[Contained][Severity: Major][Misconfiguration]

Bic Camera: a misconfigured business inquiry form was exploited; 133,039 business customer records leaked

A misconfigured business inquiry form leaked 133,039 records of company names, contact names and emails. The form is closed; this is separate from the Arara leak.

Disclosed

2026-11-10

Organizations involved

Leaked or at risk

133K

133,039

Downtime

Unknown

Leak and response

From 5 to 6 November, outside access exploiting a latent misconfiguration of the business inquiry form on BicCamera.com for Business leaked part of the business customer data. The form was closed and the setting fixed at 14:15 on the 6th, stopping leaks by that route. No intrusion into the consumer site BicCamera.com was found. [1]

A total of 133,039 records leaked, each holding some or all of company name, department, contact name and email address; transaction history, amounts and account data are not included. The count is of records, not people or companies. Affected customers are notified individually and the case was reported to the Personal Information Protection Commission. [1]