Overview
Suspicious access was detected on May 20. Guest data included names, sex, dates of birth, phones, addresses and reservations, but not guest email addresses, passwords or cards. Partner categories, however, included email addresses, bank information and billing/payment records. Credential misuse also enabled access to other partners’ information. The overall numeric field remains NULL.
Timeline
- Occurred
- Discovered
- Disclosed
Suspicious access detected; all satsuki account passwords reset.
Guest notice published (publication metadata: 10:00 JST).
Guest and partner notices last updated.
Organization response
All satsuki passwords were reset and malicious access blocked on May 20. Authorities were notified and police consulted on May 21; resets for other services began May 26.
What you can do
Check notices through the organisation’s genuine contact channels. Do not enter credentials or payment details through links in unexpected messages.
Sources
- パートナー向け：システムからの情報流出アソビュー · 2026-11-09
- ゲスト向け：satsukiからの情報流出アソビュー · 2026-11-09