Yellow Hat: unauthorized access to the online service booking system
In August, car accessories retailer Yellow Hat detected unauthorized access to its online service booking system and cut its external connections. A malicious program was used, and member data on its member server leaked. Its second report on 15 October put the leak at 1,797,124 members after log analysis: names, addresses, birth dates, genders, phone numbers, emails, member numbers, login IDs and irreversibly stored passwords. No card data was included. The initial notice dates detection to August 18, while the second says August 19; the notices conflict. The original maximum of 1,801,499 was refined to 1,797,124 confirmed people.
Disclosed
2026-08-28
Organizations involved
1
Leaked or at risk
1.8M
1,801,499
Downtime
Unknown
Timeline
- Disclosed 2026-08-28
- 1 days
Attack or cause
- Method
- [Web app exploit]
- Impact
- [Data leak][Service outage]
- Entry point
- Web app
Data exposed or at risk
Services hit
Organizations involved
[Breached][Critical]Tokyo, OtaWholesale and retail trade1,797,124 leaked
Yellow Hat Ltd.
Sources
- [1][Official]イエローハットにおける不正アクセスによる個人情報漏えいに関する お詫びとお知らせ【第二報】Yellow Hat · 2026-10-15
- [2][Official]イエローハットにおける不正アクセスによる個人情報漏えいの可能性に関するお詫びとお知らせYellow Hat · 2026-08-28