hi-ho: impersonation logins to My Page
On 8 October, internet provider hi-ho said a third party logged in to the My Page of services such as Hikari Giga and BiZiMo Hikari while posing as customers and viewed, or may have viewed, their data. Callers trying to switch customers to another provider got the login details from customers over the phone. There were 38,509 unauthorized logins counted per contract, and names, addresses, phone numbers, emails, contract and billing details may have been viewed. The login method using phone number, postcode and birth date was abolished.
Disclosed
2026-10-08
Organizations involved
1
Leaked or at risk
38.5K
38,509
Downtime
Unknown
Timeline
- Disclosed 2026-10-08
- 1 days
Attack or cause
- Method
- [Phishing][Credential abuse]
- Impact
- [Data leak]
- Entry point
- Stolen credentials
Data exposed or at risk
Services hit
Organizations involved
[Breached][Major]Tokyo, ToshimaInformation and communications38,509 leaked
hi-ho Inc.
Sources
- [1][Official]【重要なお知らせ】お客様情報への第三者によるアクセスが確認された事案に関するご報告hi-ho · 2026-10-08