SHINDO3

TRUNK

TRUNK Inc.

Personal data records424records

POSSIBLE LEAKPostal address / Full nameAccount takeover · Contained

Open in the live monitor ▶
Disclosed
Sep 1, 2026
Leak
Leak possible
Type
Account takeover
Status
Contained
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityFull name
ContactAddress, Email address
Employment & HREmployer and other details

Not leaked

  • The company does not hold credit card information

How many

  • Personal data records 424 records

Cause

An employee's email account was accessed by a third party and suspicious emails impersonating the company and its staff were sent

Timeline

  1. First disclosure

Response

  • Password reset
  • Notified individuals
  • Phishing warning

Strengthened the employee mailbox password and stopped the suspicious emails; contacting affected people and warning about impersonation emails

What you should do

  1. Don't open links in emails from this company. The apology email itself may be fake
  2. Watch for unexpected mail or invoices; your address is hard to change
  3. Check the company's notice to see if you're affected

Lessons for companies

  1. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  2. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources