> JapanHacked_
[Resolved][Severity: Major][Credential abuse]

The Pokémon Company: credential stuffing on Pokémon Center Online, with all member passwords reset and accounts suspected of tampering suspended

Unauthorized logins used IDs and passwords leaked elsewhere, and all member passwords were reset. Accounts suspected of having their details rewritten were suspended.

Disclosed

2025-07-03

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. It announced that it had confirmed unauthorized logins using IDs and passwords that appeared to come from other services. It ran emergency maintenance, reset the passwords of all member accounts and suspended accounts suspected of having their details rewritten after the login. [1] [3]

  2. It introduced two-factor authentication at login. [2]

  3. It gave a new notice that some accounts had their passwords reset by a third party and were then logged into and had their details changed. It suspended accounts that might have been logged into and contacted them individually. [2]

Impact

The information that may have leaked is email address, name, address, phone number, date of birth and registered delivery details. Card data is not held, so none leaked. No count was published. [1] [2]

Timeline

  1. Detected, Disclosed 2025-07-03
  2. 1 days

Attack or cause

Method
[Credential abuse]
Impact
[Data leak][Fraud]
Entry point
Stolen credentials

Data exposed or at risk

[E-mail address][Name][Postal address][Phone number][Date of birth]

Organizations involved

Open in organization search

Sources

  1. [1][Official]「会員アカウント」に対する不正ログインの発生のご報告とポケモンセンターオンラインを安全にご利用いただくためのお願いThe Pokémon Company · 2025-07-03
  2. [2][Official]ポケモンセンターオンラインをご利用のお客様へ：不正ログインに関する重要なお知らせとお願いThe Pokémon Company · 2025-09-19
  3. [3][News]パスワードリスト型攻撃、翌月に 2 段階認証導入 ～ ポケモンセンターオンラインScanNetSecurity · 2025-07-14 08:05