Investigation results concerning unauthorized access to our service information website
Thinca Co.,Ltd.
The service information website (https://kaiwa.cloud/), 4 sites including this website, and this server
A third party exploited a vulnerability in a CMS plug-in used by this website, gained access to the server, and installed malicious software
Company response
On 26 August 2026, access to 4 sites, including this website and related sites, was temporarily suspended
Public access to each site will be resumed sequentially from 28 August through 1 September 2026
An investigation by an external specialist investigation firm (a digital forensics specialist). Investigation period: 27 August to 7 September 2026
① Rebuilding the server environment ② Refreshing authentication credentials and strengthening access controls ③ Introducing protection and detection mechanisms ④ Not retaining personal information ⑤ Changing the Company's internal operational management organization ⑥ Upgrading the website infrastructure ⑦ Decommissioning the legacy environment ⑧ Establishing account management procedures ⑨ Reinforcing employee training
No amount stated. The impact on FY2026 results is expected to be minor
The impact on FY2026 results is expected to be minor
Related procedures
Submission of preliminary and final reports to the Personal Information Protection Commission, consultation with the competent police station, and reporting of the damage
Personal Information Protection Commission, police station with jurisdiction
The planned permanent measures will be implemented promptly, including migration to a SaaS-based CMS, suspension and deletion of the legacy CMS and related environments, establishment of account management procedures, and employee training. There are no issues affecting the continued operation of services including カイクラ.
If any matters requiring disclosure arise, they will be reported promptly.
| Item | Details |
|---|---|
| Event name | Investigation results concerning unauthorized access to our service information website |
| Date of occurrence | 24 August 2026 (the date it was detected that malicious software had been installed) |
| Date recognized / date notice received | 24 August 2026 (the date the malicious software was detected) |
| Subject Entity | Thinca Co.,Ltd. |
| Target Locations / Products | The service information website (https://kaiwa.cloud/), 4 sites including this website, and this server |
| Cause | A third party exploited a vulnerability in a CMS plug-in used by this website, gained access to the server, and installed malicious software |
| Amount of Impact on Business Performance | No amount stated. The impact on FY2026 results is expected to be minor |
| Impact on Earnings Forecast | The impact on FY2026 results is expected to be minor |
| Type of litigation or proceeding | Submission of preliminary and final reports to the Personal Information Protection Commission, consultation with the competent police station, and reporting of the damage |
| Court or authority | Personal Information Protection Commission, police station with jurisdiction |
| Suspended operations | On 26 August 2026, access to 4 sites, including this website and related sites, was temporarily suspended |
| Scheduled resumption date | Public access to each site will be resumed sequentially from 28 August through 1 September 2026 |
| Investigation structure | An investigation by an external specialist investigation firm (a digital forensics specialist). Investigation period: 27 August to 7 September 2026 |
| Measures to prevent recurrence | ① Rebuilding the server environment ② Refreshing authentication credentials and strengthening access controls ③ Introducing protection and detection mechanisms ④ Not retaining personal information ⑤ Changing the Company's internal operational management organization ⑥ Upgrading the website infrastructure ⑦ Decommissioning the legacy environment ⑧ Establishing account management procedures ⑨ Reinforcing employee training |
| Outlook | The planned permanent measures will be implemented promptly, including migration to a SaaS-based CMS, suspension and deletion of the legacy CMS and related environments, establishment of account management procedures, and employee training. There are no issues affecting the continued operation of services including カイクラ. |
| Planned follow-up disclosure | If any matters requiring disclosure arise, they will be reported promptly. |
Items this document does not state (9)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.A third party exploited a vulnerability in a CMS plug-in used by this website, gained access to the server, and installed malicious software. The stated reason no leakage of personal information was confirmed is that there was no evidence that data on the server had been transmitted externally.