nimoca: unauthorized access to the usage history service
From about midnight on 4 October, the usage history service for the nimoca transit IC card was accessed by a third party. It came to light when a user reported an unexpected email: the service's automatic emails had been triggered, sending messages with part of the registered details to registered addresses. 521 records leaked, with card numbers, birth dates and emails. The service was stopped at 17:40 that day and reopened on 15 October after measures against automated access and program fixes.
Disclosed
2026-10-04
Organizations involved
1
Leaked or at risk
521
521
Downtime
Unknown
Timeline
- Started, Detected, Disclosed 2026-10-04
- Resolved 2026-10-15
- 11 days
Attack or cause
- Method
- [API abuse]
- Impact
- [Data leak][Service outage]
- Entry point
- Web app
Data exposed or at risk
Organizations involved
[Breached][Major]Fukuoka, Fukuoka, HakataTransport and postal services521 leaked
nimoca Inc.
Sources
- [1][Official]nimoca 利用履歴照会サービスへの第三者からの不正アクセス(公開 WEB サービスへの攻撃)による情報漏えいnimoca · 2026-10-06
- [2][Official]利用履歴照会サービス再開のお知らせnimoca · 2026-10-15