[Contained][Severity: Critical][Web app exploit]

Link Station: attackers exploited a flaw in the organizer service Gettii-Lite and took 317,971 member IDs and more from the GETTIIS ticket service

Member data of the GETTIIS ticket service was taken through a flaw in the organizer service, including names, phone numbers and hashed passwords.

Disclosed

2026-10-19

Organizations involved

Leaked or at risk

318K

317,971

Downtime

Unknown

What happened

2026-10-18
Between about midnight and 7 a.m., a third party exploited a flaw in the Gettii-Lite program and took GETTIIS member data. The company noticed the suspicious access the same day and began to investigate. [2]
2026-10-19
First report. [1]
2026-10-20
The second report gave the count for each data item. [2]

Impact

Item	Records
Member ID	317,971
Hashed password	311,451
Email address	311,426
Name	309,759
Phone number	309,668
Card-related data	29,515
Gender	5,900
Birth date	5,192
Postal code	489

[2]

The counts are per item, not a total of people. The card-related data is an encrypted record of the first and last four digits, the cardholder name and the expiry date. Full card numbers and security codes were not stored, so the data alone cannot be used to pay. [2]

Gettii and Gettii-EC run on separate systems, and no effect on them has been found. [2]

Response

The company switched the affected server and fixed the flaw. It asked members to change their password, and to change it on other services that use the same one. [2] [3]

Timeline

Started, Detected 2026-10-18
Disclosed 2026-10-19
1 days

Attack or cause

Method: [Web app exploit]
Impact: [Data leak]
Entry point: Web app

Data exposed or at risk

[Name][Phone number][E-mail address][Gender][Date of birth][Passwords]

Services hit

[Breached][Critical]
GETTIIS

Service	Role	Impact level	Note
GETTIIS	[Breached]	[Critical]

Organizations involved

[Breached][Critical]Aomori, AomoriInformation and communications317,971 leaked
Link Station Co., Ltd.
Runs the GETTIIS ticket service and Gettii-Lite, where organizers register their shows.

						Note
Link Station Co., Ltd.	[Breached]	[Critical]	Aomori, Aomori	Information and communications	317,971	Runs the GETTIIS ticket service and Gettii-Lite, where organizers register their shows.

Open in organization search

Sources

[1][Official]不正アクセスによるGETTIIS会員情報の漏えいに関するお詫びとお知らせ（第一報）Link Station · 2026-10-19
[2][Official]不正アクセスによるGETTIIS会員情報の漏えいに関するお詫びとお知らせ（第二報）Link Station · 2026-10-20
[3][News]チケット販売サービス「GETTIIS」でクレジットカード関連情報含む会員情報の約31万件が漏えい不正アクセスを受け発表Aomori Broadcasting · 2026-10-22