passwords
25 articles with this tag
Unauthorized access to the online mahjong game Maru-Jan (1,855,578 members): email addresses and passwords leaked — what members should do
On November 7, 2026, Signaltalk Co., Ltd. announced that unauthorized access to Maru-Jan, the online mahjong game it operates, had leaked the email addresses and passwords of 1,855,578 members. The company says a function of its administration system was abused and that data including member information was downloaded externally by about 15:00 on November 4. The affected group is all Maru-Jan members; email addresses are included for members who registered one. Credit card numbers are not included because the company does not hold them. The notice does not say how passwords were stored (for example whether they were hashed). The company says it identified the intrusion route, applied a fix and resumed service at 16:00 on November 7. It asks members to change their Maru-Jan password, change the password at any other service where they used the same one, and watch for suspicious emails. As of November 9, 2026, no follow-up notice had been found. This site's conclusion: change the password at any service where you reused your Maru-Jan password before anything else, and do not open links in emails that use the Maru-Jan name.
Unauthorized access at Iris Plaza (data on about 7.7 million people): names, addresses and encrypted passwords may have leaked — what members and shoppers should do
On November 5, 2026, Iris Plaza Co., Ltd., part of the Iris Group, said in a second notice that unauthorized access to Iris Plaza, the official Iris Ohyama online store, may have leaked part of its customers' personal information. On October 28 the company found suspicious files in an external cloud service it uses, immediately stopped Iris Plaza and related systems, began an investigation and confirmed unauthorized access by a third party. The personal data stored in the external cloud service covered about 7.7 million people, and the company has confirmed that this data may have been viewed or obtained. The actual number of records leaked and people affected is still under investigation. The information that may have leaked is, for member data (about 5.8 million people, including former members), name, address, phone number, email address, gender, password (except for former members), date of birth and more, and for non-member data (about 1.9 million people, including people who bought without registering or entered campaigns), name, address, phone number and email address. Some items, including passwords, are encrypted. The company says credit card information was not stored in that cloud service and has been confirmed as unaffected. It asks people who use the same password elsewhere to change it. As of November 7, 2026, no third notice had been found. This site's conclusion: if you use your Iris Plaza password on any other service, change it today. Former members and people who bought without registering are also covered.
Nojima Online and Used-Phone Buyback Site Unauthorized Access (About 7 Million Records): Names, Addresses, Phone Numbers and Encrypted Passwords, and What Members Should Do
Nojima Corporation announced on November 2, 2026 that the Nojima Online member management system was accessed without authorization and that member data of Nojima Online and its used-phone buyback site leaked. According to the company, it detected and confirmed the access on November 1 and confirmed the same day that personal data had leaked outside. The scale is about 7 million records (members who have withdrawn are not included). The items are name (kanji and kana), date of birth, gender, postal code, address, phone number, login ID, encrypted password and email address. The company says it does not hold payment information and holds no credit card information on the two sites. The cause, the period of intrusion and whether any misuse or secondary harm has occurred are under investigation, and both sites were suspended as of the November 2 announcement (no reopening notice seen as of November 4). The company warns that the data could be abused for impersonation emails and phishing, but its notice does not ask members to change passwords. Our conclusion: do not open links in messages that claim to come from Nojima. If you reuse your Nojima password elsewhere, change it on those other services.
Aena EC App Unauthorized Access (My Page Data of Up to 817,215 People): Names, Addresses and Delivery Details That May Have Been Viewed, and What Members Should Do
Aena Co., Ltd., a Japanese off-price retail chain, announced on October 14, 2026 that member My Page data in its EC app may have been viewed without authorization. According to the company, system log analysis found it at 5:58 on October 13, and up to 817,215 members (full members) may have been affected. LINE members and customers who bought through Amazon, Rakuten and similar sites are not affected. The information that may have been viewed is name, address, phone number, email address, date of birth, gender, occupation, delivery address, name and phone number (including those for third parties), favourite store and mail settings, and the last 4 digits, expiry date and cardholder name of registered credit cards. The company says it does not hold full card numbers or security codes, that no password was viewed or leaked, and that it confirmed no member information was changed, no one was withdrawn and no purchase was completed. The cause is given as mechanical continuous access made through unauthorized access, and the investigation continues. The company blocked access to its EC site, and the EC app, which had been suspended, resumed at noon on Monday, October 19; a password reset screen appears at the first launch after the restart. This site's conclusion: reset your password in the app, change any other service where you reused it, and check messages about deliveries or orders without using their links or numbers.
