GoWeb Cloud: SQL injection attack on the GoWeb real estate service
On 26 October, GoWeb Cloud, which provides the web service GoWeb to real estate firms, said it suffered unauthorized access through SQL injection on 15 October. Names, dates of birth, genders, addresses, phone numbers and email addresses of the user firms' customers may have leaked. Images of ID documents were not accessed, and the service holds no card data. The same day it reported to the Personal Information Protection Commission on behalf of its customers. Two user firms, Good Fudousan and Good Real Estate, each announced it on 20 October.
Disclosed
2026-10-20
Organizations involved
3
Leaked or at risk
Unknown
Downtime
Unknown
Timeline
- Detected 2026-10-15
- Disclosed 2026-10-20
- 5 days
Attack or cause
- Method
- [Web app exploit]
- Impact
- [Data leak]
- Entry point
- Web app
Data exposed or at risk
Supply chain
- Organizations listed on this site
- 3
Services hit
Organizations involved
[Through a supplier][Major]Fukuoka, Fukuoka, ChuoReal estate and rental
Good Fudousan Inc.Uses GoWeb; confirmed the unauthorized access on 17 October.
[Through a supplier][Major]Tokyo, MinatoReal estate and rental
Good Real Estate Inc.Uses GoWeb for tenant applications and other work; confirmed the unauthorized access on 16 October. It stores personal data of tenant applicants and user data of brokers; whether any leaked is under investigation.
[Breached][Major]Fukuoka, Fukuoka, ChuoInformation and communications
GoWeb Cloud Inc.
Sources
- [1][Official]弊社提供サービス「GoWeb」への不正アクセスに関するご報告とお詫びGoWeb Cloud · 2026-10-26
- [2][Official]当社が利用するクラウドサービスへの不正アクセスに関するお知らせとお詫びGood Fudousan · 2026-10-20
- [3][Official]当社が利用するクラウドサービスへの不正アクセスに関するお知らせとお詫びGood Real Estate · 2026-10-20