Overview
Abuse of an API exposed names, addresses, phones, dates of birth, sex, email, member/app IDs, app passwords, points and vehicle information; credit-card data was excluded. An official image dated October 23 postponed expected resumption until mid-November or later; the app is not described as already restored. Occurrence and discovery dates are not established in this entry.
Timeline
- Occurred
- Discovered
- Disclosed
Initial notice disclosed possible leakage.
Final report confirmed exposure affecting 3,179,454 people.
Dated notice image announced delayed resumption.
Organization response
The company restricted app functions, investigated and rebuilt systems with vulnerability testing. It postponed resumption and extended membership/points validity.
What you can do
Check notices through the organisation’s genuine contact channels. Do not enter credentials or payment details through links in unexpected messages.
Sources
- アプリの不正アクセス・第二報・6月19日最終報２りんかんイエローハット · 2026-11-09
- アプリ再開延期：10月23日付本文画像２りんかんイエローハット · 2026-11-09