Confirmed

LEAN BODY: Metabase intrusion led to theft of data on about 440,000 customer accounts

Metabase vulnerability abuse from Aug 11, 2026 led to theft of customer data; disclosed Sep 15. Scope: about 440,000 accounts including churned users (unique people may be fewer). Email, nickname, sex, DOB, height/weight etc., hashed passwords, card last-4. PPC confirmed report Oct 23.

Last updated: 2026-11-09

Overview

“About 440,000 accounts” → blank.

Timeline

UnknownOccurred
2026-09-08Discovered
2026-09-15Disclosed

Organization response

Per the notice, the organisation investigated and contained the incident, notified individuals and offered monitoring or protective resources.

What you can do

Be wary of emails, SMS or calls impersonating the organisation; do not open links or attachments or enter passwords or card details. Change reused passwords on other services.

Sources

お客様情報の不正取得に関するご質問株式会社LEAN BODY · 2026-11-09
弊社が利用する分析ツールへの不正アクセスによるお客様情報の取得について（お詫び）株式会社LEAN BODY · 2026-11-09

LEAN BODY: Metabase intrusion led to theft of data on about 440,000 customer accounts

Overview

Timeline

Organization response

What you can do

Sources

Related information

No published information yet

Comments and replies

Write a comment