Hana-cupid Member Data Breach (Up to 4,238,242 Records): User IDs, Encrypted Passwords and Email Addresses Leaked, and What Members Should Do
Hana-cupid Co., Ltd. announced on October 28, 2026 that unauthorized access by a third party to its online florist services, Internet Hana-cupid and Business Hana-cupid, had leaked some member information. According to the company, a third party accessed its management system without authorization between October 14 (Wed) and October 15 (Thu), and the company confirmed the leak of member information on October 19 (Mon) during its investigation. The count is 4,238,242 (customers who may be affected). The leaked items are: user ID (login ID), password (an encrypted form that cannot be used as it is; the FAQ calls it hashed), PC email address and mobile email address. The company says name, gender, date of birth, address, phone number, credit card number, company name, department name and delivery destination information did not leak. Only members who registered an email address on the company's official online shop (i879.com, i879.com/biz/) are covered; orders through external shopping malls, phone orders without an email address, and purchases at Hana-cupid member florists are not. The company says it does not hold credit card information and that there is no need to stop or reissue a card. It has not confirmed any secondary harm, began emailing affected members individually on October 28, and has reported to the Personal Information Protection Commission and the police. The cause is not stated, and the company is investigating with an external specialist organisation. It says it does not plan monetary compensation or refunds. This site's conclusion: if you could be affected, change your password and any other service where you reused the same ID and password. Check anything claiming to be from Hana-cupid or a financial institution by opening the official site yourself, not through its links.
White Essence Unauthorized Access and Personal Data Leak (About 1.05 Million Accounts): Names, Addresses, Phone Numbers and Encrypted Passwords, and What Users Should Do
White Essence Co., Ltd. announced on August 12, 2026 that it had suspended its systems after unauthorized access to its booking site and core systems, and on October 5 published its findings in a notice titled 'Apology and Notice Regarding Leak of Personal Information Due to Unauthorized Access'. According to the company, it confirmed unauthorized access from outside on August 5, suspended the systems on August 12, and the investigation later found that personal information had been taken outside. Of the information registered as of August 5, 2026, the number of people affected is about 1.05 million accounts (a total that includes customers, franchise clinic personnel and head office employees). The leaked items, in whole or in part, are name, address, phone number, email address, date of birth, gender, workplace, login ID and password (in encrypted form), information about use of and responses to services, and the company's management number. The company says it does not hold financial institution account information, and that it has not confirmed that customers' images leaked. The cause, it says, was the exploitation of a vulnerability in the program of its booking site, used as a starting point to access its core systems without authorization; the company says it has finished dealing with that vulnerability. As of October 5 no secondary harm had been confirmed, but the company says suspicious emails, calls or mail posing as the company or other businesses may arrive. Our conclusion: if you use the same login ID and password on other services, change them there. Treat any message claiming to be from the company or a dental clinic as unverified even if your name, address and birth date are correct, and check through an official channel you look up yourself.
Beauty Garage and Eyelash Garage Unauthorized Access (775,725 Records): Salon Names, Phone Numbers, Emails and Password Hashes Leaked, and How to Guard Against Impersonation
Beauty Garage Co., Ltd. announced on October 15 that its e-commerce site servers, and those of Eyelash Garage, were accessed without authorization from October 10 to 12 and that some customer information leaked. It detected the incident on October 13, identified the route and blocked it the same day. According to the company, the scope is 775,725 customer records held in the Beauty Garage and Eyelash Garage e-commerce systems as of 23:55 on October 10, 2026 (no per-brand breakdown is given); Eyelash Garage's own notice gives 49,191 (how this relates to 775,725 is not stated). The main items confirmed as leaked are company name, salon name, customer name, business type, salon URL, phone number, email address, password hash values, and hash values of the password-reset question and answer. Leaks of address and shipping information, purchase history and payment information including credit cards have not been confirmed so far. The company says it has not confirmed that the data was published or misused. Second notices from both companies on October 20 say the e-commerce sites are operating normally and that the matter has been reported to the Personal Information Protection Commission. The cause has not been disclosed. This site's conclusion: a message claiming to be from either company or a business partner is not genuine just because it gets your salon name or your name right. Verify any request to change a bank transfer destination or make an extra payment through an official contact.
