credit cards
5 articles with this tag
Good Smile Company Official Shop Breach (Full Card Data May Have Leaked for 2,800 People, Partial Card Data on 402,466 Cards, Up to 202 Orders Possibly Viewed): What Each Group Should Do
Good Smile Company Co., Ltd. announced on October 23, 2026 that its official shop had been accessed by a third party, and by its fourth report on October 30 it had sorted those affected into three groups. Group B (2,800 people) may have had the cardholder name, card number, expiry date and security code entered on the payment page captured by a malicious program that was in place from 13:55 on October 21 to 7:00 on October 23. Group A (anyone who ever registered a card; 402,466 cards, number of people still being checked) is limited to the last four digits of the card number and the expiry date, and the company considers misuse of that alone extremely unlikely. Group C (5,356 people) concerns unshipped order data (name, address, phone number, email, order contents and similar); at most 202 orders may actually have been viewed. The company says the cause is not the recently reported PHP vulnerability. This site's conclusion: Group B should contact the card issuer and ask about changing the card number. People who get no email but ever registered a card on the shop are still in scope and should check statements. Do not open links in unexpected messages claiming to come from the company.
NewsPicks Data Breach (Card Holder Names and Last Digits, up to 362,000 Records): What Leaked Through an Internal Admin Tool and What Users Should Do
On October 8, 2026, Uzabase, Inc. announced that an admin tool used in the operation of its news service NewsPicks had been accessed without authorization by a third party, and that some users' personal data may have leaked. Its second notice on October 9 said the intrusion exploited a vulnerability in that admin tool, and gave maximum estimated counts per item: part of the card data used for web payments (card holder name and the last 3 or 4 digits of the card number, etc.) 362,000; email addresses 323,000; job-level category 273,000; affiliation 65,000; names 59,000; and others. The company says full card numbers and security codes were never stored on its systems and did not leak, and that no password leak has been confirmed. No secondary damage has been confirmed. This site's take: a message that quotes your card's last digits or your employer is not proof that it is genuine. Do not open links, check through the official app or a site you open yourself, and keep an eye on your card statements.
Card-Stealing Program on the PhotoGoods (Daiko Printing) Payment Page: What People Who Paid Between August 6 and September 11 Should Do
On September 16, 2026, Daiko Printing Co., Ltd. announced unauthorized third-party access to PhotoGoods (photo-goods.com), the service it runs, and said a program able to illegally capture credit card data entered on the payment page had been installed. The program was in place from August 6 until it was removed on September 11. People who entered a card on the payment page in that period (including those who did not complete a purchase) may have had their card number, expiry date and security code exposed, along with name, address, phone number, email address and information derived from their member password (stored in a converted form). The company says it confirmed unauthorized access through system vulnerabilities and abuse of a file-upload function. The number of affected people and the actual scope are under investigation, and there was no follow-up notice as of October 7. This site's take: anyone who entered a card in that period should ask the card issuer to change the number, change the password on any other service that shares the PhotoGoods password, and ignore links in 'apology' or 'refund' messages.
E-store ShopServe data breach (final report: about 23.36 million people): what buyers, shop owners and affiliates should do
In its final report of October 16, 2026, E-store Co., Ltd. said a third party exploited a vulnerability in an application on the servers of ShopServe, its service for building online shops, and sent database contents out between May 21 and August 1, 2026. About 23,356,000 people are affected (buyers and members, shop operators and affiliates combined; an approximate figure after removing duplicates), of whom about 2,096,900 had part of their card data included. 7,858 shops are affected (including current and former ShopServe shops). The leak includes buyers' names, addresses, phone numbers, email addresses and workplaces; member IDs and encrypted passwords; cardholder names, the first 6 and last 4 card digits and expiry dates; and the credentials of shops and affiliates. Full card numbers and security codes were not held and were not affected. The final report corrects the second report: shops' mail system and FTP IDs and passwords, and bank account details of the accounts E-store transfers money to (payout accounts), were confirmed not to have leaked. No secondary damage had been reported. This site's take: most buyers shopped on each store's own site without ever hearing the name ShopServe. Even if you cannot tell which shop it was, treat messages that quote your real order details or the last four digits of your card with suspicion, check your card statements, and change reused passwords. Shop owners and affiliates should change their admin or affiliate passwords and turn on two-step verification.
APORITO Online Store (RIZAP) Possible Card Data Leak: What Customers and Online Shops Should Do
According to RIZAP Co., Ltd., a third party planted a malicious script on its APORITO Online Store, and the names, addresses, phone numbers and email addresses — plus card numbers, expiry dates and security codes — of people who placed an order or entered information between May 1 and August 5, 2026 may have been sent outside. The company found a suspicious outbound-transmission program on August 5 and closed the store that day; as of August 18 the store remained closed and the investigation continued. It says no misuse or actual leak has been confirmed. This site's take: with the security code in scope, watching statements is not enough; ask your card issuer to replace the number. The lesson for e-commerce operators is that not storing card data ('non-retention') does not stop a malicious program from being planted in the input page. On top of the five vulnerability measures required by Japan's Credit Card Security Guidelines, have a way to detect changes to your payment page.