MrMax says breach may have leaked data of up to 1,735,154 members
Version 2: Nikkei reported that MrMax restored normal app and online store service from the morning of October 4 after blocking the intrusion route, and that the company is reviewing the effect on its fiscal year ending February 2027.
In short
MrMax Holdings said on October 6 that unauthorized access to servers for its MrMax app and online store may have exposed personal information of up to 1,735,154 members. The company said member IDs, names, email addresses and telephone numbers may have leaked, while addresses, dates of birth, credit card information, passwords and purchase histories were confirmed not to have leaked. It said no misuse had been confirmed and warned customers about spoofing and phishing emails.
Read the full story 2 min read
MrMax Holdings, based in Fukuoka City, announced on October 6 that unauthorized access to servers for its MrMax app and online store may have leaked personal information of up to 1,735,154 members. The company operates 62 MrMax discount stores in the Kanto, Chugoku and Kyushu regions, according to ITmedia and Yahoo! News. The potentially leaked data includes member IDs, names, email addresses and telephone numbers, depending on registration status, while addresses, dates of birth, credit card information, passwords and purchase histories were confirmed not to have leaked, the company said. [ 1 , 6 , 8 , 11 , 13 , 14 ]
The company said it detected suspicious access on the evening of October 3, immediately suspended the services and blocked external access the same day. A later investigation found a third party had intruded by improperly using functions of the software that makes up the services, ITmedia and ASCII.jp reported. Asahi Shimbun reported the leak was established the same day. [ 1 , 2 , 6 , 10 , 13 ]
The company said no misuse of the leaked information had been confirmed as of the announcement, and warned that spoofing and phishing emails could be sent in the future, urging customers not to open suspicious messages or attachments. It said it would contact affected members individually by email and would never ask for passwords or credit card information. “We are deeply sorry for the great trouble and concern caused to our customers,” the company said, according to Mainichi Shimbun and Sankei Shimbun. Nikkei reported the company pledged to work company-wide on preventing recurrence and restoring trust. [ 1 , 2 , 4 , 6 , 13 , 14 , 15 ]
MrMax Holdings reported the incident to the Personal Information Protection Commission and consulted police, according to Nippon TV News, Livedoor News and Nikkei. Nippon TV News reported the company said it would strengthen monitoring and work to prevent recurrence. [ 6 , 7 , 13 ]
Nikkei reported the intrusion route was blocked and the app and online store returned to normal service from the morning of October 4. ITmedia reported the company said the impact on its business was under review and that it would disclose promptly if a material effect were found; Nikkei reported the company said the effect on its fiscal year ending February 2027 was under review. MrMax Holdings is listed on the Tokyo Stock Exchange Prime Market and the Fukuoka Stock Exchange, ITmedia reported. [ 1 , 13 ]
Mainichi Shimbun noted the incident follows a series of unauthorized-access cases at other Japanese companies, including the car-sharing service Times Car, Daiwa Securities Group and the grilled-meat restaurant chain Yakiniku King. [ 14 ]
Why it matters
A leak of this size at a regional discount retailer can expose customers to phishing and identity fraud, and the company said it reported the incident to Japan's personal information watchdog and consulted police. MrMax Holdings also said it is reviewing the effect on its business and would disclose any material impact, making the incident a test of its notification and disclosure process.
Key facts
- MrMax Holdings announced on October 6 that unauthorized access to its MrMax app and online store servers may have leaked personal information of up to 1,735,154 members. [ 1 , 2 , 6 , 10 , 11 , 13 , 14 , 15 ]
- The data possibly leaked includes member ID, name, email address and telephone number, while addresses, dates of birth, credit card information, passwords and purchase histories were confirmed not to have leaked. [ 1 , 2 , 6 , 10 , 11 , 13 , 14 ]
- The company detected suspicious access on the evening of October 3, suspended the services and blocked external access the same day. [ 1 , 2 , 6 , 10 , 11 , 13 , 15 ]
- An investigation found a third party had intruded by improperly using functions of the software that makes up the services, ITmedia and ASCII.jp reported. [ 1 , 2 ]
- The company said no misuse of the leaked information had been confirmed and urged customers not to open suspicious emails or attachments. [ 1 , 2 , 4 , 6 , 10 , 11 , 14 , 15 ]
- The company reported the incident to the Personal Information Protection Commission and consulted police, according to Nippon TV News, Livedoor News and Nikkei. [ 6 , 7 , 13 ]
- Nikkei reported the intrusion route was blocked and app and online store services returned to normal from the morning of October 4; the company said the effect on its fiscal year ending February 2027 was under review. [ 1 , 13 ]
- MrMax Holdings is based in Fukuoka City and operates 62 MrMax discount stores in the Kanto, Chugoku and Kyushu areas. [ 1 , 8 ]
Confirmed by several sources
- Unauthorized access to MrMax app and online store servers may have leaked personal information of up to 1,735,154 members, the company announced. [ 1 , 2 , 6 , 10 , 11 , 13 , 14 , 15 ]
- The data possibly leaked includes member ID, name, email address and telephone number, while addresses, dates of birth, credit card information, passwords and purchase histories were confirmed not to have leaked. [ 1 , 2 , 6 , 10 , 11 , 13 , 14 , 15 ]
- The company detected suspicious access on the evening of October 3, suspended the services and blocked external access the same day. [ 1 , 2 , 6 , 10 , 11 , 13 , 15 ]
- The company said no misuse of the leaked information had been confirmed and warned customers about spoofing and phishing emails. [ 1 , 2 , 4 , 6 , 10 , 11 , 13 , 14 , 15 ]
- The company reported the incident to the Personal Information Protection Commission and consulted police. [ 6 , 7 , 13 ]
Still unclear
- The exact number of affected individuals. The company states a maximum of 1,735,154 people and the documents give no final confirmed figure.
- Whether the leaked data has been or will be misused. The company says no misuse is confirmed but warns that spoofing or phishing emails may be sent in the future.
- The specific vulnerability and the identity of the attacker. Documents say a third party exploited software functions to intrude but do not identify the vulnerability or the attacker.
- The impact on MrMax Holdings' business. ITmedia and Nikkei report the company saying the effect is under review, with Nikkei tying it to the fiscal year ending February 2027.
- Normal service resumption from the morning of October 4. Reported so far only by Nikkei.
What local media are saying
Timeline, local time
- Suspicious access was detected on the MrMax app and online store servers; services were suspended and external access was blocked the same day. [ 1 , 2 , 6 , 10 , 11 , 13 , 15 ]
- Nikkei reports the app and online store returned to normal service after the intrusion route was blocked. [ 13 ]
- ITmedia News reports the company's announcement, including the maximum figure of 1,735,154 people. [ 1 ]
- NHK reports the breach, citing the company. [ 3 ]
- Nippon TV News reports that the company had reported to the Personal Information Protection Commission and consulted police. [ 6 ]
- Nikkei reports the service resumption and that the effect on the fiscal year ending February 2027 is under review. [ 13 ]