> JapanHacked_
[Investigating][Severity: Critical][Intrusion]

Shibuya: facility booking intrusion risks personal data and deletes records; My Portal remains suspended

Two city services were breached; some booking data was changed or lost. The 2 November report identifies a possible personal data leak. The count remains under review.

Disclosed

2026-10-28

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

The city disclosed unauthorized access to Shibuya My Portal and its facility reservation system on 28 October. In its second report on 2 November, it said personal data from the booking system may have leaked. The fields, people and count remain under review. [1]

Registration data in the booking system was changed. Backups restored much of it, but some data was lost, so affected users are being contacted to register it again. The booking service reopened after the flaw was addressed and safety checked. [1]

My Portal showed signs of intrusion and remains suspended as of 2 November. No personal data leak has been confirmed from it. That service interruption is distinct from the possible leak in the reservation system. [1]

Timeline

  1. Disclosed 2026-10-28
  2. 1 days

Attack or cause

Method
[Intrusion]
Impact
[Data leak][Service outage]
Entry point
Unknown

Data exposed or at risk

–

Services hit

Open in service search

Organizations involved

Sources

  1. [1][Official]渋谷区のオンラインサービスに対する不正アクセスの検知について(第2報)Shibuya City · 2026-11-02