Summary
- Environment: Car-maintenance reservation service, formerly PIT in plus
- Operational impact: Online reservations, changes and cancellations suspended
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed November 11, 2026; updated as evidence emerges.
What happened
Idemitsu Kosan confirmed unauthorized access to its car-maintenance reservation service on November 9, 2026. Customer information had been externally retrievable. The company suspended the service the next day. [1]
Impact
Actual leakage, affected customers and data scope remained under investigation. Online booking, changes and cancellations were unavailable; customers could contact their stores directly. [1]
Timeline
Unusual access detected
Investigation began after abnormal access was detected.
[1]Unauthorized access confirmed
Investigators confirmed customer information was externally retrievable.
[1]Service suspended
The first report announced the suspension.
[1]Briefing updated
This briefing was last reviewed and updated on November 11, 2026.
Threat Group & Attack Vector
Idemitsu has not disclosed an entry method. It explicitly separated this intrusion from the customer-information misdisplay reported October 9. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific ATT&CK technique is mapped from the available evidence.
Response
Idemitsu planned individual notices once affected customers were identified. Restart depended on confirming safety; no date was announced. [1]