Overview
Potential fields include names, email, orders, payment-method type and delivery address. An August 28 revision added optional flight numbers and pickup dates. Cards and passwords were unaffected; phone numbers, ID documents and birth dates were not held. Monthly, Home WiFi and Fiber services were excluded. The 44,399 figure is a potentially affected customer scope, not confirmed exfiltration.
Timeline
- Occurred
- Discovered
- Disclosed
Access detected, entry blocked and credentials replaced.
Initial publication and customer notices.
Flight number and pickup date added to potential fields.
Organization response
Og closed the entry route and changed credentials that day, notified Japanese authorities on July 30 and customers the next day, and is strengthening MFA and monitoring.
What you can do
Do not provide payment information in messages; verify through official contact points and trusted URLs.
Sources
- Notice of unauthorized access to customer information, revised August 28Og Co., Ltd. / Sakura Mobile · 2026-11-09