SHINDO2

Tokyo Convention and Visitors Bureau

Personal data25people

LEAK CONFIRMEDFull nameMisdelivery · Closed (final report)

Open in the live monitor ▶
Disclosed
Apr 21, 2026
Leak
Leak confirmed
Type
Misdelivery
Status
Closed (final report)
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityWinners' names

How many

  • 25 of 560 winners' parcels addressed with another person's name 25 people

Who is affected

  • Stamp-rally prize winners

Cause

TSP Taiyo, which ran the event secretariat, wrote other winners' names on some prize labels

Timeline

  1. Error made when prizes were shipped
  2. Security NEXT report date; the organization's own announcement date was not confirmed

Response

  • Notified individuals

Recovered the wrongly addressed prizes and explained and apologized to each affected winner

What you should do

  1. Check the company's notice to see if you're affected

Lessons for companies

  1. Put security requirements, audit rights and reporting deadlines in vendor contracts
  2. Use DLP: recipient checks, send delay, automatic attachment protection
  3. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  4. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources