SHINDO4

Kyoto Sanga F.C.

Kyoto Purple Sanga Co., Ltd.

Fan club members15,612people

LEAK CONFIRMEDPostal address / Date of birthMisdelivery · Closed (final report)

Open in the live monitor ▶
Disclosed
Sep 8, 2026
Detected
Sep 2, 2026 16:29 JST
Detection to disclosure
6 days
Leak
Leak confirmed
Type
Misdelivery
Status
Closed (final report)
Security spend
Measures, no amount
Compensation
Not announced
Corporate number
5130001019476

What leaked

IdentityFull name, Date of birth, Gender
ContactAddress, Email address, Phone number
Account dataMembership type, J.LEAGUE ID, Enrollment date, One-Touch Pass ID, Digital membership card number
Transactions & activitySeason pass seat category, School facility and course information

How many

  • Fan club members 15,612 people

Who is affected

  • Fan club members

Cause

A staff member mistakenly attached a file containing personal data to an email sent to a business partner (2 of the 11 recipients opened it)

Timeline

  1. Data as of
  2. Intrusion stopped
  3. Intrusion began
  4. Detected
  5. Business partner confirmed deletion
  6. Individuals notified
  7. First disclosure

Response

  • Access review
  • Governance / committee
  • Change process
  • Data deleted

Restricted file access, improved password management, enforced attachment-checking procedures, and set up an internal "Information Management Countermeasures Committee" on September 7

What you should do

  1. Don't open links in emails from this company. The apology email itself may be fake
  2. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  3. Watch for unexpected mail or invoices; your address is hard to change
  4. Check the company's notice to see if you're affected

Lessons for companies

  1. Use DLP: recipient checks, send delay, automatic attachment protection
  2. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  3. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources