Présentation
The service was suspended at 00:30 JST on October 21 and exfiltration confirmed the same day. Intrusion into two API servers and database access were confirmed; the entry route remained under investigation. No total count is published, and customer-level counts such as 2rinkan’s are not added. Card numbers were not held.
Chronologie
- Survenue
- Découverte
- Divulgation
Suspicious access detected, service suspended and exfiltration confirmed.
Update: no impact identified on other services.
Réponse de l’organisation
The company suspended the service, investigated, checked system safety and is contacting affected customers. On October 28 it added that no impact on other group services had been identified.
Que faire ?
Verify notices through official channels, avoid links or attachments in unexpected messages, and do not provide credentials or account details.
Sources
- ブラストメール第1報ラクス · 2026-11-09
- ブラストメール第2報（10月28日追記）ラクス · 2026-11-09