What happened
On October 9, 2026, BOOKOFF GROUP HOLDINGS (9278.T) announced that on October 6 it confirmed unauthorized third-party access to a subsidiary's member management system, and that member information leaked outside the company. As of the notice, it had not confirmed public disclosure or misuse.
Official scope
Up to about 6.43 million records (membership numbers that may have leaked, not necessarily distinct people). Possible data: names, dates of birth, gender, emails, phone numbers, postal codes and addresses, password hashes, point-card and membership numbers. Payment information, including credit cards, was not stored in the system. No confirmed alteration of member data.
Company response
Blocked the attack source, fixed the vulnerability, cut external access to the affected system, started an emergency inspection of all systems, reported to the Personal Information Protection Commission and plans to contact affected customers individually.
Ask to customers
Beware of emails, SMS and calls impersonating the group; do not open unfamiliar URLs or attachments; the group will not ask for passwords, codes, cards or bank details through those channels. Contact: web form and phone 0570-01-2902 (10:00–18:30).
What to do now
- Bookoff members: change your password and watch for phishing.
- Retailers: password hashes plus contact data still warrant rotation and fraud monitoring.
- Keep payment data out of the member system — Bookoff already did; keep that discipline.