Ticketplus: other users' details shown on the Tickeplus e-ticket site
At 07:00 on 28 September, Ticketplus changed the web page cache settings of its Tickeplus site to cope with traffic peaks. Afterwards, users who opened the same page at the same moment could see another user's details; a user's report at about 21:40 on the 29th revealed it. The service was stopped at 22:35, the setting fixed and the service reopened at 07:00 on the 30th. Names, emails, addresses, phone numbers, last 4 card digits and more of up to 107 people may have been shown to others. No unauthorized access was found.
Disclosed
2026-10-01
Organizations involved
1
Leaked or at risk
107
107
Downtime
Unknown
Timeline
- Started 2026-09-28
- Detected 2026-09-29
- Disclosed 2026-10-01
- Resolved 2026-09-30
- 3 days
Attack or cause
- Method
- [Misconfiguration]
- Impact
- [Data leak][Service outage]
- Entry point
- Web app
Data exposed or at risk
Services hit
Organizations involved
[Breached][Major]Tokyo, ShibuyaInformation and communications107 leaked
Ticketplus, Inc.
Sources
- [1][Official]一部のお客様情報が別のお客様に表示される事象についてのお詫びとご報告Ticketplus · 2026-10-01