hokan: attackers abused account sign-up for the hokan Suito service for insurance agencies and took policy data of two agencies' customers

1. 2026-09-24

   From 7:24 p.m. until late at night there was unauthorized access from overseas IP addresses. Accounts were created through the sign-up function of the identity platform the service uses for logins, and reached data of organizations they had no rights to. An alert at 7:26 p.m. started the investigation. [1] [2]

2. 2026-09-25

   By 0:01 a.m. the attacking IP addresses were blocked, sign-up was stopped and the fake accounts were disabled and deleted. No leak had been found at this point. [2]

3. 2026-10-14

   A wider review of the access records confirmed at about 10:28 p.m. that data had been taken. Hoken no Takumi was told the next day. [1] [2]

4. 2026-10-19

   hokan and Hoken no Takumi issued first reports. [1] [2]

Two customer companies are known to be affected; no leak was found at the others. There was no unauthorized access to its other services, such as hokan CRM and hokan People. [1]

• Hoken no Takumi's life insurance commission statements: names (with readings), birth dates, policy numbers, start dates, premiums, commissions, product names and more for about 5,100 policyholders [2]
• Hoken no Takumi's non-life insurance settlement statements: policyholder names in kana, policy numbers, start dates, premiums, agency commissions, insurer names and more for about 13,300 policyholders [2]

No leak was found from the fields that hold card numbers, bank account numbers or medical history. [1] [2]

hokan continues its investigation with an outside firm. Hoken no Takumi will write to the affected customers. [1] [2]