> JapanHacked_
[Contained][Severity: Critical][Web app exploit]

Starts Publishing: unauthorized access to the OZmall booking site

On 26 September, Starts Publishing detected a large volume of unauthorized access from abroad to OZmall, its restaurant and hotel booking site, took the affected pages offline and fixed the cause. The investigation found member data may have been viewed; the second report on 1 October put the number at up to 442,779 members and some former members. Email addresses, and for some people names and prefectures, are affected. No sign was found of phone numbers or full addresses being viewed, and card data is handled by an outside payment system. The initial maximum of 447,610 was refined to 442,779.

Disclosed

2026-09-27

Organizations involved

1

Leaked or at risk

447.6K

447,610

Downtime

Unknown

Timeline

  1. Detected 2026-09-26
  2. Disclosed 2026-09-27
  3. 1 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[E-mail address][Name][Postal address]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]「オズモール」に海外から不正アクセス 45万人分のメアド流出の可能性ITmedia NEWS · 2026-09-28
  2. [2][Official]当社への不正アクセスによる個人情報流出の可能性に関するお知らせ(第2報)Starts Publishing · 2026-10-01
  3. [3][News]「OZmall」に不正アクセス、最大44万人の個人情報が閲覧された可能性 退会者も対象にASCII.jp · 2026-10-02