> JapanHacked_
[Contained][Severity: Major][Web app exploit]

JGC Digital: a flaw in the BI tool Metabase was exploited and data of about 60,000 accounts of its construction-site service Azas and clothing-collection service Suloop was taken

An exploited Metabase flaw let an attacker take data of about 60,000 accounts of JGC Digital's construction-site service Azas and clothing-collection service Suloop.

Disclosed

2026-09-18

Organizations involved

1

Leaked or at risk

60K

60,000

Downtime

Unknown

What happened

  1. It detected an anomaly, investigated, and confirmed unauthorized access exploiting a Metabase vulnerability and the taking of customer data. It cut the access route the same day. [1]

  2. It announced the unauthorized access; parent JGC Holdings announced it the same day. [1] [2] [3]

Impact

The data covers about 40,000 accounts of the construction-site service Azas and about 20,000 accounts of the clothing-collection service Suloop, about 60,000 in total. Some people hold several accounts, so the number of people is expected to be smaller. [1]

For Azas: names, birth dates, sex, email addresses, years of service, affiliation, main or first-tier contractor, project name and period, and body temperature records. For Suloop: email addresses, birth year and month, sex, postal codes, whether the user has children, and occupation. Neither service manages passwords, so none leaked. [1]

As prevention it said it would stop using Metabase and tighten its usage policy. [1]

Timeline

  1. Detected 2026-09-16
  2. Disclosed 2026-09-18
  3. 2 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][Date of birth][Gender][E-mail address][Employment][Health data][Postal address]

Organizations involved

  • [Breached][Major]Kanagawa, Yokohama, Nishi WardInformation and communications60,000 leaked

    JGC Digital Corporation

    A JGC Holdings subsidiary. An attacker exploited a vulnerability in Metabase, which it used for data analysis, and took user data of two services.

Open in organization search

Sources

  1. [1][Official]不正アクセスによる個人情漏えいに関するお知らせとお詫びJGC Digital Corporation · 2026-09-18
  2. [2][Official]当社子会社における個人情報流出に関するお知らせJGC Holdings Corporation · 2026-09-18
  3. [3][News]JGC Digital が利用する BI ツール「Metabase」に不正アクセス、約 6 万件の情報が取得されたことを確認ScanNetSecurity · 2026-10-09 08:05