--- title: "Shueisha HAPPY PLUS COMMUNITY data theft" description: "Shueisha’s final investigation identified 2,840 bloggers affected by the September 2026 HAPPY PLUS COMMUNITY intrusion." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-11-13" canonical_url: "https://www.ally.security/incidents/shueisha-happy-plus-community-data-theft-2026" markdown_url: "https://www.ally.security/incidents/shueisha-happy-plus-community-data-theft-2026.md" stix_url: "https://www.ally.security/incidents/shueisha-happy-plus-community-data-theft-2026/stix.json" --- # Shueisha HAPPY PLUS COMMUNITY data theft Shueisha’s final investigation identified 2,840 bloggers affected by the September 2026 HAPPY PLUS COMMUNITY intrusion. Last modified Nov 13, 2026 · 1 source ## Summary - **Environment:** Blogger information and communications system - **Operational impact:** Personal, assignment and email records taken - **Financial impact:** No confirmed incident cost quantified ## What happened [Shueisha](https://www.shueisha.co.jp/) said attackers entered HAPPY PLUS COMMUNITY September 8–9, 2026, created a privileged account and obtained information through repeated API requests. [1](#source-1) ## Impact The [final report](https://www.shueisha.co.jp/wp-content/uploads/2026/11/notice20261112.pdf) identified **2,840 bloggers**, with varying personal-profile and contact information. It separately listed 630 assignment/application records, 11,237 email records and 10,780 business entries. These categories are not additional people. [1](#source-1) ## Timeline ### September 8, 2026 — Intrusion begins Attackers entered the system. [1](#source-1) ### September 9, 2026 — Unexpected email prompts discovery A user inquiry alerted Shueisha. [1](#source-1) ### September 28, 2026 — Initial disclosure published Shueisha announced the incident. [1](#source-1) ### November 6, 2026 — Final regulator report sent The company reported its findings. [1](#source-1) ### November 12, 2026 — Investigation results published The final report revised the blogger count. [1](#source-1) ### November 13, 2026 — Briefing updated This briefing was last reviewed and updated on November 13, 2026. ## Threat Group & Attack Vector Shueisha identified [Strapi](https://strapi.io/) configuration defects affecting API authentication and excessive permissions on publicly creatable accounts. A September 12 re-entry attempt failed. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - [T1136 — Create Account](https://attack.mitre.org/techniques/T1136/): attackers created an unauthorized privileged account. [1](#source-1) ## Response Shueisha repaired authentication and API functions, added web-application firewall controls and strengthened monitoring. It notified bloggers and planned further CMS and permission reviews. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Shueisha HAPPY PLUS COMMUNITY investigation results official · Shueisha Inc. · Nov 12, 2026
Evidence ledger Review the supporting structured claims. 1. **Affected Organization · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: Shueisha Inc. 2. **Resulted In · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: Stolen information also included 630 assignment/application records, 11237 sent-email records and10780 business-contact entries; the business list included 26 email addresses and113 phone numbers but no contact-person names. These are separate record categories, not additional people. 3. **Resulted In · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: Final regulator report sent 4. **Used Attack Technique · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: https://attack.mitre.org/techniques/T1136/ 5. **Resulted In · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: Unexpected email triggers discovery 6. **Occurred At · 100% confidence · current** Intrusion begins: 2026-09-08 7. **Resulted In · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: Shueisha reported no confirmed misuse, secondary harm or related leak-site publication as of the final report. It planned CMS updating or redesign and regular authorization/configuration reviews. 8. **Resulted In · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: A September 12 re-entry attempt did not result in compromise or data acquisition, according to the investigation. 9. **Ended At · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: 2026-09-09 10. **Resulted In · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: Shueisha repaired API and authentication functions, configured a web application firewall and strengthened monitoring. It notified bloggers and sent a final report to the privacy regulator November 6. 11. **Resulted In · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: The final investigation identified 2840 affected bloggers. Data varied by person and included identity/contact details, birth dates, social profiles, images and other registered personal-profile information. 12. **Discovered At · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: 2026-09-09 13. **Disclosed At · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: 2026-09-28 14. **Occurred At · 100% confidence · current** Initial disclosure published: 2026-09-28 15. **Occurred At · 100% confidence · current** Unexpected email triggers discovery: 2026-09-09 16. **Resulted In · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: Accounts that anyone could create had permission to view member information from the 2021 launch until discovery, which Shueisha identified as a contributing cause. 17. **Resulted In · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: Investigation results published 18. **Occurred At · 100% confidence · current** Final regulator report sent: 2026-11-06 19. **Resulted In · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: The attacker sent three template-based emails to 100 addresses during the intrusion. A user inquiry about an unexpected email alerted Shueisha September 9 at 14:53. 20. **Resulted In · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: Attackers entered the blogger information and communications system September 8–9, created an unauthorized privileged account and repeatedly used APIs to obtain information. The final report traced this to Strapi CMS configuration defects affecting API authentication. 21. **Began At · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: 2026-09-08 22. **Occurred At · 100% confidence · current** Investigation results published: 2026-11-12 23. **Resulted In · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: Initial disclosure published 24. **Resulted In · 100% confidence · current** Shueisha HAPPY PLUS COMMUNITY data theft: Intrusion begins