Confirmé

IMADEYA: stolen Shopify Admin API token used to exfiltrate order/customer data

After phishing reports on the night of Aug 20, 2026 that correctly cited name/order no./amount, IMADEYA opened an investigation and posted Aug 21. Second report confirmed a Shopify Admin API token from an in-house integration was stolen and used from overseas IPs to pull order/customer data. Card data not leaked.

Dernière mise à jour: 2026-11-09

Ce contenu est affiché en English.

Présentation

No published headcount (blank).

Chronologie

InconnuSurvenue
2026-08-20Découverte
2026-08-21Divulgation

Réponse de l’organisation

Per the notice, the organisation investigated and contained the incident, notified individuals and offered monitoring or protective resources.

Que faire ?

Be wary of emails, SMS or calls impersonating the organisation; do not open links or attachments or enter passwords or card details. Change reused passwords on other services.

Sources

お客様情報の外部流出の可能性に関するお詫びとお知らせ（第1報）株式会社いまでや · 2026-11-09
お客様情報の外部流出に関するお詫びとお知らせ（第2報）株式会社いまでや · 2026-11-09

IMADEYA: stolen Shopify Admin API token used to exfiltrate order/customer data

Présentation

Chronologie

Réponse de l’organisation

Que faire ?

Sources

Informations associées

Aucune information publiée

Commentaires et réponses

Écrire un commentaire