概述
Malware on a device obtained credentials on September 18, 2025, followed by repeated logins from November 27; the event was discovered February 18, 2026 and possible personal-data exposure disclosed March 27. Potential fields include names, addresses, phones, email, allergies and reservations, excluding cards and My Number identifiers. The 18,553 count represents records, not unique people.
时间线
- 发生
- 发现
- 披露
Credentials obtained through malware infection.
Repeated unauthorised logins began.
Unauthorised access discovered.
Possible leakage disclosed.
组织应对措施
The company isolated the device, changed and disabled legacy accounts, commissioned external investigation, reported to the privacy regulator and notified affected parties.
用户应对建议
Check notices through the organisation’s genuine contact channels. Do not enter credentials or payment details through links in unexpected messages.
信息来源
- 旧メールシステムの不正アクセスに関する通知ゼットン · 2026-11-09