Nippon Gas: unauthorized access to the My Nichigas sign-up system
On October 20, Nippon Gas (Nichigas) found unauthorized access by a third party to the sign-up system of its My Nichigas app and web service. A series of accesses viewed and took data on 85 customers: 81 names with partly masked phone numbers and 4 surnames with partly masked phone numbers. Cards, bank accounts and passwords were not included. The company blocked traffic from overseas IP addresses, fixed the API, reported to the Personal Information Protection Commission and consulted the police.
Disclosed
2026-10-23
Organizations involved
1
Leaked or at risk
85
85
Downtime
Unknown
Timeline
- Started, Detected 2026-10-20
- Disclosed 2026-10-23
- 3 days
Attack or cause
- Method
- [API abuse]
- Impact
- [Data leak]
- Entry point
- API
Data exposed or at risk
Services hit
Organizations involved
[Breached][Major]Tokyo, ShibuyaElectricity, gas, heat and water85 leaked
Nippon Gas Co., Ltd.
Sources
- [1][Official]当社システムへの不正アクセスによるお客さま情報の漏えいに関するお詫びとご報告Nippon Gas · 2026-10-23