> JapanHacked_
[Resolved][Severity: Critical][Misconfiguration]

Toshiba Tec: a procedure document wrongly contained an administrator account, so one user company of its cloud system "ShopCraft" could view customer data of 382,123 people of other users

A procedure document for Toshiba Tec's "ShopCraft" held an admin account by mistake, letting one user company view data of 382,123 customers; no viewing was found.

Disclosed

2026-08-03

Organizations involved

1

Leaked or at risk

382.1K

382,123

Downtime

Unknown

What happened

  1. Administrator account details were wrongly written in a procedure document for one user company, and customer data of other users on the same server became viewable. [1]

  2. It found the problem, disabled the account and changed the password. [1]

  3. It announced the incident. The data was names, birth dates, sex, addresses, phone numbers and email addresses of 382,123 people. The user company said it did not view the data, and no viewing or misuse has been found. [1] [2]

Timeline

  1. Started 2026-03-26
  2. Detected 2026-06-23
  3. Disclosed 2026-08-03
  4. 130 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Name][Date of birth][Gender][Postal address][Phone number][E-mail address]

Organizations involved

  • [Breached][Critical]Tokyo, ShinagawaManufacturing382,123 leaked

    Toshiba Tec Corporation

    A procedure document for one user company wrongly held administrator account details, so customer data of other users on the same server could be viewed. It was not open to the public on the internet.

Open in organization search

Sources

  1. [1][Official]顧客情報への不適切なアクセスが可能な状態となっていたことに関するお知らせToshiba Tec Corporation · 2026-08-03
  2. [2][News]手順書に管理者権限を有するアカウント情報を誤記載 ～ 東芝テックの「ShopCraft」で他のユーザーの情報が閲覧可能にScanNetSecurity · 2026-08-24 08:05