SHINDO3

Kyoto City

Donors83people

LEAK CONFIRMEDPostal address / Phone numberMisdelivery · Closed (final report)

Open in the live monitor ▶
Disclosed
Jan 20, 2026
Detected
Dec 25, 2025
Detection to disclosure
26 days
Leak
Leak confirmed
Type
Misdelivery
Status
Closed (final report)
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityName
ContactAddress, Phone number, Email address
Transactions & activityGift items ordered, Gift delivery address

How many

  • Donors 83 people
  • Gift delivery recipients 2 people

Who is affected

  • Hometown-tax donors
  • Gift delivery recipients

Cause

Hometown-tax contractor JTB mistakenly sent donor data to an unrelated gift supplier

Timeline

  1. Misdirected by JTB
  2. JTB reported it to the city
  3. Security NEXT report date

Response

  • Data deleted
  • Notified individuals

Asked the recipient to delete the data; the contractor explained and apologized to donors

What you should do

  1. Don't open links in emails from this company. The apology email itself may be fake
  2. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  3. Watch for unexpected mail or invoices; your address is hard to change
  4. You can be affected without ever using this service (parcel recipients etc.). Check any notice you receive
  5. Check the company's notice to see if you're affected

Lessons for companies

  1. Put security requirements, audit rights and reporting deadlines in vendor contracts
  2. Use DLP: recipient checks, send delay, automatic attachment protection
  3. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  4. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources