[Contained][Severity: Major][Software defect]

JR East: JRE ID bug may have shown other users' IDs to up to 546 people

After an update on the night of 28 October, user identifiers in JR East's JRE ID were duplicated, and up to 546 people may have seen another user's ID on linked services.

Disclosed

2026-11-04

Organizations involved

Leaked or at risk

546

Downtime

Unknown

People affected or at risk

4.2K

4,188

What happened

After a system update to East Japan Railway Company's JRE ID on the night of 28 October, a bug duplicated the numbers that identify users. From 02:03 on 29 October to 03:03 on 3 November, another user's JRE ID could appear on 14 linked services such as JRE POINT and Mobile Suica. [1]

Impact

What may have been shown is the JRE ID itself, an email address or a string the user chose, for up to 546 people. JR East suspended 4,188 users’ accounts. The display bug has been fixed, but access to the suspended accounts is being restored gradually. [1]

Timeline

Detected 2026-11-03
Disclosed 2026-11-04
1 days

Attack or cause

Method: [Software defect]
Impact: [Data leak]
Entry point: Web app

Data exposed or at risk

[E-mail address]

Services hit

Service	Role	Impact level
JRE ID	[Breached]	[Major]
JRE POINT	[Breached]	[Major]
Mobile Suica	[Breached]	[Major]

Open in service search

Organizations involved

[Breached][Major]Tokyo, ShibuyaTransport and postal services546 leaked
East Japan Railway Company
On 14 services linked to JRE ID, another user's JRE ID (an email address or a string the user chose) may have been shown, affecting up to 546 people.

						Note
East Japan Railway Company	[Breached]	[Major]	Tokyo, Shibuya	Transport and postal services	546	On 14 services linked to JRE ID, another user's JRE ID (an email address or a string the user chose) may have been shown, affecting up to 546 people.

Sources

[1][Official]JRE IDサービスにおけるシステム不具合に伴うお客さま情報の誤表示についてJR East · 2026-11-04