Summary
- Environment: palan analytics tool and connected service databases
- Operational impact: Data extracted; analytics tool stopped and login information invalidated
- Financial impact: No financial loss established in the reviewed evidence
- Record status: Developing record. Reviewed October 28, 2026; updated as evidence emerges.
What happened
palan said a vulnerability in its Metabase analytics tool enabled an unauthorized administrator account to extract service-database information. Its October 26 notice dates unauthorized access to August 9–October 21, 2026, with discovery on October 22. It found no record of personal-data extraction after October 16. [3]
Impact
palan reported a maximum of 33,348 people across overlapping categories: 24,273 customers, 7,225 campaign participants and 1,850 inquiry contacts. This is not a unique-person total. Depending on category, exposed information included contact and company details, password hashes, plan/payment details, survey answers and campaign histories. Card and bank-account information were excluded. [3]
Gifu Prefecture reported email addresses and demographic survey answers for 1,135 stamp-rally participants. Its notice says data remained at palan despite a destruction certificate received from the prefecture’s contractor, Gifu Shimbun. [2]
Miyazaki Prefecture separately reported 551 tourism-guide survey records containing email addresses, demographics and travel-related answers. Its warning describes records, not a deduplicated population. Neither prefecture’s figure should be added to palan’s maximum. [1][3]
Timeline
Access window begins
The reported intrusion window begins.
[3]Unauthorized account discovered
palan detected database extraction and began containment.
[3]Campaign impact disclosed
Gifu published its participant-data findings.
[2]Tourism-survey warning issued
Miyazaki warned survey participants about possible impersonation emails.
[1]Briefing updated
This briefing was last reviewed and updated on October 28, 2026.
Threat Group & Attack Vector
palan identifies exploitation of its analytics tool but no specific vulnerability identifier. This does not establish compromise of Metabase’s own infrastructure. [3]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
palan stopped the tool, blocked access, disabled unauthorized accounts, rotated credentials and invalidated login information. It reported to Japan’s privacy regulator and began notifications. It reported no alteration, deletion or secondary misuse; read-only operations still exposed information. [3]