So-net Member Database Unauthorized Access (2.14M So-net Records, 443K plala S-Course Records): Names, Phone Numbers and Birth Dates Leaked, and What Users Should Do
Sony Network Communications Inc. announced on October 27, 2026 that it had confirmed an information leak from unauthorized access to the member database of its internet service So-net. According to the company, the database was accessed from outside on October 19, the company confirmed this on October 23 and stopped the affected server, and on October 24 it established which items and how many records had leaked. The leaked information is: So-net member information, 2,141,986 records (1,869,771 current members and 272,215 former members who left in or after March 2026), and plala (S-Course) member information, 443,495 records (422,365 current and 21,130 former members who left in or after March 2026). Both contain name, phone number, email address, user ID, date of birth, gender and internet connection ID. The company says no password leaked in the member information. For four mail services (Mail Service G, A-Box, Sonnet VAIO Mail and PostPet Mail Account Service), mail passwords also leaked, for 54,401 addresses in total, and the company reset them on October 27. Bank account information for 16 records and password-reset notice information for 7 records also leaked, and the company says it will contact those people individually. Credit card information is not included, and the company has not confirmed a leak from other services, including NURO. The cause is given as unauthorized access by a third party (under investigation); the route of the intrusion has not been announced. This site's conclusion: if you used any of the four mail services, reset your mail password and change any other service where you reused it. Everyone should check a message claiming to be from So-net through an official site or the special phone line, not through its links or numbers, even if it gets your name and birth date right.
Qzoo survey site breach (about 400,000 records): member data including bank account details may have leaked, and what members should do
On October 21, 2026, Monitas Inc. announced that its survey site Qzoo had been accessed by a third party without authorization and that members' (panelists') personal data may have leaked. According to the timeline, unauthorized access began at 8:30 on October 17; at 12:22 the database was viewed and updated through SQL injection; at 18:44 the access was detected and blocked; at 19:02 the service was put into emergency maintenance; and on October 20 a preliminary report was made to Japan's Personal Information Protection Commission. The scope is about 400,000 records (all records held in the Qzoo system as of October 17). The database that may have been affected stores basic information (name, date of birth, address, phone number, email address, etc.), member authentication information (member ID, password, etc.), financial information (account number, branch name, account holder name, etc.) and survey answers (annual income, occupation, etc.). The items are still under investigation. The company does not hold credit card data or My Number (Japan's national ID number). It says the intruder exploited a vulnerability in its system. No unauthorized access to its other systems has been found. This site's take: change any password you share with Qzoo today, do not open links in messages claiming to be Qzoo or a bank, and never give your PIN or login details to anyone. Check your bank account activity as well.
How to clear browsing history, cookies and saved passwords (Chrome, Safari, Edge, Firefox on computer and phone): what to delete after a leak, and what to keep first
A guide to deleting browsing history, cookies (site data), cache, saved passwords and autofill in Chrome (Windows, Mac, Android, iPhone), Safari (Mac, iPhone, iPad), Edge and Firefox, using the labels in each vendor's official help. Deleting browsing history does not take back anything already copied and is not a defence against a threat. What reduces future harm is dealing with sign-in state (cookies) and saved passwords: change passwords and sign out of all sessions from a safe device. If you will go to the police, record the threatening email and any suspicious extensions before deleting. If sync is on, deletion also removes the data from your other devices on the same account. In the October 2026 Onamae.com Desktop Cloud case, GMO Internet's sixth notice asks customers to keep browser sync off until their device check is done.
Digital Arts cloud services hit by unauthorized access (i-FILTER@Cloud and five others): some customer data may have been viewed, and what administrators should do
On October 21, 2026, Digital Arts Inc., a Japanese maker of web and email filtering and file-security products, announced in a timely disclosure and on its website that it had found traces of unauthorized access to the operating environment of its cloud services and to its internal environment. According to the company, credentials used to operate its cloud services were obtained by an outside party and used to get into the service operating environment. As a result, information on some customers of six cloud services (i-FILTER@Cloud, m-FILTER@Cloud (Modern Edition), m-FILTER MailAdviser for Microsoft 365, FINAL CODE@Cloud, z-FILTER and Desk) may have been viewed by the outside party. The traces were found on October 9 in a company-wide review that used AI, and some go back to around July 2025. As of noon on October 21, no taking of customer data outside the company had been confirmed, and no misuse or secondary harm had been reported. The data items and the number of customers that may have been viewed have not been published. The company asks every customer of the six services to change administrator and user passwords, and will contact some customers individually where more action is needed. On-premises software versions are not affected. In an investor Q&A on October 23, the company said its whitelist database was neither viewable by the intruder nor altered, and that it has reported the incident to Japan's Personal Information Protection Commission. This site's conclusion: administrators at organisations using any of the six services should change administrator and user passwords this week and check whether the company has contacted them individually.
Trustbank's Furusato Choice breach (4,454,097 member records): names, addresses and hashed passwords leaked — what donors should do
On October 20, 2026, Trustbank, Inc., which runs Furusato Choice, a major site for Japan's furusato nozei hometown tax donation scheme, announced that an outside party had gained unauthorized access to member data and that donors' personal data had leaked. After noticing unusual access patterns on October 19, the company found that the unauthorized access had taken place on October 17, and it shut down the related services at 15:50 on October 19. The leak it confirmed covers 4,454,097 member records: name, email address, postal address, phone number, hashed password and estimated donation tax deduction amount. In a second report on October 23, the company said that for five of these donors additional items had leaked, including points history, donation history, date of birth and delivery address. For two of them, an outside party accessed the My Page screen that shows saved card details (last four digits, cardholder name, expiry date). The company says card details are fetched from the payment processor each time that screen is shown and are not stored in its systems, and that they cannot be used on their own to make a card payment. Members have been emailed individually since October 21 about whether their data leaked and which items. In a third report on October 26, the company said it had begun gradually resuming the donation management system used by municipalities and return-gift vendors that day (its FAQ of the same day says from October 25). New donations are not being accepted, and no restart date has been set for the donor-facing site. All members' passwords have been invalidated, and a new password will need to be set after the restart. This site's conclusion: members should change the password on any other service where they use the same email and password combination, and should not open links in messages claiming to be from Furusato Choice or a municipality.
Unauthorized Access to Medley's Clinic System @link (at-link): Patients' Names, Birth Dates, Login IDs and Passwords Leaked — What Patients and Clinics Should Do
On October 15, 2026, Medley, Inc. announced unauthorized access by a third party to its medical-institution management system @link (at-link), the patient-facing at-link app and related services, and said it had suspended them from late at night on October 14. According to the company, it began investigating on October 11 after an outside specialist organization alerted it to possible unauthorized access, and confirmed the access. On October 23 it said it had confirmed that, from late September to mid-October 2026, the third party accessed the company's database through a program it had planted without authorization and obtained information, and that personal data had leaked. For patients who used the at-link app or web booking, the leaked items are name, name reading (furigana), birth month and day, email address (only if registered), app and web-booking login ID and password, the name of the clinic used, registration date, last visit date, and credit card payment history (payment date and amount only; only for those who paid online through the app). For patients who did not use the app or web booking, the leaked items are name, furigana, birth month and day, the name of the clinic used, registration date, last visit date, and the app and web-booking login ID and initial password. The company says it does not hold card numbers. The number of clinics and people affected is under investigation; the company will notify affected people in turn, working with the clinics. It has not disclosed the specific method, saying doing so could invite similar attacks. It has closed the route and invalidated all related credentials, and has reported to the Personal Information Protection Commission and the Ministry of Health, Labour and Welfare. App and web-booking passwords will not be carried over; users will set new ones when the service restarts. In the notice updated at 12:30 on October 28, the company said test use of the clinic-facing “@link Cloud beta” began at some clinics on October 28 (features under test: checking and registering bookings, patient information and the consultation calendar), that the patient app and web-booking site and other services remain suspended, and that it plans to refund fees for the suspension period within November. The investigation into the cause and scope is continuing. This site's view: people who used the at-link app or web booking should change the password on any service where they reused it, and should not open links in messages that mention their clinic or visits. Clinics should direct patient inquiries to the company's dedicated contact.
Comic Cmoa Member Data Breach (Up to About 4.2 Million Records in Log Files): Email Addresses and Dates of Birth Leaked — What Users Should Do
NTT Solmare Corporation, which runs the Japanese e-book store Comic Cmoa (コミックシーモア), published four notices about unauthorized access to the service, from a first notice on October 15, 2026 to a fourth report on October 21. According to the company, on October 15 it judged that unauthorized access from outside to its servers had very likely taken place and suspended the service at 11:35. In its second report on October 16 it said it had confirmed that member data in the system that manages member information had leaked to a third party (the count was still being examined). In its third report on October 18 it said it had identified the intrusion route and attack method and was dealing with them, and that some system log files had also been viewed and taken. In its fourth report on October 21 it described the data confirmed as leaked as 319 records of registration data in the member database (email address, hashed password, nickname, date of birth, gender) and up to about 4.2 million records in system log files (email address, nickname, date of birth, gender; no passwords; possibly including duplicates for the same person). It says credit card data is not held in the affected systems and did not leak, and that no leak of purchase histories and no leak, loss or damage of MY Bookshelf (users' libraries) has been confirmed. It says identifying and blocking the intrusion route and attack method is complete, but has not disclosed what they were. Affected people will be contacted by email. The service remains suspended and is to resume in stages, starting with web reading of purchased titles; all users will be asked to reset their passwords on resumption. This site's take: anyone who uses the same email address and password as on Comic Cmoa for another service should change that password today, should not open links in emails claiming to be the company, and should check through NTT Solmare's news release page opened themselves.
Unauthorized Access to Onamae.com Desktop Cloud (GMO Internet) (26,739 Servers Possibly Affected): Customer Data Taken Out, Compensation, and What FX and Securities Traders Should Do Today
On October 21, 2026, GMO Internet, Inc. announced unauthorized third-party access to Onamae.com Desktop Cloud, a VPS (virtual private server) service for FX auto-trading, and said a malicious program had been placed in some customers' server environments. 26,739 servers may be affected; the company says this is the number of servers that could be affected, not the number where unauthorized access or data acquisition has been confirmed. From 04:00 on October 21 it stopped the servers of all plans one after another. In its fourth notice of October 24, the company said a security problem existed in the service's system, and that it had confirmed unauthorized access to the service environment and that customer information had been taken out. It also said some customers had reported trades on their trading accounts that they did not make. Which information was taken and for how many customers, the intrusion route, and the number of affected accounts and amounts have not been disclosed. The company will pay a flat 5,000 yen to every current user of the service, and will compensate realized losses from trades it finds were caused by this unauthorized access (minus any refund from the exchange or broker). It will not restart the current system platform as it is, and will offer a switch to an alternative service on a separate cloud platform, free for six months after switching. According to the company, someone it believes to be the attacker has demanded money and threatened to publish information and take other actions if it refuses; the company says it will not pay and has given evidence to the police. Its fifth notice of October 24 again asks customers to fully scan and back up their own devices, change passwords from a device not used for FX trading, end all signed-in sessions even if they have already changed their password, and set up two-factor authentication. In its seventh notice of October 26, the company said that a party believed to be the attacker had announced it would publish customer information and launch a ransomware attack at 12:00 on October 27. In its eighth notice of October 27, it asked customers to back up their data and then, before 12:00, disconnect from the network, shut down and unplug every cable connected to the PC. In its ninth notice (as of 11:59), it said no malware (including ransomware) had been found on the customer devices it had finished analysing, but that this did not confirm every device was safe, and that customers hit by ransomware who contact its support desk would be given a new PC of equivalent performance after the damage is checked. In its tenth notice of October 27 (as of 13:55), the company said it had confirmed at 12:30 that a party believed to be the attacker had published what it claims is information about the company and its customers (the company is still checking the content and says it may include false information). It said no ransomware attack had been confirmed as of 13:55. It asks people not to visit or share the site where the information was reportedly published, saying that the attacker obtains the information of anyone who visits it. In its twelfth notice (as of 19:10), the company said it would pay a special payment of 10,000 to 25,000 yen per category of information (capped at 3 million yen per publication) to customers whose information it confirms was included in what the attacker published, and set up a bounty capped at US$1 million in total for information that helps identify the perpetrators (accepted from 12:00 on October 28). In its thirteenth notice of October 28 (as of 11:00), the company said it had confirmed that the domain of the site of the party believed to be the attacker (including mirror sites) was suspended at around 04:00 that day, and that it would act to take down any similar site that appears. In its fourteenth notice the same day (as of 18:20), the company said the bounty site, opened at 12:00 that day, had received 113 tips in its first six hours or so (as of 18:00), that it had sent 20 warnings in total about posts on X spreading the URL or content of the site of the party believed to be the attacker (as of 18:00), and that its analysis of devices has found no traces of malware infection or ransomware attack so far. It thanked customers for powering devices off and asked them, if they reuse a PC, to run a security scan and take a backup beforehand. In its fifteenth notice (as of 12:40 on October 29), the company said its group white-hat hacker team had carried out its own investigation and obtained information it believes may lead to identifying the perpetrators, which it planned to submit to the police and other relevant parties that day, and reported 270 tips to the bounty site as of 11:30. In its sixteenth notice (as of 20:50 on October 29), it reported that tips had risen from 113 (as of 18:00 on October 28) to 321 (as of 18:00 on October 29), gave a reporting form (listed in the fifteenth and sixteenth notices) for new attacker sites and sites where personal information is published without authorization, and again asked people not to identify or contact perpetrators, post unverified information or share suspicious URLs. It also says it will take legal action, including criminal complaints, against the attack and the extortion. The disclosure of October 28 says that, according to its parent GMO Internet Group, the group is still checking its companies' services and, at present, no impact from this incident has been confirmed on services other than this one. Customers are reported to have received emails from a sender believed to be the attacker, with part of their browsing history attached as proof that the data is held. The company's group CEO wrote in a blog post that the attacker has threatened to publish information on customers' PCs and to attack them with ransomware, but the company has not said that any customer's PC was actually compromised. Its sixth notice of October 26 asks customers to fully scan the devices they used to connect and to keep browser sync off until their check is done, among other steps. This site's take: from a device you do not use for FX trading, change your broker passwords, end all sessions, and check your trading history and balance. Use only the company's official site and the notices sent to your registered email for compensation, and never give anyone a password that can trade.
SourceNext Member Data Leak (22,519,960 Records): Emails, Passwords and Addresses May Be Exposed — What Members Should Do
On October 15, 2026, SOURCENEXT CORPORATION announced that a third party had gained unauthorized access to member data it manages and that personal data of its registered members had leaked outside the company. According to the company, from around 10:00 on October 9 a third party misused a member data retrieval API to obtain member information; the company confirmed the unauthorized access at around 9:00 on October 13 and completed containment by 13:36 the same day. The data that may have leaked covers 22,519,960 records. The items are email address, password, name, name in katakana, address, gender, phone number, fax number, date of birth, company name, job title, department and system identifiers (subscribed services, registration date, login date and so on); the items differ by how each member registered. Credit card data is not stored in the affected system and is not included, the company says. In an update on October 16, the company said every member's password has already been disabled and the old passwords no longer work, and asked members to set a new one. An October 19 report attributes encrypted storage and confirmed decrypted exposure to the company’s spokesperson. The company's FAQ says it asked an independent outside security specialist to start a third-party investigation on October 16, that its Super Security and Virus Security products can still be used as before, and that data saved in 1Password is not held by the company and is not part of the leak. Separately, on October 27 and November 5 the company announced that a third party had gained unauthorized access to the provider of the email delivery service it used (a contractor), so email addresses and order information used for deliveries may have leaked (142,669 records, counted as distinct email addresses, in the November 5 second report; passwords, names, addresses, phone numbers and credit card information are not included). The company says this is a separate incident, unrelated to the October 15 one. This site's take: anyone who has registered with SourceNext should first change the password on any other service that uses the same email and password, then set a new SourceNext password through the official website opened themselves, and not use links or numbers in emails, text messages, calls or letters claiming to be SourceNext.
Bookoff Member Data Leak (6,383,279 People): Names, Addresses, Emails and Password Hashes May Be Exposed — What Members Should Do
On October 9, 2026, BOOKOFF GROUP HOLDINGS LIMITED announced that a third party had gained unauthorized access to the member management system for Bookoff in Japan, provided by its subsidiary BOOKOFF CORPORATION LIMITED, and that member data had been leaked outside the company. According to its second report on October 13, member data was taken from outside between October 4 and 6. The count is 6,427,735 records by member number, or 6,383,279 people when member records registered with the same email address are counted as one person (212,371 of them former members). Those affected are app members, online store members and web members; people who only use a member card and never registered through the app or web are not included. The data that may have leaked is name, date of birth, gender, occupation, nickname, email address, phone number, postal code and address, password hash, point card number and member number (occupation and nickname were added by a correction on October 16), though not every item leaked for every member. Payment data such as credit card details, bank account details, text read from ID documents at in-store buybacks and ID document images from mail-in buybacks are not included. The company emailed affected members in stages from October 15 (sending to every address it could confirm as deliverable finished on October 22) and asks them to change their passwords for the official online store and app. On October 23 it announced a web lookup on the Bookoff member site that lets members sign in and check whether they are affected, and said it had opened a dedicated toll-free line on October 22. In its third report on November 6, it said an investigation with outside experts found that a third party had exploited an access-control problem in part of the system that handles member data; it is withholding technical details such as the system configuration and settings. According to the third report, the scope (services, people and data items) is unchanged from the second report, and from October 26 to 29 it also notified affected members individually through notices in the official app. No publication of member data, misuse of points or alteration of member data has been confirmed, and the company says it will fully compensate points if misuse resulting from the incident is confirmed. It plans to submit its final report to the Personal Information Protection Commission in early December. This site's take: anyone who registered through the app or online store should change the password through the official app or a website they open themselves, change it on any other service that shares it, and not open links in emails or texts claiming to be Bookoff.
skyticket (Adventure Inc.) Data Breach (About 14.64 Million Records): Passwords, Refund Bank Details and Some Users' Card Data Exposed — What Users Should Do Today
On October 9, 2026, Adventure Inc. announced three separate incidents of unauthorized access, each by a different route, affecting its travel comparison and booking site skyticket. In the first, an administrative function was misused and used as a starting point to reach other servers and data stored in the cloud; about 14.64 million records leaked, including names (also as written in passports), dates of birth, email addresses, phone numbers, addresses and the remitter name used for bank transfers, and about 4.13 million of them included hashed member passwords. In the second, a vulnerability in a business management system was exploited, and 17,780 records (including duplicates, with more still being counted) containing refund bank account details leaked or may have leaked. In the third, a bus booking completion page could be displayed without logging in, and about 12,000 bookings were or may have been viewed. The company first said card numbers were not among the leaked data, but corrected this in a second notice on October 16: the card number, cardholder name and expiry date (for some, the number only; no security codes) of up to 6,140 people who registered or used a credit card to pay the "skyticket Premium" membership fee between February 2017 and June 2018 leaked in the first incident, along with member IDs, names and passwords for a welfare benefits service offered as a Premium perk. Passport images were not exposed, and as of the October 9 notice the only confirmed secondary harm was one unauthorized login to a member account (the second notice does not say whether the leaked card data has been misused). This site's take: members should change their password from the official site or app today, change it anywhere it was reused, check card statements from October onward if they registered or used a card for the Premium fee in that period, ignore messages about refunds, compensation or booking changes, and never give anyone a bank PIN or one-time code.
