Step Golf: up to 215,000 member-related database records at risk, including bank details
An intrusion may expose member, former-member and trial-user data, including bank details. The 215,000 ceiling counts database registrations, not people.
Disclosed
2026-11-07
Organizations involved
1
Leaked or at risk
215K
215,000
Downtime
Unknown
Findings and count unit
An anomaly detected on 5 November led to findings that unauthorized access on 23 and 25 October may have exposed backup data. The maximum 215,000 is a count of database registrations, not people or confirmed leaked records. Members, former members and trial users may be affected; the actual scope remains under investigation. [1]
Potentially affected fields include names, addresses, birth dates, phone numbers, email, unencrypted bank-account details, contract/booking/purchase/lesson records, face photos and unspecified special-care personal information. The notice does not identify the special-care fields. Card data and identity documents are not held in this system. Access was blocked and credentials changed; bookings and lessons remain available normally. [1]
Timeline
- Started 2026-10-23
- Detected 2026-11-05
- Disclosed 2026-11-07
- 15 days
Attack or cause
- Method
- [Intrusion]
- Impact
- [Data leak]
- Entry point
- Unknown
Data exposed or at risk
Services hit
Organizations involved
[Breached][Critical]Tokyo, ShibuyaPersonal services and entertainment215,000 leaked
Step Golf Co., Ltd.
Sources
- [1][Official]当社業務システムへの不正アクセスによる個人情報漏えいのおそれに関するお詫びとご報告(第一報)Step Golf · 2026-11-07