SHINDO5

Kaikatsu CLUB

Kaikatsu Frontier Inc.

Personal dataup to7.3Mrecords

POSSIBLE LEAKDate of birth / Postal addressUnauthorized access · Investigating

Open in the live monitor ▶
Disclosed
Jan 22, 2025
Detected
Jan 18, 2025
Detection to disclosure
4 days
Leak
Leak possible
Type
Unauthorized access
Status
Investigating
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityFull name, Gender, Date of birth
ContactAddress, Phone number
Account dataMembership number, Membership type and status, Points balance and expiry, Barcode, Push notification preferences, coupon messages, etc.
Transactions & activityStore code and last checkout date/time

How many

  • Personal data records that may have leaked up to 7.3M records

Who is affected

  • Some customers who became Kaikatsu CLUB members in a certain period, and FiT24 and FiT24 Indoor Golf members
  • Kaikatsu CLUB provisional members

Cause

Servers managed by the company (member management) were compromised

Timeline

  1. Evening
  2. Date of the first Security NEXT report
  3. Company issued an update

Response

  • Notified individuals

Will notify affected customers by email and letter

What you should do

  1. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  2. Watch for unexpected mail or invoices; your address is hard to change
  3. Check the company's notice to see if you're affected

Lessons for companies

  1. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  2. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources