The week the GMO case went public in every sense: the attackers posted data, GMO answered with payments and a bounty, and the government asked carriers to block the site. Meanwhile, MUJI disclosed up to 27 million app records, Amadeus exposed Japanese and Korean airlines' bookings, more vendors fell, and the PHP flaws that paused Japan's websites were used to take over firewalls.

The week in numbers

Disclosure Records (maximum) Status
MUJI app (Ryohin Keikaku) 27.26 million, incl. former members Possible
Yumil Link (email delivery), second report 51.63 million, cumulative Taken
Joshin (electronics retailer) 6 million members; 230,000 subscriptions Possible
Hana-cupid (flower delivery) 4.24 million Taken
Rakuten Travel (two incidents) 3.54 million Possible
Arara Message (email delivery) 3.01 million email addresses Taken
So-net and plala (internet provider) 2.59 million, plus 54,401 email passwords Taken
Matsuya (beef bowl chain, ordering apps) 2.38 million, with delivery addresses Taken
Tin Pan Alley (a World subsidiary) 1.2 million, cumulative Possible
JAL and JTA, via Amadeus 92,000, of whom 2,000 with passport numbers Viewed
skyticket, third report 32,341 refund bank accounts; partial card data on 936,000 payments Taken / possible

These figures overlap and mix records with people, so they cannot simply be added up. Our list of 2026's largest breaches now has 49 entries of a million or more, up from 41 a week ago.

GMO: from extortion to a leak, a bounty and a blocking request#

After GMO refused to pay, the attackers began publishing what they said was customer data at noon on October 27. GMO responded the same evening with special payments of ¥10,000 to ¥25,000 per category of published data and a US$1 million bounty for information on the attackers, which drew 321 tips in its first 30 hours. The site's domain was stopped early on October 28, the Tokyo police opened an investigation, and on October 29 GMO said its own white hackers had found information that could help identify the attackers and passed it to the police. No malware has been found on the customer PCs it collected.

Two pieces of the story deserve separate reading. The communications ministry asked carriers to block the leak site, a step Japan has taken only for child abuse images, and GMO's price list for published data sets a new benchmark for what Japanese companies pay breach victims. The main article has the full timeline. We will look at GMO's crisis communication separately.

When the vendor is breached, again#

  • Amadeus: JAL, JTA, ANA, Korean Air and Asiana all disclosed that booking records were viewed through unauthorized access to the passenger service system they share. JAL's window of traces runs from August 2023 to September 2026.
  • Email delivery services: Yumil Link's count rose to a cumulative 51.63 million from 49 client systems, and a fifth service, Arara Message, lost 3.01 million addresses through a web server flaw. Its parent, Paycloud Holdings, also owns Value Design, breached a week earlier.
  • IDCF Cloud: the final report traced the ransomware attack to an open-source flaw in the customer portal's login system, which led to admin rights over the virtualization platform.
  • Marketing tools: the B2B platform ferret One found an attacker account created through an internal admin function on October 14, and the SNS campaign tool OWNLY lost Mos Burger campaign entrants' handles through a file upload flaw.
  • Other contractors: Benefit One's contractor exposed 29,465 members of a credit card perks service; a repair contractor for Don Quijote was hit and its data encrypted; Sukesan Udon's attendance system, run by a contractor, left employees' data, including some reasons for resigning, open to view, about 20,000 people according to the Nikkei; and a Bandai Namco logistics subsidiary may have leaked Ichiban Kuji ONLINE delivery addresses.

Apps and member services#

  • MUJI: Ryohin Keikaku said on October 30 that email addresses, birth dates and gender of up to 27.26 million MUJI app users, including former members, may have leaked. No names, addresses or card data were involved. It has not said when or how. It is the third-largest figure this year, and we will cover it separately as details emerge.
  • Matsuya: the beef bowl chain stopped its app and website on the evening of October 28. Names, phone numbers and delivery addresses of 2.38 million users of its ordering and delivery services leaked. It plans to compensate app members for the outage.
  • Hana-cupid: user IDs, hashed passwords and emails of 4.24 million members, from an intrusion into its admin system on October 14–15. It says it will not pay compensation.
  • So-net: 2.59 million members of So-net and plala (S course), plus email passwords for 54,401 addresses on older mail services, now reset.
  • Rakuten Travel: two separate intrusions, on pages run by a subsidiary in September and on its multilingual site in October, up to 3.54 million records in total.
  • Tin Pan Alley: a World subsidiary's work server was entered on October 17 and the intrusion found only on October 28; up to 1.2 million member records.
  • skyticket: its third report found that attackers read database backups it had never deleted, taking 32,341 refund bank accounts. See the third report.

Joshin: data it did not need to hold in that form#

Joshin's second report on October 26 put up to 6 million member records in scope of a network intrusion found on October 16. The count is not the most telling part. Its subscription service held, for up to 230,000 contracts, data of handwritten signatures, login IDs and initial passwords, and device activation codes. A renovation photo upload system held construction photos of customers' homes and, in a few cases, driver's licenses, a My Number card and bank account numbers that customers had uploaded.

In our view, three things stand out. A handwritten signature cannot be changed. Initial passwords should not be stored in a form that can be read back. And photos of the inside of a home, linked to an address, are a physical security risk as well as a privacy one, the kind of information the Tokyo police warned last week can lead from a leak to a burglary. On the positive side, Joshin issued its first notice the day after it found the intrusion. Some services have been down for more than ten days, and it has not said whether ransomware was involved. We will decide on a separate article after its next report.

Payment page skimming#

Good Smile Company, the figure maker, said its development contractor alerted it on October 23 that its official shop had been accessed. A malicious program sat on its card payment page from October 21 to 23, exposing full card numbers and security codes of up to 2,800 customers. Partial details of 402,466 registered cards may also have leaked. Card-skimming through tampered payment pages remains one of the most common forms of e-commerce breach in Japan.

PHP2Shell, one week on#

The critical PHP flaws that led Japan to pause websites on October 21 were confirmed as exploited: CISA added them to its catalog on October 26, and Palo Alto Networks' Unit 42 said attackers had chained them with a Linux kernel flaw to gain root on internet-facing PAN-OS firewall management interfaces. CrowdStrike, by contrast, found that most public exploit code only crashes PHP. Our one-week analysis argues that the hardest question was where PHP was running at all, and that the answer is asset management, not outside-in scanning.

Other disclosures#

  • giftee: attackers exploited a vulnerability in a subsidiary's system on October 25 to issue e-gifts fraudulently. No customer assets or personal data were affected, but it expects a ¥550 million loss.
  • Ministry of Foreign Affairs: on October 30 it disclosed that its network for external communication had been accessed, detected on July 27. Emails and names, about 3,600 items, may have leaked, about 900 of them from outside the ministry. No classified information was involved.
  • METI: "Dentorinet", the site electricity and gas retailers use to submit trading reports to the market surveillance commission, was attacked on October 27 and stopped.
  • Yakult: about 40,000 records from its website's inquiry forms and a school lunch site, accessed on October 26.
  • TwitCasting: the live streaming service stopped within 25 minutes of detecting an intrusion on October 28; seven records were accessed, and server logs are being checked.
  • Doutor: 951 current and former employees of four Tokyo stores, including bank account numbers.
  • Proterial: the ransomware group Qilin listed the materials maker on its leak site on October 29, according to ransomware.live. This is the group's claim; we have not found a statement from the company.

What to watch next week#

  • GMO: the police investigation, the bounty, whether more data is published, and what the inspection of other Onamae.com services finds
  • MUJI: when and how the access happened, and whether any data was actually taken
  • Amadeus: ANA's numbers, and whether Amadeus explains how the credentials were obtained
  • Blastmail: its planned restart around November 11
  • Times Car: whether the group lawsuit is filed
  • Joshin: the third report, and whether services return