Summary
- Environment: Blogger information and communications system
- Operational impact: Personal, assignment and email records taken
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed November 13, 2026; updated as evidence emerges.
What happened
Impact
The final report identified 2,840 bloggers, with varying personal-profile and contact information. It separately listed 630 assignment/application records, 11,237 email records and 10,780 business entries. These categories are not additional people. [1]
Timeline
Intrusion begins
Attackers entered the system.
[1]Unexpected email prompts discovery
A user inquiry alerted Shueisha.
[1]Initial disclosure published
Shueisha announced the incident.
[1]Final regulator report sent
The company reported its findings.
[1]Investigation results published
The final report revised the blogger count.
[1]Briefing updated
This briefing was last reviewed and updated on November 13, 2026.
Threat Group & Attack Vector
Shueisha identified Strapi configuration defects affecting API authentication and excessive permissions on publicly creatable accounts. A September 12 re-entry attempt failed. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1136 — Create Account: attackers created an unauthorized privileged account. [1]
Response
Shueisha repaired authentication and API functions, added web-application firewall controls and strengthened monitoring. It notified bloggers and planned further CMS and permission reviews. [1]