Leakage of Personal Information Due to Unauthorized Access at a Consolidated Subsidiary
株式会社２りんかんイエローハット
2 Rinkan mobile app, customer web server, and 2 Rinkan membership system
As a result of the attacker stealing information from the 2 Rinkan mobile app, an API that could retrieve personal information without using the app was called
Company response
Restrictions on use of the 2 Rinkan app
Around October 2026
Forensic investigation by an independent investigation firm
(1) Strengthen security for the 2 Rinkan app; (2) change and review the APIs; and (3) strengthen monitoring for unauthorized access and the blocking function when anomalies are detected
Related procedures
Final report to the Personal Information Protection Commission, notification of damage to the jurisdictional police, and cooperation with the investigation
Personal Information Protection Commission and jurisdictional police
The costs of the responses and measures described above are not expected to have a material impact on the company's consolidated results
The company will review its security framework and rebuild the system, with a view to resuming the app around October 2026. It will continue coordinating with the Personal Information Protection Commission, notifying the jurisdictional police of the damage, and cooperating with the investigation
Information regarding the resumption of the app will be posted on the 2 Rinkan website
| Item | Details |
|---|---|
| Event name | Leakage of Personal Information Due to Unauthorized Access at a Consolidated Subsidiary |
| Date of occurrence | API calls were made from 4:54 on 20 April 2026, and customer data was obtained |
| Date recognized / date notice received | Unauthorized access was detected on 20 April 2026 |
| Subject Entity | 株式会社２りんかんイエローハット |
| Target Locations / Products | 2 Rinkan mobile app, customer web server, and 2 Rinkan membership system |
| Cause | As a result of the attacker stealing information from the 2 Rinkan mobile app, an API that could retrieve personal information without using the app was called |
| Impact on Earnings Forecast | The costs of the responses and measures described above are not expected to have a material impact on the company's consolidated results |
| Type of litigation or proceeding | Final report to the Personal Information Protection Commission, notification of damage to the jurisdictional police, and cooperation with the investigation |
| Court or authority | Personal Information Protection Commission and jurisdictional police |
| Suspended operations | Restrictions on use of the 2 Rinkan app |
| Scheduled resumption date | Around October 2026 |
| Investigation structure | Forensic investigation by an independent investigation firm |
| Measures to prevent recurrence | (1) Strengthen security for the 2 Rinkan app; (2) change and review the APIs; and (3) strengthen monitoring for unauthorized access and the blocking function when anomalies are detected |
| Outlook | The company will review its security framework and rebuild the system, with a view to resuming the app around October 2026. It will continue coordinating with the Personal Information Protection Commission, notifying the jurisdictional police of the damage, and cooperating with the investigation |
| Planned follow-up disclosure | Information regarding the resumption of the app will be posted on the 2 Rinkan website |
Items this document does not state (10)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.As a result of the attacker stealing information from the 2 Rinkan mobile app, an API that could retrieve personal information without using the app was called, and customer data was obtained from the customer web server.