Summary
- Environment: Outsourced server processing non-member campaign entries
- Operational impact: Affected server stopped and campaign-entry forms suspended
- Financial impact: No verified financial loss in the reviewed evidence
- Record status: Developing record. Reviewed October 26, 2026; updated as evidence emerges.
What happened
Impact
The potential exposure covered approximately 15,500 non-member entries for two campaigns conducted since May 2026. That figure includes repeat entries and is not a count of unique people. May describes the campaign period, not the beginning of the attack. Member, postcard and X entries were excluded. [1]
Possible data fields included names, ages, gender, occupation, marital and family details, phone numbers, email and postal addresses, and survey answers. Driver’s licence, credit-card and bank-account information were excluded. Fujicco had not confirmed public posting or misuse, but was responding as though the information had been acquired. [1]
Timeline
Possible leakage identified
Fujicco identified possible leakage from the processor’s server and promptly stopped the affected server.
[1]Public notice issued
The company disclosed the possible exposure and suspension of the affected campaign-entry forms.
[1]Briefing updated
This briefing was last reviewed and updated on October 26, 2026.
Threat Group & Attack Vector
The notice describes unauthorized access but gives no technical entry route. [1]
Actors
- Neither the attacker nor the outsourced processor is named.
TTPs
- No specific MITRE ATT&CK technique is supported by the available evidence.
Response
Fujicco described reporting to Japan’s Personal Information Protection Commission, consulting police and planning a complaint. It planned direct email notifications and consolidation into a verified environment with stronger monitoring. Reopening had not been scheduled. [1]