Rakumachi: credential stuffing on the Rakumachi property investment site exposed incomes and assets of up to 3,450 people through agent accounts

1. 2026-10-09

   Until 11 October, there were unauthorized logins on the member and agent login pages, which the company believes was credential stuffing with email and password pairs leaked elsewhere. [1]

2. 2026-10-15

   The attacking sources were blocked and the passwords of the affected accounts disabled. [1]

3. 2026-10-19

   Public disclosure; affected people began to receive emails. [1]

• Up to 160 member accounts: names, addresses, email addresses, phone numbers, birth dates, occupations, incomes, own funds and property holdings where entered, saved properties and messages with agents. [1]
• 7 agent companies: company and representative names, staff names, email addresses and photos, billing details, property listings and more. [1]
• Through 4 of these accounts, names, contact details, addresses, ages, occupations, incomes, own funds, property holdings and inquiry contents of up to 3,450 people who had asked about properties or valuations were viewed; at one company the inquiry list was downloaded. [1]

The groups overlap. The company holds no card data, and ID documents were not taken. There was no break-in to its servers or databases, and no misuse had been found at the time of disclosure. [1]

Agent logins now also require a code sent by email. The company reported to the Personal Information Protection Commission and consulted the police. It asked users who share the password with other services to change it on both. [1]