---
title: "palan Metabase service-data incident"
description: "palan disclosed database extraction through its Metabase tool; Gifu and Miyazaki confirmed campaign and tourism-survey impacts."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-28"
canonical_url: "https://www.ally.security/incidents/palan-metabase-service-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/palan-metabase-service-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/palan-metabase-service-data-incident-2026/stix.json"
---

# palan Metabase service-data incident

An unauthorized administrator account exposed service and campaign information; the reported maximum includes overlapping categories.

Last modified Oct 28, 2026 · 3 sources

## Summary

- **Environment:** palan analytics tool and connected service databases
- **Operational impact:** Data extracted; analytics tool stopped and login information invalidated
- **Financial impact:** No financial loss established in the reviewed evidence

## What happened

[palan](https://palan.co.jp/) said a vulnerability in its Metabase analytics tool enabled an unauthorized administrator account to extract service-database information. Its [October 26 notice](https://palan.co.jp/news/20261026) dates unauthorized access to August 9–October 21, 2026, with discovery on October 22. It found no record of personal-data extraction after October 16. [3](#source-3)

## Impact

palan reported a maximum of 33,348 people across overlapping categories: 24,273 customers, 7,225 campaign participants and 1,850 inquiry contacts. This is not a unique-person total. Depending on category, exposed information included contact and company details, password hashes, plan/payment details, survey answers and campaign histories. Card and bank-account information were excluded. [3](#source-3)

[Gifu Prefecture](https://www.pref.gifu.lg.jp/) reported email addresses and demographic survey answers for 1,135 stamp-rally participants. Its [notice](https://www.pref.gifu.lg.jp/site/pressrelease/524450.html) says data remained at palan despite a destruction certificate received from the prefecture's contractor, Gifu Shimbun. [2](#source-2)

[Miyazaki Prefecture](https://www.pref.miyazaki.lg.jp/) separately reported 551 tourism-guide survey records containing email addresses, demographics and travel-related answers. Its [warning](https://www.pref.miyazaki.lg.jp/kanko-suishin/press/2026/10/20261027100338.html) describes records, not a deduplicated population. Neither prefecture's figure should be added to palan's maximum. [1](#source-1) [3](#source-3)

## Timeline

### August 9, 2026 — Access window begins

The reported intrusion window begins. [3](#source-3)

### October 22, 2026 — Unauthorized account discovered

palan detected database extraction and began containment. [3](#source-3)

### October 26, 2026 — Vendor disclosure published

The vendor disclosed the incident. [2](#source-2) [3](#source-3)

### October 27, 2026 — Campaign impact disclosed

Gifu published its participant-data findings. [2](#source-2)

### October 27, 2026 — Tourism-survey warning issued

Miyazaki warned survey participants about possible impersonation emails. [1](#source-1)

### October 28, 2026 — Briefing updated

This briefing was last reviewed and updated on October 28, 2026.

## Threat Group & Attack Vector

palan identifies exploitation of its analytics tool but no specific vulnerability identifier. This does not establish compromise of Metabase's own infrastructure. [3](#source-3)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

palan stopped the tool, blocked access, disabled unauthorized accounts, rotated credentials and invalidated login information. It reported to Japan's privacy regulator and began notifications. It reported no alteration, deletion or secondary misuse; read-only operations still exposed information. [3](#source-3)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/palan-metabase-service-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### 「みやざき神話さんぽ－キキタビ観光ガイド－」における個人情報の外部流出に伴う注意喚起について

official · Miyazaki Prefecture · Oct 27, 2026

<https://www.pref.miyazaki.lg.jp/kanko-suishin/press/2026/10/20261027100338.html>

<a id="source-2"></a>

### 株式会社palanで発生した不正アクセスに伴う個人データの漏えいについて

official · Gifu Prefecture · Oct 27, 2026

<https://www.pref.gifu.lg.jp/site/pressrelease/524450.html>

<a id="source-3"></a>

### 不正アクセスによる個人情報の漏えいに関するお知らせとお詫び

official · palan · Oct 26, 2026

<https://palan.co.jp/news/20261026>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Affected Organization · 100% confidence · current**  
   palan Metabase service-data breach: Gifu Prefecture
2. **Occurred At · 100% confidence · current**  
   Gifu discloses downstream impact: 2026-10-27
3. **Resulted In · 100% confidence · current**  
   palan Metabase service-data breach: palan found read-only database operations and no alteration or deletion, and reported no confirmed secondary misuse at publication. These findings do not negate the confirmed information extraction.
4. **Affected Organization · 100% confidence · current**  
   palan Metabase service-data breach: Miyazaki Prefecture
5. **Resulted In · 100% confidence · current**  
   palan Metabase service-data breach: Miyazaki reported 551 tourism-guide survey records, including email addresses, demographics, residence area and travel-related answers. It learned of the incident on October 26 and warned about impersonation emails. The 551 figure describes records, not a separately deduplicated person count.
6. **Used Product · 100% confidence · current**  
   palan Metabase service-data breach: Metabase
7. **Resulted In · 100% confidence · current**  
   palan Metabase service-data breach: Vendor disclosure published
8. **Disclosed At · 100% confidence · current**  
   palan Metabase service-data breach: 2026-10-26
9. **Resulted In · 100% confidence · current**  
   palan Metabase service-data breach: palan reported exploitation of a vulnerability in its internally used Metabase analytics tool. An unauthorized administrator account was used to obtain information from connected service databases.
10. **Resulted In · 100% confidence · current**  
   palan Metabase service-data breach: Gifu reported leaked email addresses and age-group, gender and municipality survey answers for 1,135 stamp-rally participants. Data remained at palan despite Gifu having received a destruction certificate from its contractor Gifu Shimbun.
11. **Resulted In · 100% confidence · current**  
   palan Metabase service-data breach: The unauthorized-access period was August 9 through October 21, 2026. palan found no record of personal-data extraction after October 16; the intrusion window and data-registration cutoff are different.
12. **Resulted In · 100% confidence · current**  
   palan Metabase service-data breach: Reported unauthorized-access period begins
13. **Discovered At · 100% confidence · current**  
   palan Metabase service-data breach: 2026-10-22
14. **Occurred At · 100% confidence · current**  
   Vendor disclosure published: 2026-10-26
15. **Occurred At · 100% confidence · current**  
   Reported unauthorized-access period begins: 2026-08-09
16. **Resulted In · 100% confidence · current**  
   palan Metabase service-data breach: palan reported a maximum of 33,348 affected people across categories that include duplicates: 24,273 service customers, 7,225 campaign participants and 1,850 contacts or document requesters. This is not a deduplicated population.
17. **Affected Organization · 100% confidence · current**  
   palan Metabase service-data breach: palan
18. **Resulted In · 100% confidence · current**  
   palan Metabase service-data breach: palan blocked external access, disabled unauthorized accounts, stopped the tool, rotated database credentials and invalidated service-login information. It reported to the Personal Information Protection Commission and began individual notifications; it said the tool would be retired.
19. **Resulted In · 100% confidence · current**  
   palan Metabase service-data breach: Gifu discloses downstream impact
20. **Resulted In · 100% confidence · current**  
   palan Metabase service-data breach: Depending on category, information included names, contact and company details, plan/payment details, password hashes, survey answers and campaign participation or prize history. Payment-card and bank-account information were not stored and were excluded.
21. **Resulted In · 100% confidence · current**  
   palan Metabase service-data breach: Unauthorized administrator account discovered
22. **Occurred At · 100% confidence · current**  
   Unauthorized administrator account discovered: 2026-10-22

</details>