Speee: unauthorized logins to group partner dashboards
From October 3 to 16, a third party used valid IDs and passwords over overseas servers to log in to two partner dashboards of Speee's Ieul and Sumai Step, one Housii user account, and one partner dashboard of ReFact's Nurikae. Users' names, phone numbers, emails, addresses and property locations may have been viewed and taken, 3,822 records in total (853 at Speee, 2,969 at ReFact). The companies detected the logins on October 16, changed the passwords and blocked the sources from the 19th. No sign of a system vulnerability was found; how the credentials were obtained was under investigation.
Disclosed
2026-10-22
Organizations involved
2
Leaked or at risk
3.8K
3,822
Downtime
Unknown
Timeline
- Started 2026-10-03
- Detected 2026-10-16
- Disclosed 2026-10-22
- 19 days
Attack or cause
- Method
- [Credential abuse]
- Impact
- [Data leak]
- Entry point
- Stolen credentials
Data exposed or at risk
Services hit
Organizations involved
[Breached][Major]Tokyo, MinatoInformation and communications853 leaked
Speee, Inc.[Breached][Major]Tokyo, MinatoInformation and communications2,969 leaked
ReFact Inc.
Sources
- [1][Official]当社グループのサービスへの不正ログインに関するお詫びとお知らせSpeee · 2026-10-22
- [2][Official]当社サービスへの不正ログインに関するお詫びとお知らせSpeee · 2026-10-22
- [3][Official]当社サービスへの不正ログインに関するお詫びとお知らせReFact · 2026-10-22