Cynd: unauthorized access to the BeautyMerit booking system
Cynd detected suspicious access on 10 March to BeautyMerit, its cloud booking system for hair and beauty salons. Names, phone numbers, email addresses and other data of users may have leaked. The access path was cut off and the system kept running. No card data is stored. The April 27 follow-up found no traces of personal-data exfiltration or backdoors, but could not exclude exposure of information that was accessible. No secondary misuse had been confirmed.
Disclosed
2026-03-24
Organizations involved
1
Leaked or at risk
Unknown
Downtime
Unknown
Timeline
- Detected 2026-03-10
- Disclosed 2026-03-24
- 14 days
Attack or cause
- Method
- [Unknown]
- Impact
- [Data leak]
- Entry point
- Unknown
Data exposed or at risk
Services hit
Organizations involved
[Breached][Major]Tokyo, ShinagawaInformation and communications
Cynd Co., Ltd.
Sources
- [1][Official]サイバー攻撃による不正アクセスの検知と情報漏えいの可能性に関するお詫びとご報告 (第一報)Cynd · 2026-03-24
- [2][Official]サイバー攻撃による不正アクセスの検知と情報漏えいの可能性に関するお詫びとご報告(第二報)Cynd · 2026-04-27