Unauthorized access to Orix Life's service provider, スカラコミュニケーションズ, has been disclosed, and approximately 26,500 customer records may have been exposed. In addition to names and contact details, the records may include inquiry details containing medical information.
On 8 October 2026, Orix Life announced that customer information may have been exposed after its outsourced service provider, スカラコミュニケーションズ, suffered unauthorized access. No unauthorized access to Orix Life's own systems has been identified at this time.
The information potentially exposed is reported to cover approximately 26,500 records and may include names, dates of birth, addresses, telephone numbers, email addresses, securities account numbers and inquiry details. The inquiry details may also include medical information. In some cases, multiple inquiries from the same customer are included.
The incident was caused by unauthorized access to the "i-ask" FAQ system provided by スカラコミュニケーションズ, which is investigating the cause and scope of the impact. Orix Life has stated that no unauthorized access to its own systems has been identified.
The affected customers will be contacted individually by letter or email. A contact center for inquiries about suspicious communications will be established, and guidance on consulting the police will also be provided. Verification of controls over outsourced service providers is also under way, including reviews of information storage locations, access permissions, log management and measures to prevent recurrence.