> JapanHacked_
[Resolved][Severity: Major][Misconfiguration]

The Pokémon Company: a defect at the Pokémon Center Online relaunch may have mixed up the information of 326 members

A defect right after the relaunch registered new members' email addresses under other members, and names and delivery addresses may also have leaked.

Disclosed

2025-03-04

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. The site reopened after its renewal at 10:00 on February 28. Until 10:36, when several people registered as new members at the same time, a registration could be made with an email address that was not the person's own. [1] [2]

  2. It started emergency maintenance and suspended the site. [1]

  3. It announced the incident. It said 326 cases were affected and that it had sent individual apology emails. [1] [2]

Impact

The data that may have leaked is the email addresses of people who registered in the period, and the member names and delivery names and addresses of those who registered or ordered. [1]

Timeline

  1. Started, Detected 2025-02-28
  2. Disclosed 2025-03-04
  3. 4 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak][Service outage]
Entry point
Unknown

Data exposed or at risk

[E-mail address][Name][Postal address]

Organizations involved

Open in organization search

Sources

  1. [1][News]ポケモンセンターオンラインで個人情報漏えいか　リニューアル時に不具合　対象は300件超ITmedia NEWS · 2025-03-04
  2. [2][News]メールアドレスが他の会員に登録される事象 ～「ポケモンセンターオンライン」障害ScanNetSecurity · 2025-03-07 08:05