> JapanHacked_
[Contained][Severity: Critical][Intrusion]

Step Golf: up to 215,000 member-related database records at risk, including bank details

An intrusion may expose member, former-member and trial-user data, including bank details. The 215,000 ceiling counts database registrations, not people.

Disclosed

2026-11-07

Organizations involved

1

Leaked or at risk

215K

215,000

Downtime

Unknown

Findings and count unit

An anomaly detected on 5 November led to findings that unauthorized access on 23 and 25 October may have exposed backup data. The maximum 215,000 is a count of database registrations, not people or confirmed leaked records. Members, former members and trial users may be affected; the actual scope remains under investigation. [1]

Potentially affected fields include names, addresses, birth dates, phone numbers, email, unencrypted bank-account details, contract/booking/purchase/lesson records, face photos and unspecified special-care personal information. The notice does not identify the special-care fields. Card data and identity documents are not held in this system. Access was blocked and credentials changed; bookings and lessons remain available normally. [1]

Timeline

  1. Started 2026-10-23
  2. Detected 2026-11-05
  3. Disclosed 2026-11-07
  4. 15 days

Services hit

Organizations involved

Sources

  1. [1][Official]当社業務システムへの不正アクセスによる個人情報漏えいのおそれに関するお詫びとご報告(第一報)Step Golf · 2026-11-07