How to check if your password was leaked: using Have I Been Pwned safely, and the checks already built into your browser and phone
A guide to checking for leaked passwords. Have I Been Pwned (HIBP) tells you whether an email address appears in a known data breach, which service it came from and what kinds of data leaked. Its password check (Pwned Passwords) hashes the password on your device and sends only the first five characters of the hash, so the password itself is never sent (HIBP API documentation). This site's take: check your current passwords where they are already saved (Google Password Manager, the iPhone Passwords app, Edge Password Monitor, or your password manager) instead of typing them into a website, and use HIBP for email addresses. A 'not found' result is not proof that nothing leaked.
infoQ survey site breach (894,082 records): what leaked and what members should do
On October 5, 2026, GMO Research & AI, Inc. announced that its survey site infoQ had been accessed by a third party without authorization and that members' personal data had been taken out. In its second report on October 14, it confirmed the number of records taken out as 894,082 (the first report said up to 948,498). The items are name, name reading (furigana), gender, date of birth, email address, home address, phone number, encrypted password, member ID, and other registration data such as nickname and point balance. The company does not hold credit card data or My Number (Japan's national ID number). In addition, 611 point exchanges worth 2,869,500 yen were converted into Amazon gift codes without the members' consent, and the company says it will compensate them in full (credited to accounts when the service resumes). The company invalidated all members' passwords on October 7. The company says the intruder exploited a vulnerability in software used on its site. This site's take: with birth dates and addresses included, convincing fake messages are easy to make. Change the password on any service that shares your infoQ password, turn on two-step verification for your email account, and do not open links in messages claiming to be infoQ.
EPARK Relax & Esthe "PeakManager" data breach (about 22.18M records): health notes leaked too — what salon customers should do
EPARK Relax & Esthe Co., Ltd. announced that the database of PeakManager, the booking and customer-management system it provides to salons, was accessed without authorization and customer data was transferred outside. Its first notice (July 31, 2026) gave about 33 million records; after removing duplicates, its second notice (September 24) gave about 22.18 million records, which it says cannot be converted into a number of people. The leaked items are name and its phonetic reading, date of birth, gender, address, phone number, email address and a notes field where salons recorded handover notes for treatments, partly including health conditions and other sensitive personal information. The first notice also said encrypted passwords may have leaked and asked customers to change them. This site's take: PeakManager is each salon's own customer ledger, so people who never used EPARK can still be affected if they gave a salon their name or contact details. Do not respond to messages claiming to be from a salon or the company, and change your My Page password and anywhere you reused it.
The Gyazo Breach (About 23.62 Million Records): User Data and Image Metadata Leaked — What Users Should Do Today
A vulnerability in Gyazo's image upload server was exploited, leaking about 23.62 million user records and metadata on about 490 million images, mostly uploaded before January 2019. This site's view: change your password and stop reusing it — that is the minimum. What is easy to miss is that the leak covers information about the images rather than the images themselves: text read from screenshots (OCR), photo location data and upload IP addresses. If a screenshot showed a secret, revoke that secret.
What is password hashing? Storing passwords safely with a one-way transform
Password hashing means storing a password as a one-way, non-reversible transform. Never store plaintext. Unlike encryption you can't decrypt it back — that's the point. But plain MD5/SHA-256 falls to rainbow tables and brute force. The fix: a per-user salt plus a deliberately slow hash (bcrypt/Argon2/scrypt). Don't roll your own — use the standard function.
What is a salt? The random per-user value added when hashing passwords
A salt is a random, per-user value added before hashing a password. The same password then stores differently for every user, which defeats precomputed rainbow tables and stops one cracking run from breaking many accounts. A salt is not secret — store it alongside the hash. bcrypt/Argon2 add one automatically.
How to store passwords safely: the right way to hash and salt
A practical guide to storing passwords safely on the server. Understand why plaintext, encryption, and raw hashes all fail, then converge on one answer: a per-user salt plus a deliberately slow hash (Argon2id recommended, bcrypt/scrypt as alternatives). Don't roll your own — use the standard function, raise the cost over time, and migrate weak hashes by re-hashing on login.