Potential leakage of personal information from a consolidated subsidiary due to unauthorized access to an e-commerce platform operated by a third party
株式会社GALLERY・2 (a consolidated subsidiary of Xebio Holdings)
The e-commerce site and customer database of 株式会社GALLERY・2, which uses the Commerble e-commerce platform
The company has been informed that inadequate system access-control settings and other issues were exploited. The specific cause of the intrusion is still under investigation.
Company response
Suspension of 株式会社GALLERY・2's e-commerce site on 18 October 2026
A phased resumption will be considered after safety has been confirmed.
Investigations are being conducted by 株式会社Commerble and シグマコンサルティング株式会社. Going forward, the company will take into account the results of investigations by external specialist organizations and others.
Measures to prevent the damage from spreading, including suspending external access to administrative functions, changing authentication and connection information, correcting access controls, and reviewing permissions. The company will inspect its management and oversight framework for external cloud services and work to prevent recurrence.
Related procedures
Report to the Personal Information Protection Commission
Personal Information Protection Commission
The company expects the incident to have a minor impact on the consolidated results of the group. If it is found to have a material impact, the company will make an announcement promptly.
The company is preparing individual notifications and alerts for affected customers. A phased resumption of the e-commerce site will be considered after safety has been confirmed. The need for additional measures will also be assessed.
If it becomes clear that the incident will have a material impact on results or that there are other matters requiring disclosure, the company will make an announcement promptly.
| Item | Details |
|---|---|
| Event name | Potential leakage of personal information from a consolidated subsidiary due to unauthorized access to an e-commerce platform operated by a third party |
| Date of occurrence | The system administration credentials on the Commerble side were obtained fraudulently on 16 October 2026, unauthorized access to the customer database was confirmed on 17 October 2026, and tampering with the payment-entry screen on the e-commerce site was confirmed on 18 October 2026. |
| Subject Entity | 株式会社GALLERY・2 (a consolidated subsidiary of Xebio Holdings) |
| Target Locations / Products | The e-commerce site and customer database of 株式会社GALLERY・2, which uses the Commerble e-commerce platform |
| Cause | The company has been informed that inadequate system access-control settings and other issues were exploited. The specific cause of the intrusion is still under investigation. |
| Impact on Earnings Forecast | The company expects the incident to have a minor impact on the consolidated results of the group. If it is found to have a material impact, the company will make an announcement promptly. |
| Type of litigation or proceeding | Report to the Personal Information Protection Commission |
| Court or authority | Personal Information Protection Commission |
| Suspended operations | Suspension of 株式会社GALLERY・2's e-commerce site on 18 October 2026 |
| Scheduled resumption date | A phased resumption will be considered after safety has been confirmed. |
| Investigation structure | Investigations are being conducted by 株式会社Commerble and シグマコンサルティング株式会社. Going forward, the company will take into account the results of investigations by external specialist organizations and others. |
| Measures to prevent recurrence | Measures to prevent the damage from spreading, including suspending external access to administrative functions, changing authentication and connection information, correcting access controls, and reviewing permissions. The company will inspect its management and oversight framework for external cloud services and work to prevent recurrence. |
| Outlook | The company is preparing individual notifications and alerts for affected customers. A phased resumption of the e-commerce site will be considered after safety has been confirmed. The need for additional measures will also be assessed. |
| Planned follow-up disclosure | If it becomes clear that the incident will have a material impact on results or that there are other matters requiring disclosure, the company will make an announcement promptly. |
Items this document does not state (11)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.The e-commerce platform's system administration credentials were obtained fraudulently, and the customer database was accessed without authorization via the administrative cloud environment. The company has been informed that inadequate system access-control settings and other issues were exploited, but the specific cause of the intrusion and the scope of the information leakage are still under investigation.