SHINDO5

TV Asahi Media Plex Co., Ltd.

Total4,543people

POSSIBLE LEAKMy Number / Bank accountUnauthorized access · Contained

Open in the live monitor ▶
Disclosed
Jul 3, 2026
Detected
Apr 28, 2026 00:00 JST
Detection to disclosure
66 days
Leak
Leak possible
Type
Unauthorized access
Status
Contained
Security spend
Measures, no amount
Compensation
Not announced
Corporate number
8010401070559

What leaked

IdentityFull name, Date of birth, Gender
ContactAddress, Phone number, Email address
Financial & paymentBank account number
ID documentsMy Number
Business dataCorporate number, qualified invoice issuer number, etc.

How many

  • Total 4,543 people
  • Employees (incl. former employees) 1,343 people
  • Job applicants (graduate, mid-career, part-time) 2,786 people
  • Individual business partners 414 people

Who is affected

  • Employees
  • Former employees
  • Job applicants
  • Individual business partners

Cause

Credentials of an account used for authentication federation to the servers were likely stolen and misused to gain access

Timeline

  1. Detected
  2. First disclosure
  3. Second report; outside forensic investigation completed

Response

  • Blocked the entry point
  • Forensic investigation
  • More monitoring

Affected servers stopped and cut off from outside networks. Investigation by an outside specialist. Full review and strengthening of security and monitoring

What you should do

  1. ID numbers can never be changed. Request your credit file from CIC, JICC and others and look for contracts or loans you didn't make
  2. Register a self-declaration (honnin shinkoku) with the credit bureaus so lenders check applications in your name more carefully. The stronger loan self-restriction scheme also blocks your own borrowing and can't be withdrawn for 3 months. Neither stops bank accounts being opened
  3. Scammers who know your account number pose as refund staff. No bank or company asks for your PIN
  4. Don't open links in emails from this company. The apology email itself may be fake
  5. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  6. Watch for unexpected mail or invoices; your address is hard to change
  7. Expect targeted phishing posing as HR or interview contacts
  8. Check the company's notice to see if you're affected

Lessons for companies

  1. Passkeys or MFA for every account; monitor leaked credentials and rotate API keys
  2. Don't keep ID or bank data: delete after checks or use a KYC provider
  3. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  4. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources