> JapanHacked_
[Investigating][Severity: Critical][Intrusion]

Tin Pan Alley: unauthorized access to its business server may have exposed about 1.2 million RAGTAG member records

A business server of Tin Pan Alley, a World subsidiary, was accessed without authorization, and about 1.2 million member records in total may have leaked.

Disclosed

2026-10-30

Organizations involved

1

Leaked or at risk

1.2M

1,200,000

Downtime

Unknown

What happened

  1. A business server of Tin Pan Alley, which runs the RAGTAG reuse shops, was accessed without authorization. [1] [2] [3]

  2. Unauthorized operations were detected; the server was isolated and the online shop and other services were paused. [1] [2] [3]

  3. Parent company World disclosed the incident. [1] [2] [3]

Impact

  • About 1,200,000 member records in total [1] [2] [3]
  • Names, addresses, phone numbers, birth dates, gender and emails [1] [2] [3]
  • No leak of card data or face data is confirmed. [1] [2] [3]

Timeline

  1. Started 2026-10-17
  2. Detected 2026-10-28
  3. Disclosed 2026-10-30
  4. 13 days

Attack or cause

Method
[Intrusion]
Impact
[Data leak][Service outage]
Entry point
Unknown

Data exposed or at risk

[Name][Postal address][Phone number][Date of birth][Gender][E-mail address]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]ワールドの個人情報流出か　子会社で120万件、住所や電話番号　クレカ情報は確認されずSankei Shimbun · 2026-10-30
  2. [2][News]ワールド系、個人情報120万件漏洩か　不正アクセスでNikkei · 2026-10-30
  3. [3][News]ワールド子会社ティンパンアレイに不正アクセス 会員情報延べ約120万件流出かAct · 2026-10-30