> JapanHacked_
[Contained][Severity: Major][Credential abuse]

Speee: unauthorized logins to group partner dashboards

From October 3 to 16, a third party used valid IDs and passwords over overseas servers to log in to two partner dashboards of Speee's Ieul and Sumai Step, one Housii user account, and one partner dashboard of ReFact's Nurikae. Users' names, phone numbers, emails, addresses and property locations may have been viewed and taken, 3,822 records in total (853 at Speee, 2,969 at ReFact). The companies detected the logins on October 16, changed the passwords and blocked the sources from the 19th. No sign of a system vulnerability was found; how the credentials were obtained was under investigation.

Disclosed

2026-10-22

Organizations involved

2

Leaked or at risk

3.8K

3,822

Downtime

Unknown

Timeline

  1. Started 2026-10-03
  2. Detected 2026-10-16
  3. Disclosed 2026-10-22
  4. 19 days

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][Official]当社グループのサービスへの不正ログインに関するお詫びとお知らせSpeee · 2026-10-22
  2. [2][Official]当社サービスへの不正ログインに関するお詫びとお知らせSpeee · 2026-10-22
  3. [3][Official]当社サービスへの不正ログインに関するお詫びとお知らせReFact · 2026-10-22