> JapanHacked_
[Investigating][Severity: Critical][Intrusion]

M.League: official site and shop leak data of 9,502 people, including password hashes

M.League's official site and online shop were breached; data of 9,502 people leaked, including names, addresses, orders and password hashes.

Disclosed

2026-11-02

Organizations involved

1

Leaked or at risk

9.5K

9,502

Downtime

Unknown

What happened

  1. On the night of 29 October, the official site and M.League Official Online Shop were accessed without authorization and data leaked. The league cut off the access the same day. [1]

  2. The servers were shut down early in the morning. [1]

  3. The league disclosed the leak. It retired the old system, rebuilt it, and resumed posting schedules and news. [1]

Impact

9,502 users between October 2019 and 29 October 2026, including guest buyers. For 9,497 shop customers: name, address, phone number, email address, login ID, registration date and hashed password, plus number, time, items, amount and payment method of 13,922 orders. For 5 member-site users: name, address and phone number. No card data is included. [1]

Response

The Personal Information Protection Commission has been notified, and a report to the police is in progress. [1]

The official online shop has been stopped since early on 30 October; no reopening date had been set as of the 2 November notice. [1]

Timeline

  1. Started, Detected 2026-10-29
  2. Disclosed 2026-11-02
  3. 4 days

Attack or cause

Method
[Intrusion]
Impact
[Data leak][Service outage]
Entry point
Web app

Data exposed or at risk

[Name][Postal address][Phone number][E-mail address][Passwords][Purchase history]

Services hit

Organizations involved

Sources

  1. [1][Official]Mリーグ公式サイトおよび公式オンラインショップへの不正アクセスによるお客様情報の漏えいについて（お詫びとご報告）M.League · 2026-11-02