Tokiwa and Tokiwa Industry: ransomware may have exposed data of about 421,000 members, and credit card payments were suspended for three months

1. 2025-03-30

   A system failure occurred, and an investigation found that several servers of the group had been encrypted by ransomware. [2] [4]

2. 2025-03-31

   Tokiwa Industry announced the incident. Stores would open normally from April 1 except for some payment services; credit card payments, RUCCHA top-up balances and payments with Tokipo points were suspended. [1] [6]

3. 2025-04-02

   Tokiwa also announced the incident. Stores were open, but the automatic parking fee machines and new card enrollment and reissuing were suspended. At that point it saw no damage to customer information. [2]

4. 2025-06-26

   Credit card payments, RUCCHA top-up balances, and use and granting of Tokipo points resumed at all stores. [3]

5. 2025-07-23

   It announced that an investigation by outside experts found it could not rule out that some personal data and supplier information had been viewed. [4]

6. 2025-09-19

   It resumed granting and use of points after new enrollment and reissuing of cards, which had been suspended. [5]

Names, addresses, phone numbers, email addresses, genders, birth dates, member numbers and purchase history from April 2022 to March 2025 of 421,355 members of RUCCHA, Futabakai, Tokiwa Card and others may have been viewed. For 127,263 of them, holders of the Tokiwa Card and Tokiwa Customer Card, credit card numbers, holder names and expiry dates were also included. Also covered were 3,892 reservation customers, 218 credit-sale customers, supplier information (4,559 entries), 8,545 employees enrolled since December 2005, including salary account and social insurance data, and 6,722 dependents. It said no misuse had been confirmed. [4]