> JapanHacked_
[Resolved][Severity: Major][API abuse]

nimoca: unauthorized access to the usage history service

From about midnight on 4 October, the usage history service for the nimoca transit IC card was accessed by a third party. It came to light when a user reported an unexpected email: the service's automatic emails had been triggered, sending messages with part of the registered details to registered addresses. 521 records leaked, with card numbers, birth dates and emails. The service was stopped at 17:40 that day and reopened on 15 October after measures against automated access and program fixes.

Disclosed

2026-10-04

Organizations involved

1

Leaked or at risk

521

521

Downtime

Unknown

Timeline

  1. Started, Detected, Disclosed 2026-10-04
  2. Resolved 2026-10-15
  3. 11 days

Attack or cause

Method
[API abuse]
Impact
[Data leak][Service outage]
Entry point
Web app

Data exposed or at risk

[Date of birth][E-mail address]

Organizations involved

Open in organization search

Sources

  1. [1][Official]nimoca 利用履歴照会サービスへの第三者からの不正アクセス(公開 WEB サービスへの攻撃)による情報漏えいnimoca · 2026-10-06
  2. [2][Official]利用履歴照会サービス再開のお知らせnimoca · 2026-10-15