toypo: a flaw in the access controls of the toypo shop membership app leaked data of 697,209 users

1. 2026-10-04

   Unauthorized access was found. A flaw let a logged-in user fetch other users' data without permission, and records showed a third party had used it to take user data. [1] [4]

2. 2026-10-07

   The company informed the businesses using the app. [2]

3. 2026-10-13

   Public disclosure; affected users began to receive in-app notices, and businesses using the app published their own notices. [1] [2] [3]

4. 2026-10-14

   The company put the number of affected users at 697,209. [4]

Phone numbers and user IDs, plus names (also in kana), email addresses, birth dates, genders and addresses where users had entered them. Passwords, card and other payment data, points and visit or purchase histories were not included. [1] [4] [5]

The affected people are members of shops that use the app, and some of those businesses published notices. [2] [3] [5]

The company fixed the flaw and is checking other systems for the same problem. It is tightening access controls and monitoring and arranging a security review by an outside firm. Some of the businesses stopped new app sign-ups. [2] [4] [5] [6]