SHINDO3

APORITO

RIZAP Inc.

Unauthorized accessSize not disclosed

POSSIBLE LEAKCard security code / Card numberContained

Open in the live monitor ▶
Disclosed
Aug 10, 2026
Detected
Aug 5, 2026
Detection to disclosure
5 days
Leak
Leak possible
Type
Unauthorized access
Status
Contained
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityFull name
ContactAddress, Phone number, Email address
Financial & paymentCard number, expiry date, security code, Card number, expiry date, security code, Card number, expiry date, security code

Who is affected

  • Customers who ordered or entered information between May 1 and August 5, 2026

Cause

A suspicious data-sending program apparently planted in the system by a third party

Timeline

  1. Exposure began
  2. Exposure ended
  3. Detected
  4. Site closed
  5. Affected customers notified by email
  6. Reported to authority
  7. First disclosure

Response

  • Service stopped
  • Notified individuals
  • Forensic investigation

Closed the site the day the program was found; emailed affected customers on 8/8; reported to the PPC; detailed investigation under way

What you should do

  1. Call your card issuer, reissue the card, check statements daily and turn on alerts
  2. Don't open links in emails from this company. The apology email itself may be fake
  3. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  4. Watch for unexpected mail or invoices; your address is hard to change
  5. Check the company's notice to see if you're affected

Lessons for companies

  1. Don't keep ID or bank data: delete after checks or use a KYC provider
  2. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  3. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources