[Contained][Severity: Critical][Web app exploit]

palan: intrusion through a data-analysis tool leaks data on up to 33,348 users, campaign participants and inquirers

A data-analysis tool flaw exposed up to 33,348 people’s data, including service users’ contacts and protected passwords, and local tourism campaign participants’ information.

Disclosed

2026-10-26

Organizations involved

Leaked or at risk

33.3K

33,348

Downtime

Unknown

What happened

2026-08-09
Unauthorized access began through a flaw in the Metabase data analysis tool palan Inc. uses internally; a rogue admin account was used to read its service database. [1] [5]
2026-10-16
No personal data was taken after this day, according to the logs. [1]
2026-10-22
It found the access, cut outside connections, disabled the rogue account and stopped the tool. [1]
2026-10-26
It disclosed the breach and reported it to the Personal Information Protection Commission. [1]
2026-10-27
Gifu, Miyazaki and other local governments whose events used palan began announcing their own participants' exposure. [2] [3] [4] [5] [6] [7]

Impact

Up to 33,348 people are affected, counting overlaps between groups. For 24,273 service users: names, email addresses, phone numbers, company names, plans, payment amounts and dates, and password hashes. For 7,225 participants in company and public campaigns: names, email addresses, age bands, gender, some municipalities and survey answers. For 1,850 people who made inquiries: names, contact details and inquiry contents. It holds no card or bank data. [1]

Prefectures and cities that commissioned the campaigns have announced their own shares. Gifu and Kumamoto prefectures say palan still held data that should have been deleted when the projects ended. [2] [7]

Client	Count	Details
Gifu Prefecture	1,135	Email addresses and survey answers of participants in its 2024 local food digital stamp rally; Gifu Shimbun had palan manage the data.
Miyazaki Prefecture	551	551 survey responses from its AR tourism guide Miyazaki Shinwa Sanpo: email addresses, gender, age band, area of residence and three other items.
Fuchu City (Tokyo)	179	Email addresses and encrypted passwords of 179 users of its AR walking tour of local karuta sites.
Ibaraki Prefectural Government	2,776	Email addresses of 2,776 participants in its Digital Satoyama Adventure AR photo rally, with age band, gender and other answers; the prefecture contracted through JTB, JR East Marketing & Communications and JNS before palan.
Kumamoto City	1,084	Email addresses, user names and other data of 1,084 users of its 2024 AR digital stamp rally, subcontracted by TOPPAN to palan.
Kumamoto Prefecture	478	Email addresses, age bands, gender and other data of all 478 participants in its 2024 Kumamon Tekuteku AR stamp rally; palan, subcontracted by JTB Publishing, had not deleted them after the contract ended.

[2] [3] [4] [5] [6] [7]

Response

palan is retiring the data-analysis tool, reviewing access and permissions to its internal systems and tightening its monitoring of software flaws. [1]

These tourism services can overlay characters or guidance on a smartphone camera view. Ibaraki’s notice identifies the contracting chain as JTB, JR East Marketing & Communications, JNS and palan, and says palan alone held and managed the affected data. [5] [1]

Timeline

Started 2026-08-09
Detected 2026-10-22
Disclosed 2026-10-26
78 days

Attack or cause

Method: [Web app exploit]
Impact: [Data leak]
Entry point: Web app

Data exposed or at risk

[Name][E-mail address][Phone number][Gender][Passwords][Purchase history]

Supply chain

Services hit

Service	Role	Impact level
Musashi Fuchu local karuta walking tour	[Through a supplier]	[Critical]
Digital Satoyama Adventure	[Through a supplier]	[Major]
Gifu local food digital stamp rally	[Through a supplier]	[Major]
Kumamon Tekuteku	[Through a supplier]	[Major]
Kumamoto Castle and central shopping district AR stamp rally	[Through a supplier]	[Major]
Miyazaki Shinwa Sanpo - Kikitabi tourism guide	[Through a supplier]	[Major]

Open in service search

Organizations involved

[Through a supplier][Critical]Tokyo, FuchuMunicipality179 leaked
Fuchu City (Tokyo)
Email addresses and encrypted passwords of 179 users of its AR walking tour of local karuta sites.
[Breached][Critical]Tokyo, ShinjukuInformation and communications33,348 leaked
palan Inc.
Its service database was read through a data-analysis tool: 24,273 service users, 7,225 campaign participants and 1,850 people who made inquiries, up to 33,348 in total including overlaps.
[Through a supplier][Major]GifuPrefecture1,135 leaked
Gifu Prefecture
Email addresses and survey answers of participants in its 2024 local food digital stamp rally; Gifu Shimbun had palan manage the data.
[Through a supplier][Major]Ibaraki, MitoPrefecture2,776 leaked
Ibaraki Prefectural Government
Email addresses of 2,776 participants in its Digital Satoyama Adventure AR photo rally, with age band, gender and other answers; the prefecture contracted through JTB, JR East Marketing & Communications and JNS before palan.
[Through a supplier][Major]Tokyo, MinatoPersonal services and entertainment2,776 leaked
JTB Corp.
Contracted by Ibaraki Prefecture for Digital Satoyama Adventure; data held by subcontractor palan included 2,776 participants’ emails.
[Through a supplier][Major]Kumamoto, Kumamoto, ChuoPrefecture478 leaked
Kumamoto Prefecture
Email addresses, age bands, gender and other data of all 478 participants in its 2024 Kumamon Tekuteku AR stamp rally; palan, subcontracted by JTB Publishing, had not deleted them after the contract ended.
[Through a supplier][Major]Miyazaki, MiyazakiPrefecture551 leaked
Miyazaki Prefecture
551 survey responses from its AR tourism guide Miyazaki Shinwa Sanpo: email addresses, gender, age band, area of residence and three other items.
[Through a supplier][Major]Tokyo, TaitoManufacturing1,084 leaked
TOPPAN Inc.
Contracted by Kumamoto City for its tourism stamp rally and subcontracted to palan; 1,084 participants’ emails, user names and other data leaked.
[Through a supplier][Major]Kumamoto, Kumamoto, ChuoMunicipality1,084 leaked
Kumamoto City
Email addresses, user names and other data of 1,084 users of its 2024 AR digital stamp rally, subcontracted by TOPPAN to palan.
[Through a supplier][Major]Gifu, GifuInformation and communications1,135 leaked
Gifu Shimbun Inc.
Contracted by Gifu Prefecture for its local-food stamp rally and subcontracted data management to palan; 1,135 participants’ emails and survey information leaked.

						Note
Fuchu City (Tokyo)	[Through a supplier]	[Critical]	Tokyo, Fuchu	Municipality	179	Email addresses and encrypted passwords of 179 users of its AR walking tour of local karuta sites.
palan Inc.	[Breached]	[Critical]	Tokyo, Shinjuku	Information and communications	33,348	Its service database was read through a data-analysis tool: 24,273 service users, 7,225 campaign participants and 1,850 people who made inquiries, up to 33,348 in total including overlaps.
Gifu Prefecture	[Through a supplier]	[Major]	Gifu	Prefecture	1,135	Email addresses and survey answers of participants in its 2024 local food digital stamp rally; Gifu Shimbun had palan manage the data.
Ibaraki Prefectural Government	[Through a supplier]	[Major]	Ibaraki, Mito	Prefecture	2,776	Email addresses of 2,776 participants in its Digital Satoyama Adventure AR photo rally, with age band, gender and other answers; the prefecture contracted through JTB, JR East Marketing & Communications and JNS before palan.
JTB Corp.	[Through a supplier]	[Major]	Tokyo, Minato	Personal services and entertainment	2,776	Contracted by Ibaraki Prefecture for Digital Satoyama Adventure; data held by subcontractor palan included 2,776 participants’ emails.
Kumamoto Prefecture	[Through a supplier]	[Major]	Kumamoto, Kumamoto, Chuo	Prefecture	478	Email addresses, age bands, gender and other data of all 478 participants in its 2024 Kumamon Tekuteku AR stamp rally; palan, subcontracted by JTB Publishing, had not deleted them after the contract ended.
Miyazaki Prefecture	[Through a supplier]	[Major]	Miyazaki, Miyazaki	Prefecture	551	551 survey responses from its AR tourism guide Miyazaki Shinwa Sanpo: email addresses, gender, age band, area of residence and three other items.
TOPPAN Inc.	[Through a supplier]	[Major]	Tokyo, Taito	Manufacturing	1,084	Contracted by Kumamoto City for its tourism stamp rally and subcontracted to palan; 1,084 participants’ emails, user names and other data leaked.
Kumamoto City	[Through a supplier]	[Major]	Kumamoto, Kumamoto, Chuo	Municipality	1,084	Email addresses, user names and other data of 1,084 users of its 2024 AR digital stamp rally, subcontracted by TOPPAN to palan.
Gifu Shimbun Inc.	[Through a supplier]	[Major]	Gifu, Gifu	Information and communications	1,135	Contracted by Gifu Prefecture for its local-food stamp rally and subcontracted data management to palan; 1,135 participants’ emails and survey information leaked.

Open in organization search

Sources

[1][Official]不正アクセスによる個人情報の漏えいに関するお知らせとお詫びpalan · 2026-10-26
[2][Official]県が令和６年度に実施した「清流の国ぎふ地産地消デジタルスタンプラリー」の業務を受託した(株)岐阜新聞社から、データ管理を請け負った(株)palan で発生した不正アクセスに伴う個人データの漏えいについてGifu Prefecture · 2026-10-27
[3][Official]「みやざき神話さんぽ－キキタビ観光ガイド－」における個人情報の外部流出に伴う注意喚起についてMiyazaki Prefecture · 2026-10-27
[4][Official]「まち歩き×AR 解説武蔵府中郷土かるた巡り」運営事業者への不正アクセスに伴う個人情報の不正取得についてFuchu City · 2026-10-30
[5][Official](株)palan のシステムへの不正アクセスによる情報漏えいについてIbaraki Prefecture · 2026-10-30
[6][News]1084人分の個人情報流出熊本市「ARスタンプラリー」委託先システムに不正アクセス二次被害確認されずRKK Kumamoto · 2026-10-30 16:28
[7][News]「くまモンテクテク」参加４７８人分の個人情報漏えい、データ管理会社が消去しておらず…不正アクセス被害Yomiuri Shimbun · 2026-11-03 11:48