SHINDO3

Sumitomo Mitsui Banking Corporation

Payers~2,000people

POSSIBLE LEAKPostal address / Full nameImproper disposal · Closed (final report)

Open in the live monitor ▶
Disclosed
Jan 9, 2026
Leak
Leak possible
Type
Improper disposal
Status
Closed (final report)
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityPayer name
ContactAddress
Financial & paymentAmount paid
Transactions & activityPayment details

How many

  • Payers ~2,000 people

Who is affected

  • People who paid public charges (such as residents of Ikeda City, Osaka)

Cause

Copies of public payment slips were discarded by mistake with other documents past their retention period

Timeline

  1. Start of the period in which the slips were handled
  2. End of that period
  3. Security NEXT report date

What you should do

  1. Watch for unexpected mail or invoices; your address is hard to change
  2. Check the company's notice to see if you're affected

Lessons for companies

  1. Don't keep ID or bank data: delete after checks or use a KYC provider
  2. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  3. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources