[Investigating][Severity: Critical][Intrusion]

Suruga-ya: affiliate system breach alters data of about 5,500 affiliates and may have leaked bank details

Suruga-ya’s affiliate system was accessed without authorization. Data of about 5,500 affiliates, including names and passwords, was altered, and bank details may have leaked.

Disclosed

2026-11-05

Organizations involved

Leaked or at risk

5.5K

5,500

Downtime

Unknown

What happened

On 30 October Suruga-ya Co., Ltd. confirmed unauthorized third-party access to the system behind its Suruga-ya Affiliate program. It suspended the system to prevent further harm and reported to the authorities. [1]

For about 5,500 affiliate registrations, including those who left, names, readings, email addresses, passwords, genders, birth dates, addresses and phone numbers were rewritten. Company names, bank account details and site URLs may have leaked. The company says shop members’ data, payments and orders are not affected. No misuse had been confirmed as of 11:00 on 5 November. [1]