> JapanHacked_
[Resolved][Severity: Major][Misconfiguration]

Ticketplus: other users' details shown on the Tickeplus e-ticket site

At 07:00 on 28 September, Ticketplus changed the web page cache settings of its Tickeplus site to cope with traffic peaks. Afterwards, users who opened the same page at the same moment could see another user's details; a user's report at about 21:40 on the 29th revealed it. The service was stopped at 22:35, the setting fixed and the service reopened at 07:00 on the 30th. Names, emails, addresses, phone numbers, last 4 card digits and more of up to 107 people may have been shown to others. No unauthorized access was found.

Disclosed

2026-10-01

Organizations involved

1

Leaked or at risk

107

107

Downtime

Unknown

Timeline

  1. Started 2026-09-28
  2. Detected 2026-09-29
  3. Disclosed 2026-10-01
  4. Resolved 2026-09-30
  5. 3 days

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][Official]一部のお客様情報が別のお客様に表示される事象についてのお詫びとご報告Ticketplus · 2026-10-01