2026 Treasure Factory (Torefac) — case-management system for home buyback and moving accessed by a third party; 746,277 customer records taken, mostly email addresses
Data compromised
746,277 customer records, mostly email addresses. Names and addresses were included for only 11 of those records. About 750 business-partner and staff records and about 1,000 device records were also taken, according to Japanese reporting. The company says card and payment data were not included.
Technical writeup
The company’s TDnet disclosure dated October 23, 2026, is the primary source; it was not retrieved directly. The figures come from Japanese media summaries of that disclosure. The company says the August 2026 incident at its subsidiary Kaindol had a different cause and entry point; that subsidiary incident is not in this entry. The company said it planned to resume services after safety checks around October 28. Customers were warned that the leaked emails could be used for phishing.
Root cause
Unauthorised third-party access to the case-management system behind home-visit buyback (Shutchō Kaitori) and the Torefac Hikkoshi moving service. The company says an attacker exploited a database-access vulnerability. External access stopped at 10:30 on October 20; the related application forms were also suspended.