Carry: attackers sat in the server of the Lili matching site for three months; passwords and ID images of about 98,000 members may have leaked

1. 2026-07-11

   From this day until 6 October a third party was inside the server, where it had placed a program to read members' passwords. [1]

2. 2026-10-06

   A suspicious program on the server was found. From about 3:30 a.m. to 1 p.m., PC visitors were shown a fake Cloudflare check page that asked them to paste and run a command. [1]

3. 2026-10-11

   At about 11:45 p.m. the attacker got in again by another route. By about 3:20 a.m. on 12 October the route was closed and the program removed. The fake page also appeared that night from about 11:50 p.m. to 2 a.m. [1]

4. 2026-10-14

   First report; all member passwords were invalidated. [1]

5. 2026-10-22

   The second report corrected the first: small preview copies of older ID images had been left on the server, so more people are affected. [2]

• Up to about 98,256 members (about 71,456 current and 26,800 former): email addresses, passwords, profile data such as birth date and prefecture, site messages and login IP addresses [1]
• ID images submitted between 1 December 2025 and 12 October 2026: up to 7,261 people [1]
• Preview copies (about 320 by 240 pixels) of documents submitted since September 2020 and earlier: up to 32,916 more people. Some are too rough to read, but most show the document details. [2]
• Email addresses, passwords and profiles of up to about 10,223 people who did not finish sign-up, and names, email addresses, phone numbers and text of up to 1,364 contact form messages [1]

Passwords were stored encrypted, but a program to decrypt them had been planted, so they likely leaked in plain text. Card numbers are held by the payment company and are not affected. [1]

The planted programs and access tools were removed, the flaw used to get in was fixed and the admin tool used for the second entry taken out. Passwords are now stored in a form that cannot be reversed. Preview images are no longer made, and the old ones were removed from the server. It reported to the Personal Information Protection Commission and consulted the police. [1] [2]