Japan Arts: phishing took over an employee's Google account; 5,376 contacts were taken and spoofed emails sent

1. 2026-10-13

   At about 10:25 a.m., an employee followed a link in an email posing as an acquaintance, entered the password and approved the device sign-in. At about 4:08 p.m. the attacker downloaded the account's contacts. [1]

2. 2026-10-14

   At about 7:07 a.m. the company noticed emails posing as the employee going out. At 6:55 p.m. the password was reset and access was cut off. [1]

3. 2026-10-16

   Reported to the Personal Information Protection Commission and disclosed. [1]

Names and email addresses of 5,376 contacts saved in the account or emailed in the past. Card and financial data were not in this system, and no leak of ticket site member data was found. [1]

The company is moving to stronger sign-in such as passkeys with a physical factor, training all staff on phishing and stepping up account monitoring. [1]