> JapanHacked_
[Contained][Severity: Major][Web app exploit]

ELESTYLE: unauthorized access to the elepay and OneQR admin system may expose 7,162 merchant registrations

ELESTYLE's admin system for its payment services elepay and OneQR was accessed without authorization, and 7,162 merchant registration records may have been obtained.

Disclosed

2026-10-29

Organizations involved

1

Leaked or at risk

7.2K

7,162

Downtime

Unknown

What happened

An access control flaw in part of the admin system was exploited. [1]

  1. Unauthorized access ran from about 09:30 to 16:00; outside access was blocked the same day. [1]

  2. The flaw was fixed. [1]

  3. The company disclosed the incident and reported it to the Personal Information Protection Commission. [1]

Impact

  • User names, emails, internal system IDs and more in 7,162 merchant registration records [1]
  • Passwords, payment data and end-user data are not included. [1]
  • The admin screens, order taking and payment processing worked normally throughout. [1]

What users should do

Watch out for suspicious emails posing as ELESTYLE. [1]

Timeline

  1. Started, Detected 2026-10-25
  2. Disclosed 2026-10-29
  3. 4 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][E-mail address]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][Official]当社システムへの不正アクセスに関するご報告ELESTYLE · 2026-10-29