> JapanHacked_
[Investigating][Severity: Critical][Web app exploit]

NEXT STAGE: a fake account in the Metabase BI tool it uses internally could search the database of its building inspection services; up to about 40,000 records at risk

A fake account in a BI tool used by NEXT STAGE, a building inspection firm, could search its service database. Up to about 40,000 records of clients and inspectors are at risk.

Disclosed

2026-10-13

Organizations involved

1

Leaked or at risk

40K

40,000

Downtime

Unknown

What happened

  1. From this day until 9 October, a third party misused an account in the Metabase BI tool and could search the service database. A risk from a flaw in the tool had already been made public. [1]

  2. The misuse was found; the account was stopped and database access restricted. [1]

  3. Disclosed. [1]

Impact

Names, phone numbers and email addresses of clients and certified site inspectors of Qualiz (including the former GenKan-NS and TeiKan-NS) and ACRO5, up to about 40,000 records. For the former GenKan-NS and TeiKan-NS, login credentials are included; for inspectors, also addresses, birth dates, qualifications and blood types. [1]

The tool could only search, so nothing was altered or deleted. Card, bank account and ID document data are not included. [1]

Response

Reported to the Personal Information Protection Commission. The flaw will be fixed, monitoring stepped up and access rights reviewed. [1]

Timeline

  1. Started 2026-09-22
  2. Detected 2026-10-09
  3. Disclosed 2026-10-13
  4. 21 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][Phone number][E-mail address][Passwords][Postal address][Date of birth][Education]

Organizations involved

Open in organization search

Sources

  1. [1][Official]サイバー攻撃による不正アクセス及び情報漏えい等に関するお知らせとお詫びNEXT STAGE · 2026-10-13