance in some situations.
What happened (from the companies' announcements)
On October 23, 2026, three companies published notices: Value Design Inc. (the operator of Value Card), its parent company PayCloud Holdings, Inc. (listed on the Tokyo Stock Exchange Growth market), and MOS Food Services, Inc., the issuer of MOS Card, which contracts Value Design to operate and maintain the MOS Card servers. MOS Food Services' notice does not mention the name "Value Card". Value Design's own notice refers readers to its parent company's disclosure for details. Everything below comes from these announcements.
October 14 (Wed) to October 18 (Sun), 2026
Value Design detected suspicious access and unauthorized login attempts against the MOS Card management system and immediately took emergency measures such as blocking access (MOS Food Services' announcement).October 19 (Mon)
The date PayCloud Holdings gives as the date the incident was confirmed.October 22 (Thu)
Value Design posted a notice that it had suspended other services (Arara Cashless and an online top-up service) as a precaution against a PHP vulnerability. That notice says the Value Card ASP service was running. No announcement states any link to this incident.October 23 (Fri)
PayCloud Holdings (stock exchange disclosure), Value Design and MOS Food Services announced the incident. MOS Food Services says it forcibly reset the PINs linked to the leaked card numbers (the date of the reset is not given).October 27 (Tue)
The MOS Card help line is scheduled to switch to 0120-395-126 (toll-free in Japan).
- Affected system
- The servers of Value Card, an in-house electronic money issuing service Value Design provides to card issuers
- Leaked data
- ID number, PIN, balance information
- Records
- 1,424,748 (569,224 issued IDs, 855,524 unissued IDs). Unissued IDs are IDs not yet bought by a user
- Personal information
- None
- Impact on users
- There was a risk of misuse of issued IDs, which has been dealt with. No actual damage from misuse. Some users may face inconvenience because of the response
- Cause
- A third party exploited a web server vulnerability in part of the subsidiary's system environment
- Response
- Blocked the access route soon after discovery and reported to the relevant authorities. Will re-inspect all services for vulnerabilities with outside specialists
- Leaked data
- MOS Card number (16 digits), PIN (6 digits), balance information
- Records
- 1,133,070 of about 3.8 million cards issued (about 570,000 in circulation, about 560,000 not yet in circulation)
- Not included
- Personal information such as name, address, phone number and credit card details
- How it was found
- The leak was confirmed to result from unauthorized access using an external program
- Damage
- No customer enquiries about damage caused by this incident (as of October 23)
- First response
- Forcibly reset the PINs linked to the leaked card numbers
- Contact
- Dedicated MOS Card help line (9:00 to 22:00): 03-3496-8322 until October 26, 0120-395-126 from October 27
Value Card platform (Value Design)
ID numbers, PINs and balances leaked: 1,424,748 records (PayCloud Holdings)
↓ Card issuers among Value Design's clients
MOS Card (MOS Food Services)
1,133,070 records. PINs forcibly reset
Other issuers
Names, cards and figures not disclosed
↓ Cardholders
Check usage history, follow the issuer's guidance, never share the PIN
What is known and what is not
Based on the three companies' announcements (all dated October 23) as of October 26, 2026. We will update the status column as follow-ups appear.
| Item | What was announced | Status |
|---|---|---|
| ID (card) number, PIN, balance | Data managed for Value Card and MOS Card | Leak confirmed (PayCloud Holdings, MOS Food Services) |
| Value Card total | 1,424,748 (569,224 issued, 855,524 unissued) | Confirmed (PayCloud Holdings) |
| MOS Card total | 1,133,070 (about 570,000 in circulation, about 560,000 not in circulation) | Confirmed (MOS Food Services) |
| Names, addresses and other personal information | None. MOS lists name, address, phone number and credit card details | Not included (both companies) |
| Misuse | Risk of misuse of issued IDs dealt with, no actual damage. MOS has had no damage enquiries | No actual damage (PayCloud HD); no damage enquiries (MOS) |
| MOS Card PINs | PINs linked to the leaked card numbers forcibly reset | Confirmed (MOS Food Services) |
| Cause | A web server vulnerability exploited by a third party. Which one is not stated | Confirmed (PayCloud Holdings); details not stated |
| Other issuers | Progress is being reported to some client companies, but no company or card names are given | Not stated |
| How the MOS Card figure relates to the total | The companies use different breakdowns (issued/unissued vs. in/not in circulation); whether the MOS figure is part of the total is not stated | Not stated |
| Link to the October 22 suspension of other services over a PHP vulnerability | Not mentioned in the October 23 announcements | Not stated |
| Handling of unissued and uncirculated cards | Not mentioned | Not stated |
Why we do not add the figures together
1,424,748 is the Value Card total given by PayCloud Holdings, and 1,133,070 is the MOS Card figure given by MOS Food Services. The two companies break their figures down differently, and neither says whether the MOS Card figure is included in the total. This article shows the two numbers separately and does not add or subtract them.
