> JapanHacked_
[Contained][Severity: Major][Web app exploit][Misconfiguration]

Tokyu Land: unauthorized access to a shared AWS server of managed websites may expose 4,082 personal records

The server environment of websites Tokyu Land manages was accessed without authorization, and 4,079 member registrations of GREEN CROSS PARK and more may have leaked.

Disclosed

2026-10-30

Organizations involved

1

Leaked or at risk

4.1K

4,079

Downtime

Unknown

What happened

  1. Unauthorized access was found in the shared AWS server environment of websites it manages, and the sites were taken down. [1] [2]

  2. After reviewing access rights across the servers and fixing vulnerable software, it began restoring the sites one by one. [2]

  3. It reported to the Personal Information Protection Commission. [1] [2]

  4. It disclosed the incident and began notifying affected people individually. [1] [2]

Impact

Site
Records
Data
GREEN CROSS PARK site
4,079
Member registrations: company, department, name, email, phone and more
GREENUP Cooldown Project site
3
Enquiries: company, name and its reading, email, phone and more
[1] [2]

The logs do not show whether data actually left. No misuse is confirmed. [2]

Cause

Attackers exploited software flaws in the sites' content management system (WordPress and others) and misconfigured access rights on the server. [2]

Timeline

  1. Detected 2026-10-19
  2. Disclosed 2026-10-30
  3. 11 days

Attack or cause

Method
[Web app exploit][Misconfiguration]
Impact
[Data leak][Service outage]
Entry point
Web app

Data exposed or at risk

[Name][E-mail address][Phone number]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][Official]当社管理ウェブサイトにおける不正アクセスおよび個人情報流出の可能性についてTokyu Land · 2026-10-30
  2. [2][Official]当社管理ウェブサイトにおける不正アクセスおよび個人情報流出の可能性についてTokyu Land · 2026-10-30