[Contained][Severity: Critical][Credential abuse]

Fancrew: credential stuffing attack on the mystery shopper service

On 24 August, Fancrew said its mystery shopper service Fancrew was hit by unauthorized logins that appear to be a credential stuffing attack. From 22:00 on 20 August to 13:00 on 24 August there were 5,060,270 login attempts, and 59,389 member accounts were logged in to, so member data on their My Page may have been viewed. Points were fraudulently exchanged in 2 accounts. It suspended the service and resumed it at noon on 25 August.

Disclosed

2026-08-24

Organizations involved

Leaked or at risk

59.4K

59,389

Downtime

Unknown

Timeline

Started 2026-08-20
Disclosed 2026-08-24
4 days

Attack or cause

Method: [Credential abuse]
Impact: [Data leak][Fraud][Service outage]
Entry point: Stolen credentials

Data exposed or at risk

–

Services hit

[Breached][Critical]
Fancrew

Service	Role	Impact level	Note
Fancrew	[Breached]	[Critical]

Organizations involved

[Breached][Critical]Tokyo, ChiyodaScientific research, professional and technical services59,389 leaked
Fancrew Inc.

						Note
Fancrew Inc.	[Breached]	[Critical]	Tokyo, Chiyoda	Scientific research, professional and technical services	59,389

Open in organization search

Sources

[1][Official]【重要】不正ログインに関する調査結果、サービス再開および今後の対応について（第二報）Fancrew · 2026-08-25
[2][Official]【重要】不正ログインに関するご報告（最終報）Fancrew