What can happen when card numbers, PINs and balances leak
In general, if someone learns a prepaid card's number and PIN, the following can happen (there is no announcement that it happened in this incident; PayCloud Holdings says there has been no actual damage, and MOS Food Services says it has received no enquiries about damage).
What can generally happen
- Someone uses the card number and PIN to spend the balance online as if they were the holder
- Scam calls or messages that ride on the news and claim you must "reset your PIN" to get the number
What you can do
- Check your usage history for deductions you do not recognise
- Follow the issuer's guidance (PIN reset, reissue)
- Never give your PIN or card number to anyone who asks
For a prepaid and points case in which names and contact details were viewed, see the Seicomart app breach. This case is the opposite: no names leaked, but the numbers needed to use the card itself did.
For businesses that outsource a prepaid card system
The only disclosed cause is "a web server vulnerability"; which product or vulnerability is unknown. This section sticks to what the disclosed sequence of events and the leaked items show.
Know which of your data sits on the provider's platform
In this incident, the platform operator published the overall figure and the issuer, MOS Food Services, published the figure for its own cards. An issuer has to explain to its own customers, in its own words, who is affected and what to do. Check in normal times how much of your card numbers, PINs and balances (including cards not yet sold) is held on the provider's platform.
Prepare a procedure for resetting PINs in bulk
MOS Food Services forcibly reset the PINs linked to the leaked card numbers and says in-store use is not affected. On the other hand, some cardholders can no longer check balances online or register the app, so the company handles them through its help line. Deciding in advance which functions cardholders lose after a bulk PIN reset, and how they will set a new one, makes the notice faster to publish.
Protect data for cards that have not been sold yet
In both companies' breakdowns, about 50–60% of the leaked records were cards not yet sold. The number and PIN of an unsold card become usable once it is sold. Review where data for unsold cards is kept, and whether their PINs can be changed before sale, just as you would for cards in use.
MOS Food Services lists as recurrence-prevention measures: stricter security audits of contractors, stronger controls against unauthorized access via APIs, restrictions on simple or high-risk passwords, source IP address restrictions for administrator accounts, and stronger monitoring including contractor environments. These are measures the company says it will take; they are not a statement of the cause of this incident.
Sources (public record)
The facts in this article are based on the public information below. We have not speculated about undisclosed attack details or causes.
- PayCloud Holdings, Inc., notice on unauthorized access to a system provided by a consolidated subsidiary (October 23, 2026, stock exchange disclosure, Japanese) — release.tdnet.info (PDF)
- Value Design Inc., notice on unauthorized access to a system it provides (October 23, 2026, Japanese) — valuedesign.jp
- MOS Food Services, Inc., notice on the leak of prepaid card information due to unauthorized access (October 23, 2026, stock exchange disclosure, Japanese) — eir-parts.net (PDF)
- MOS Burger official site, important notice on the leak of MOS Card information (October 23, 2026, Japanese) — mos.jp
- Value Design Inc., notice on suspending some services in response to a critical PHP vulnerability (October 22, 2026, Japanese; no link to this incident is stated) — valuedesign.jp
Update history
2026-10-26: First version, based on the October 23 announcements by PayCloud Holdings, Value Design and MOS Food Services. We will update it when other issuers or the cause are announced.
Read next
- A prepaid and points case: The Seicomart app breach
- Follow-on scams: What is phishing?
- A breach through a service provider: The Temairazu breach
- Major 2026 incidents: Japan's major data breaches of 2026 / list of breaches and cyberattacks (Japan and worldwide)
- For operators: The minimum security baseline for organizations