Overview
The service was suspended at 00:30 JST on October 21 and exfiltration confirmed the same day. Intrusion into two API servers and database access were confirmed; the entry route remained under investigation. No total count is published, and customer-level counts such as 2rinkan’s are not added. Card numbers were not held.
Timeline
- Occurred
- Discovered
- Disclosed
Suspicious access detected, service suspended and exfiltration confirmed.
Update: no impact identified on other services.
Organization response
The company suspended the service, investigated, checked system safety and is contacting affected customers. On October 28 it added that no impact on other group services had been identified.
What you can do
Verify notices through official channels, avoid links or attachments in unexpected messages, and do not provide credentials or account details.
Sources
- ブラストメール第1報ラクス · 2026-11-09
- ブラストメール第2報（10月28日追記）ラクス · 2026-11-09