> JapanHacked_
[Investigating][Severity: Critical][Intrusion]

Free Standard: SHIPS CYCLE MARKET investigates possible fake-checkout redirects after its app supplier was breached

A compromised wishlist app could redirect shoppers to a fake checkout and expose entered card details. The store is checking its own impact; stored customer data was not leaked.

Disclosed

2026-10-22

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

SHIPS CYCLE MARKET reports a compromise of Swym Wishlist Plus, used for its wishlist. Between 19:6 on 14 October and 1:32 on 15 October, shoppers could be redirected to a fake checkout that collected entered card details. The shop is investigating its own impact and says customer data stored by the shop was not taken. [1]

The shop disabled its wishlist feature. It confirms that a separate compromise on 19 October did not affect this shop; that event is excluded from this record. The store’s seller is Free Standard, a company registered in Japan. [1] [2]

Timeline

  1. Started 2026-10-14
  2. Disclosed 2026-10-22
  3. 8 days

Attack or cause

Method
[Intrusion]
Impact
[Data leak][Service outage]
Entry point
Supplier

Data exposed or at risk

[Payment card]

Supply chain

[Breached]

Organizations listed on this site
1

Services hit

Organizations involved

  • [Through a supplier][Critical]Tokyo, ShibuyaInformation and communications

    Free Standard Inc.

    The store’s seller and operator is investigating possible fake-checkout redirects and exposure of entered card details through its external app. It rules out exposure of customer data stored by the shop.

Sources

  1. [1][Official]【重要】外部アプリ「Swym Wishlist Plus」におけるセキュリティ事象についてのお知らせとお詫びSHIPS CYCLE MARKET · 2026-10-22
  2. [2][Official]特定商取引法に基づく表記SHIPS CYCLE MARKET