Bank of The Ryukyus disclosed unauthorized access to repica, a distribution service operated by an external contractor, and revealed that 96,477 customer email addresses had been leaked externally. The affected period was 8 to 29 October 2026, and no intrusion into the bank's own systems has been confirmed.
On 4 November 2026, Bank of The Ryukyus issued a second report and announced that unauthorized access to Arara Inc.'s repica external distribution service had resulted in the leakage of a total of 96,477 email addresses from emails distributed by the bank. The affected email distribution period was 8 to 29 October 2026. The leakage was attributed to a breach of Arara's environment, and no direct intrusion into the bank's own systems has been identified. The bank said that no leakage of sensitive information such as names, addresses, account information or PINs has been confirmed.
The first report said that the number of leaked records and the contracted service had not yet been identified, but the second report confirmed both the number and the service name. The bank disclosed that 96,477 records were affected and said that the leakage related only to email distributions during that period and did not indicate any other unauthorized access. The bank plans to notify affected individuals separately after identifying them, and has suspended use of the distribution service.
The bank said that no leakage of customers' account information or PINs has been confirmed. It also pointed to the risk of phishing and fraudulent notifications exploiting the leaked email addresses and urged customers to verify information through official channels. The bank intends to take a cautious approach in deciding when to suspend and resume the distribution service.