Strategic Marketing: Tokumoni! admin system intrusion

1. 2026-10-21

   A third party got into the Tokumoni! admin system and took member and client data. [1]

2. 2026-10-22

   Its investigation found the intrusion; it cut off the route, stopped the service, disclosed the incident and reported it to the Personal Information Protection Commission. [1]

3. 2026-10-23

   It updated the notice after finding that the range of possibly leaked data was wider. [1]

4. 2026-10-31

   It added advice on spotting fake emails posing as the company, which had begun to circulate. [1]

Names, login IDs, email addresses, phone numbers, dates of birth, addresses, reward bank accounts (bank, branch, account number and holder), point balances and application histories of 42,900 of about 340,000 members, and company names, contact names, addresses and login IDs for 819 client companies. The site holds no card data, and no password leak has been found. [1]

It restricted access to the admin system and strengthened authentication, and will restart the service once its fixes are done. It warns about contacts posing as the company or banks and advises members with registered accounts to check for unknown transactions. [1]