SHINDO4

Tokyu Malls Development

ID documents25,734records

LEAK CONFIRMEDCard expiry / Full nameMisdelivery · Closed (final report)

Open in the live monitor ▶
Disclosed
Jan 7, 2026
Detected
Dec 2, 2025
Detection to disclosure
36 days
Leak
Leak confirmed
Type
Misdelivery
Status
Closed (final report)
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityName in Roman letters
Financial & paymentCredit card number, partly masked, Expiry date, Card payment company information
Transactions & activityPayment date and time, payment amount

How many

  • Credit card settlement records 25,734 records

Who is affected

  • Shoppers at the company's commercial facilities

Cause

A wrong condition when extracting data from the settlement data system combined with a failure to check the attachment before sending the email

Timeline

  1. Settlement data sent by mistake in an email to a specific store
  2. Found when the store pointed it out
  3. Security NEXT report date

What you should do

  1. Even the last 4 digits make a scam call sound genuine. Never give card details by phone or text
  2. Check the company's notice to see if you're affected

Lessons for companies

  1. Use DLP: recipient checks, send delay, automatic attachment protection
  2. Don't keep ID or bank data: delete after checks or use a KYC provider
  3. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  4. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources