Overview
Malware on a device obtained credentials on September 18, 2025, followed by repeated logins from November 27; the event was discovered February 18, 2026 and possible personal-data exposure disclosed March 27. Potential fields include names, addresses, phones, email, allergies and reservations, excluding cards and My Number identifiers. The 18,553 count represents records, not unique people.
Timeline
- Occurred
- Discovered
- Disclosed
Credentials obtained through malware infection.
Repeated unauthorised logins began.
Unauthorised access discovered.
Possible leakage disclosed.
Organization response
The company isolated the device, changed and disabled legacy accounts, commissioned external investigation, reported to the privacy regulator and notified affected parties.
What you can do
Check notices through the organisation’s genuine contact channels. Do not enter credentials or payment details through links in unexpected messages.
Sources
- 旧メールシステムの不正アクセスに関する通知ゼットン · 2026-11-09