Personal Information Leakage Caused by Unauthorized Access at a Consolidated Subsidiary
株式会社カインドオル (our consolidated subsidiary)
The e-commerce site operated by 株式会社カインドオル and the staff account for the e-commerce platform used on that site
The staff account credentials were obtained by a third party through a phishing email impersonating the operator of the e-commerce platform. In addition, two-factor authentication had not been enabled, meaning that login was possible using only an email address and password, and the password was not sufficiently strong.
Related procedures
Report to the Personal Information Protection Commission
Personal Information Protection Commission
Company response
Internal investigation and an investigation requested from the operator of the e-commerce platform
Two-factor authentication will be made mandatory for all staff accounts, and the management of accounts and access rights will be reviewed. Measures against phishing emails will be strengthened, and information security education and anti-phishing training for employees will be thoroughly implemented. Access rights to customer information and bulk-export permissions will be reviewed, and the monitoring and escalation framework will be strengthened to enable the early detection of suspicious logins, changes to important account information, large-volume data exports and other activity. The settings for two-factor authentication, account and access-rights management, information-export permissions and security monitoring frameworks for the systems and cloud services used by the Company's group will be reviewed, and anti-phishing measures and information security education will be strengthened throughout the group.
The impact of this matter on the consolidated results of the Company's group is currently under review. If it is determined that the matter will have a material impact on results, or if any other matter requiring disclosure arises, the Company will make an announcement promptly.
The customers concerned will be notified individually on a rolling basis regarding the details of this matter and relevant precautions. Preparations are under way to establish a dedicated inquiry desk, and details will be announced on the websites of the Company and 株式会社カインドオル once the arrangements are in place. The Company will also confirm all other staff accounts, request an additional investigation by the operator of the e-commerce platform, review account and access-rights management, and implement measures to prevent recurrence.
If it is determined that the matter will have a material impact on results, or if any other matter requiring disclosure arises, the Company will make an announcement promptly. Details of the inquiry desk will also be announced on the website once the arrangements are in place.
| Item | Details |
|---|---|
| Event name | Personal Information Leakage Caused by Unauthorized Access at a Consolidated Subsidiary |
| Date of occurrence | 22 August 2026 (unauthorized access to the staff account by a third party) |
| Date recognized / date notice received | 24 August 2026 (the Company confirmed that the email address associated with the staff account had been changed and requested an investigation by the operator of the e-commerce platform) |
| Subject Entity | 株式会社カインドオル (our consolidated subsidiary) |
| Target Locations / Products | The e-commerce site operated by 株式会社カインドオル and the staff account for the e-commerce platform used on that site |
| Cause | The staff account credentials were obtained by a third party through a phishing email impersonating the operator of the e-commerce platform. In addition, two-factor authentication had not been enabled, meaning that login was possible using only an email address and password, and the password was not sufficiently strong. |
| Impact on Earnings Forecast | The impact of this matter on the consolidated results of the Company's group is currently under review. If it is determined that the matter will have a material impact on results, or if any other matter requiring disclosure arises, the Company will make an announcement promptly. |
| Type of litigation or proceeding | Report to the Personal Information Protection Commission |
| Court or authority | Personal Information Protection Commission |
| Date of filing / date of action | 27 August 2026 (date of the report to the Personal Information Protection Commission) |
| Investigation structure | Internal investigation and an investigation requested from the operator of the e-commerce platform |
| Measures to prevent recurrence | Two-factor authentication will be made mandatory for all staff accounts, and the management of accounts and access rights will be reviewed. Measures against phishing emails will be strengthened, and information security education and anti-phishing training for employees will be thoroughly implemented. Access rights to customer information and bulk-export permissions will be reviewed, and the monitoring and escalation framework will be strengthened to enable the early detection of suspicious logins, changes to important account information, large-volume data exports and other activity. The settings for two-factor authentication, account and access-rights management, information-export permissions and security monitoring frameworks for the systems and cloud services used by the Company's group will be reviewed, and anti-phishing measures and information security education will be strengthened throughout the group. |
| Outlook | The customers concerned will be notified individually on a rolling basis regarding the details of this matter and relevant precautions. Preparations are under way to establish a dedicated inquiry desk, and details will be announced on the websites of the Company and 株式会社カインドオル once the arrangements are in place. The Company will also confirm all other staff accounts, request an additional investigation by the operator of the e-commerce platform, review account and access-rights management, and implement measures to prevent recurrence. |
| Planned follow-up disclosure | If it is determined that the matter will have a material impact on results, or if any other matter requiring disclosure arises, the Company will make an announcement promptly. Details of the inquiry desk will also be announced on the website once the arrangements are in place. |
Items this document does not state (11)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.The Company believes that an employee entered the staff account credentials on a link in a phishing email, enabling the credentials to be obtained by a third party. The Company also cites deficiencies in authentication management, including the fact that two-factor authentication had not been enabled and the password was not sufficiently strong.