Unauthorized logins by third parties occurred across 4 Speee Group services, and it was disclosed that personal information in a cumulative total of 3,822 records may have been viewed or obtained across the 4 services, Ieul, Sumai Step, Housii and Nurikae.
Speee and its group company ReFact announced that unauthorized logins had occurred on 22 October 2026. The affected services were Ieul, Sumai Step, Housii and Nurikae, and users' names, contact details and property locations, among other information, may have been viewed or obtained.
The unauthorized logins occurred from 3 to 16 October, and cases were confirmed in which the administration interface for partner companies was accessed via overseas servers. At ReFact's Nurikae, an unauthorized login was confirmed involving 1 administration interface for a remodeling company. The two companies said they had detected and addressed the issue.