SHINDO3

Lawson Bank, Inc.

Personal dataup to5,373records

POSSIBLE LEAKBank account / Payment data (unspecified) imagesLoss · Investigating

Open in the live monitor ▶
Disclosed
Mar 31, 2026
Detected
Mar 24, 2026
Detection to disclosure
7 days
Leak
Leak possible
Type
Loss
Status
Investigating
Security spend
Not checked yet
Compensation
Not announced

What leaked

Transactions & activityTransaction records (deposits and transfers)
Financial & paymentCard images (image), Payee account information
IdentityRemitter name, Security camera footage (image)
ContactRemitter phone number

How many

  • Transaction records and other data up to 5,373 records

Who is affected

  • ATM users (deposits and transfers)

Cause

SSDs collected from ATMs went missing while handled by contractors; collection staff may have discarded them

Timeline

  1. SSDs collected from ATMs at Lawson stores in Tokyo (Kiyose and Shibuya) between October and December 2024
  2. Found in a stock check on March 23; confirmed missing on March 24
  3. Announced

Response

  • Vendor review

Continuing to search for the missing SSDs and tightening record management at the contractor and subcontractor

What you should do

  1. Scammers who know your account number pose as refund staff. No bank or company asks for your PIN
  2. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  3. Check the company's notice to see if you're affected

Lessons for companies

  1. Put security requirements, audit rights and reporting deadlines in vendor contracts
  2. Don't keep ID or bank data: delete after checks or use a KYC provider
  3. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  4. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources