> JapanHacked_
[Contained][Severity: Major][Credential abuse]

eplus: festival app admin screen intrusion

eplus said a brute-force attack broke into the admin screen of a festival app it ran and leaked names, phone numbers and email addresses in 3,571 records.

Disclosed

2026-10-30

Organizations involved

1

Leaked or at risk

3.6K

3,571

Downtime

Unknown

What happened

  1. The admin screen of the management system behind the festival app for Porno Chou Tokkyu 2021 was broken into by a password brute-force attack, and data was downloaded. [1]

  2. eplus confirmed that personal data in 3,571 records had leaked. [1]

  3. It published the incident. [1]

Impact

Names, phone numbers and email addresses in 3,571 records leaked. It is the second leak at eplus after the one it disclosed in September. [1]

Response

eplus deleted the data, restricted access and reported to the Personal Information Protection Commission. [1]

Timeline

  1. Started 2026-10-11
  2. Detected 2026-10-13
  3. Disclosed 2026-10-30
  4. 19 days

Attack or cause

Method
[Credential abuse]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][Phone number][E-mail address]

Organizations involved

Sources

  1. [1][Official]弊社システムに対する不正アクセスの発生および個人情報漏えいに関するお詫びとお知らせeplus · 2026-10-30 06:48