Apology and Notice Regarding the Leakage of Personal Information Due to Unauthorized Access (Report 3)
BOOKOFF GROUP HOLDINGS LIMITED's consolidated subsidiary, ブックオフコーポレーション株式会社
BOOKOFF member management system; affected services: BOOKOFF SUPER BAZAAR, BOOKOFF PLUS, BOOKOFF, BOOKOFF official online store, あそビバ, BOOKOFF FASHION, BINGO, B・SPORTS, B・STYLE, and Rehello by BOOKOFF (stores)
The exploitation by a third party of an access-control vulnerability in certain functions of a system handling member information
No amount has been disclosed. The costs of the investigation, contacting customers, operating the inquiry desk and strengthening security measures are expected to be recorded from the second quarter of the fiscal year ending May 2027 onward.
From the second quarter of the fiscal year ending May 2027 onward
There is no change to the consolidated earnings forecast for the fiscal year ending May 2027 announced on 13 July 2026.
Related procedures
Reporting to the Personal Information Protection Commission and cooperation with the police investigation
Personal Information Protection Commission and police
Company response
An investigation into the cause was conducted with the assistance of external experts. The company is strengthening its verification framework, including third-party assessments.
Blocking the route used for unauthorized access and strengthening access controls / strengthening security measures for the affected system / strengthening monitoring for unauthorized access / confirming security by drawing on the expertise of external specialists / strengthening security inspections of the group's systems / reviewing the incident detection and response framework / strengthening continuous monitoring and detection capabilities / strengthening security management in system development and operations / strengthening security governance across the group
The company will continue additional investigations and monitoring, and work to address affected members, restore trust, review its security framework and prevent recurrence. A final report is scheduled to be submitted to the Personal Information Protection Commission in early December.
If any new facts requiring public disclosure are identified, the company will announce them promptly.
| Item | Details |
|---|---|
| Event name | Apology and Notice Regarding the Leakage of Personal Information Due to Unauthorized Access (Report 3) |
| Date of occurrence | Member information was obtained externally from 4 October through 6 October 2026, and the unauthorized access was confirmed on 6 October 2026. |
| Date recognized / date notice received | 6 October 2026 |
| Subject Entity | BOOKOFF GROUP HOLDINGS LIMITED's consolidated subsidiary, ブックオフコーポレーション株式会社 |
| Target Locations / Products | BOOKOFF member management system; affected services: BOOKOFF SUPER BAZAAR, BOOKOFF PLUS, BOOKOFF, BOOKOFF official online store, あそビバ, BOOKOFF FASHION, BINGO, B・SPORTS, B・STYLE, and Rehello by BOOKOFF (stores) |
| Cause | The exploitation by a third party of an access-control vulnerability in certain functions of a system handling member information |
| Amount of Impact on Business Performance | No amount has been disclosed. The costs of the investigation, contacting customers, operating the inquiry desk and strengthening security measures are expected to be recorded from the second quarter of the fiscal year ending May 2027 onward. |
| Accounting period in which recognized | From the second quarter of the fiscal year ending May 2027 onward |
| Impact on Earnings Forecast | There is no change to the consolidated earnings forecast for the fiscal year ending May 2027 announced on 13 July 2026. |
| Type of litigation or proceeding | Reporting to the Personal Information Protection Commission and cooperation with the police investigation |
| Court or authority | Personal Information Protection Commission and police |
| Investigation structure | An investigation into the cause was conducted with the assistance of external experts. The company is strengthening its verification framework, including third-party assessments. |
| Measures to prevent recurrence | Blocking the route used for unauthorized access and strengthening access controls / strengthening security measures for the affected system / strengthening monitoring for unauthorized access / confirming security by drawing on the expertise of external specialists / strengthening security inspections of the group's systems / reviewing the incident detection and response framework / strengthening continuous monitoring and detection capabilities / strengthening security management in system development and operations / strengthening security governance across the group |
| Outlook | The company will continue additional investigations and monitoring, and work to address affected members, restore trust, review its security framework and prevent recurrence. A final report is scheduled to be submitted to the Personal Information Protection Commission in early December. |
| Planned follow-up disclosure | If any new facts requiring public disclosure are identified, the company will announce them promptly. |
Items this document does not state (10)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.A third party exploited an access-control vulnerability in certain functions of a system handling member information.