Yamamoto Paper Packaging: the payment application of "Package Shop.jp" was tampered with, and data on 3,973 customers, including 1,395 card records, may have leaked

1. 2025-09-05

   Some credit card companies warned that card data of customers who used the site might have leaked. The same day it stopped card payments and began a third-party investigation. [3] [4]

2. 2025-09-17

   It announced that the site had been compromised and personal data might have leaked. The investigation was completed by the same day. [1] [2] [4]

3. 2026-01-28

   It published the findings: tampering with the payment application may have leaked data of customers who paid by card from June 4, 2021 to January 17, 2025. [3] [4]

The email addresses, passwords and phone numbers of 3,973 customers who paid by card in the period may have leaked. Of them, 1,395 also had card numbers, holder names, expiry dates and security codes exposed, and some cards may have been misused. The cause was unauthorized access through a flaw in the site. Explaining the delay of about four and a half months before the full announcement, the company said publishing unconfirmed information would cause confusion, so it waited for the investigation results and coordination with card companies. [3] [4]