November 6, 2026: WebMoney, the Japanese prepaid e-money brand, said a third party reached its systems and that some customer payment information may have leaked. It has restricted some prepaid numbers against misuse and stopped some services. The catalog entry treats this as a confirmed incident with no published census.
What is known
- The 6 November notice confirms unauthorised access and a possible leak of "payment information and similar" (決済情報等). It does not list fields, a date of access, or a headcount.
- Prepaid numbers that WebMoney thinks may be abused are temporarily blocked. Other services are paused to stop further access.
- A 5 November "maintenance" notice had already taken balance-inquiry and campaign-winner lookup offline. Read that against the 6 November security notice, not as a separate outage story.
What is not known
- Whether a leak is confirmed, which payment fields are in scope (prepaid numbers, wallet balances, merchant history), and how many customers.
- How the actor got in, and whether any numbers have already been spent.
- When restricted prepaid numbers and paused services will return.
This is a first report. "May have leaked" is not the same as a confirmed dump of every wallet. It is also not a reason to assume the incident is minor.
Who is at risk
WebMoney users — especially anyone whose prepaid number is now blocked, and anyone who stored a number in a browser or screenshot. Phishing that offers to "unlock" a prepaid number is the obvious follow-on.
What to do
- Check the official WebMoney site for the 6 November notice. Do not trust a telegram or mail that offers to restore a number.
- If a prepaid number stops working, wait for WebMoney; do not buy a "replacement number" from a marketplace.
- WebMoney does not ask you to paste prepaid numbers into mail. Anyone who does is running a scam.
- Review recent merchant charges if you have a registered wallet. Report spend you did not make through the official support channel.
- Keep the notice. If WebMoney later publishes a field list or a count, that update is the one that matters for a bank or police report.
Sources
Sourcing note: leak language is "possibility" in the first report. We will update this post if WebMoney confirms fields or a census.