What happened
On October 6, 2026, Mr Max Holdings (TSE Prime: 8203), a Fukuoka-based discount store chain, disclosed that servers for its subsidiary's MrMax app and online store were accessed without authorization and personal data leaked.
Timeline
- Saturday, Oct 3, evening: MrMax detects suspicious server access, suspends the services the same day and blocks external access.
- The investigation finds the attacker got in by misusing a function of the software behind the services.
- Oct 6: public notice; reported to Japan's Personal Information Protection Commission (PPC) and the police.
What leaked
- Affected: app and online store members, up to 1,735,154 people (registered as of Oct 3).
- Data: member ID, name, email and phone number (varies by registration).
- Not leaked, per the company: addresses, dates of birth, credit cards, passwords and purchase history.
No misuse had been confirmed as of the notice. The company will email affected customers from noreply@mrmax.jp and says it never asks for passwords or card numbers.
What's still unknown
MrMax hasn't named the software or function abused, nor said whether ransomware or extortion was involved. No group has claimed the attack. Financial impact is under review.
Why it matters
Name + email + phone for 1.7 million customers is ideal raw material for phishing and smishing impersonating the store ("your coupon expires", "confirm your delivery"). It joins a run of retail and loyalty-app leaks in Japan this season, such as the Yakiniku King app.
"Misuse of a software function" usually points to legitimate features misconfigured or exposed: admin panels, export APIs, upload or debug functions left open.
What to do
MrMax customers:
- Distrust emails, SMS or calls in MrMax's name, especially with links.
- Only trust noreply@mrmax.jp, and even then never give passwords or card numbers.
Companies with member apps:
- Inventory admin and export functions exposed to the internet; restrict by IP/VPN and MFA.
- Monitor anomalous volumes of customer-data reads; MrMax detected it the same day, limiting the attacker's window.
- Have a fast service-suspension plan and a notice template ready.
- Minimize data: what you don't store can't leak.
Sources
- Mr Max Holdings, TDnet notice (2026-10-06): https://fs2.magicalir.net/tdnet/2026/8203/20261006546325.pdf
Want to review the security of your app or online store? KGA IT offers a free consultation: kga-it.com.