Shibuya: facility booking intrusion risks personal data and deletes records; My Portal remains suspended
Two city services were breached; some booking data was changed or lost. The 2 November report identifies a possible personal data leak. The count remains under review.
Disclosed
2026-10-28
Organizations involved
1
Leaked or at risk
Unknown
Downtime
Unknown
What happened
The city disclosed unauthorized access to Shibuya My Portal and its facility reservation system on 28 October. In its second report on 2 November, it said personal data from the booking system may have leaked. The fields, people and count remain under review. [1]
Registration data in the booking system was changed. Backups restored much of it, but some data was lost, so affected users are being contacted to register it again. The booking service reopened after the flaw was addressed and safety checked. [1]
My Portal showed signs of intrusion and remains suspended as of 2 November. No personal data leak has been confirmed from it. That service interruption is distinct from the possible leak in the reservation system. [1]
Timeline
- Disclosed 2026-10-28
- 1 days
Attack or cause
- Method
- [Intrusion]
- Impact
- [Data leak][Service outage]
- Entry point
- Unknown
Data exposed or at risk
–
Services hit
Organizations involved
[Breached][Critical]Tokyo, ShibuyaMunicipality
Shibuya City
Sources
- [1][Official]渋谷区のオンラインサービスに対する不正アクセスの検知について(第2報)Shibuya City · 2026-11-02