[Contained][Severity: Critical][Misconfiguration]

Yeny: an API connection misconfiguration leaked phone numbers and member IDs of 1.33 million members

A misconfigured API connection leaked phone numbers and member IDs of 1,332,505 ultra pay and other prepaid card users; no payment data leak is confirmed.

Disclosed

2026-11-12

Organizations involved

Leaked or at risk

1.3M

1,332,505

Downtime

Unknown

What happened

Yeny Inc. said on 12 November that an outsider accessed part of its member data and that phone numbers and its own member IDs leaked. After a connected business reported suspicious API calls on 31 October, it found a misconfigured API connection was the cause. It confirmed the leak on 5 November and reported to the Kanto Local Finance Bureau and the Personal Information Protection Commission on 6 November. [1]

The leak covers 1,332,505 records, including former members, across the ultra pay card and three fan payment apps built on PayBlend (Azul Claro Numazu Pay, Mikami Kon Pay and Toshiba Brave Lupus Tokyo Pay). No card numbers or other payment data are confirmed leaked, and the leaked data alone cannot be used to log in or pay. The setting has been corrected. [1]