SHINDO2

Tixplus

Ticketplus, Inc.

tixplus.jp

Personal dataup to107people

POSSIBLE LEAKPostal address / Phone numberMisconfiguration · Contained

Open in the live monitor ▶
Disclosed
Oct 1, 2026
Detected
Sep 29, 2026 21:40 JST
Detection to disclosure
2 days
Leak
Leak possible
Type
Misconfiguration
Status
Contained
Security spend
Measures, no amount
Compensation
Not announced

What leaked

IdentityFull name (kanji and katakana), Full name (kanji and katakana)
ContactEmail address, Postal code, Address, Phone number
Financial & paymentLast 4 digits of credit card number
Account dataPlus member ID

How many

  • Users whose information was displayed up to 107 people
  • Users who may have viewed others' information up to 322 people

Who is affected

  • Members

Cause

A change to web page cache settings, made to reduce server load during access spikes, caused other users' information to be displayed during simultaneous access

Timeline

  1. Exposure began
  2. Detected
  3. Exposure ended
  4. Service suspended
  5. Service restored
  6. First disclosure
  7. Individuals notified

Response

  • Change process
  • Service stopped

Review of verification procedures for system changes

What you should do

  1. Even the last 4 digits make a scam call sound genuine. Never give card details by phone or text
  2. Don't open links in emails from this company. The apology email itself may be fake
  3. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  4. Watch for unexpected mail or invoices; your address is hard to change
  5. Check the company's notice to see if you're affected

Lessons for companies

  1. Two-person review and pre-release tests for sharing and cache changes; monitor cloud config (CSPM)
  2. Never sit on a known defect. Test every change before production
  3. Don't keep ID or bank data: delete after checks or use a KYC provider
  4. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  5. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources