SHINDO4

Smaregi

Customer names136,346records

POSSIBLE LEAKPhone number / Full nameUnauthorized access · Investigating

Open in the live monitor ▶
Disclosed
Jan 13, 2026
Detected
Jan 8, 2026
Detection to disclosure
5 days
Leak
Leak possible
Type
Unauthorized access
Status
Investigating
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityName
ContactPhone number

Not leaked

  • No leak from servers or systems operated by Smaregi has been confirmed

How many

  • Customer names 136,346 records
  • Phone numbers 114,951 records
  • Companies that had linked the app 8 organizations

Who is affected

  • Eight companies that had linked the app
  • Customers of the eight companies' stores

Cause

The management systems of the vendor of the external app Shorui Jozu / Estimates and Invoices, +invoice were breached and the data was taken and published by a third party

Timeline

  1. Detected
  2. First announcement
  3. Published the number of affected records

Response

  • Service stopped
  • Blocked the entry point
  • Notified individuals
  • Forensic investigation

Removed the app from the marketplace and blocked its access; contacted affected stores directly and is investigating with the vendor

What you should do

  1. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  2. Check the company's notice to see if you're affected

Lessons for companies

  1. Put security requirements, audit rights and reporting deadlines in vendor contracts
  2. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  3. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources