TSUKU TSUKU: tampered Tsuku Tsuku!!! payment pages likely leaked data of 19,115 cards

On 4 September 2025 a card company detected possible misuse of cards used on Tsuku Tsuku!!! and passed it on through the payment processor. TSUKU TSUKU learned of it on 9 September and stopped card payments, reported to the Personal Information Protection Commission on 11 September and consulted the police on 12 September. [1] [3]

It published the forensic findings on 26 October 2026. It said the delay of more than a year came from confirming the affected cards, coordinating with card companies and preparing notices and a support desk, which took longer than expected. [1] [2] [4]

Attackers exploited a system vulnerability and planted malicious code in some pages of the shopping and web-ticket sites. Card holder names, numbers, expiry dates and security codes for 19,115 cards newly registered from 10 May to 9 September 2025 were very likely sent out. [1] [3] [2]

Separately, the company could not rule out a leak of 362,750 registered users’ personal records, including names, birth dates, addresses, phone numbers, gender, email addresses, login IDs and passwords, delivery addresses and occupations. No sign that these were sent out was found. [1] [3]

It removed the malicious code, fixed the vulnerability and is emailing affected users. It monitors transactions with the card companies and asked them not to charge users for replacement cards. Users are advised to check card statements and change their password, including on other services that share it. Payments with some card brands remain stopped. [1] [3]