The Treasure Factory data breach is a personal information incident at Treasure Factory Co., Ltd. (株式会社トレジャー・ファクトリー), a Japanese reuse retailer, in which a third party improperly obtained 746,277 customer email addresses. The company, listed on the Tokyo Stock Exchange Prime market under securities code 3093, published a timely disclosure (適時開示) on 23 October 2026 at 15:30 Japan time reporting that the third party had gained unauthorised access to the management systems of its 出張買取 (home-visit purchasing) service and its トレファク引越 (Trefac moving) service. The company confirmed the intruder had also obtained 750 vendor and employee name-and-email records and 1,000 records of vendor and employee terminal information. No credit card numbers or other payment data were included, and customer data held at stores and in the company app is stored on separate systems and was not affected. The disclosure was reported the same evening by Nikkei, Sankei and the Kyodo wire.
Affected data
The company defined the improperly obtained information in three categories. Customer information for 出張買取, トレファク引越 and related services accounts for 746,277 records, consisting of email addresses, with 11 of those records also containing customer names and addresses. Information on vendors, business partners and employees accounts for 750 records, consisting of names and email addresses. Information on terminals used by vendors, partners and employees accounts for 1,000 records, consisting of names and terminal identifier information. The three categories are separate management units, so the sum of the three counts is not a single count of affected individuals, and the counts are the company's own confirmed figures from the disclosure. Reuters also reported the disclosure on 23 October, describing the leak as more than 700,000 customer email addresses.
Intrusion timeline and cause
On 20 October 2026, during an investigation of the management system's access logs, the company found that unauthorised access by a third party had taken place from the early morning to the morning of that day. At that point the company confirmed that customer information had been improperly obtained during the access. The exact access times and duration beyond that window have not been published, and no attacker or group has been identified in the published material. The company attributes the intrusion to the exploitation of a vulnerability related to database access. It has not published the specific software, the CVE number, or the structure of the attack requests involved, and there is no published basis for describing the attack as SQL injection. The company stated explicitly that the intrusion did not use the recently published PHP vulnerability, a denial reported by both Nikkei and Sankei on 23 October 2026.
Company response
On 20 October, after confirming the access, the company blocked external access to the management system at 10:30 and stopped accepting applications through the 出張買取 and トレファク引越 sign-up forms at 11:05, according to the security-lab analysis of the disclosure. Sankei's report carried a photograph of the Trefac moving service website showing an emergency maintenance notice. The passwords of related accounts were changed. The company is working with an external security specialist to fix the exploited vulnerability, strengthen login security and the monitoring of suspicious access, and to investigate the cause and the scope of the impact. Reporting to the Personal Information Protection Commission and consultation and reporting to the police and related organisations are in progress. Individual notification for the affected customers and related parties is being prepared, together with a dedicated inquiry desk that the company plans to announce on its homepage. The company targets 28 October for resuming the suspended applications and services, subject to completing the required safety checks. As of the 23 October announcement, the company had confirmed no secondary damage from the improperly obtained information.
Email aliases and exposed addresses
A leaked email address is usable material for phishing and scam messages that impersonate the service the customer used. The common patterns are described in how phishing uses a leaked email address and how to check whether a message is phishing. A dedicated email alias for each service is one mechanism that limits the spread of such an address: with a separate alias per service, the address held by any one company identifies only that service, and if it appears in a breach the alias can be disabled or paused while the user's other aliases continue to work. An alias does not prevent the company from being breached, and it does not recover an address that a third party has already obtained.
AliasFleet provides managed email aliases, one per service. An alias that appears in a breach can be paused or disabled. All aliases forward to a single verified destination inbox. AliasFleet is not a disposable email service; it does not monitor other companies' breaches, and it cannot remove an address from systems that have already stored it. Whether an address appears in a known breach can be checked at Have I Been Pwned. More about the service is at aliasfleet.com.
Separate subsidiary incident
In August 2026, a separate incident occurred at Kindal, a consolidated subsidiary of Treasure Factory, affecting the subsidiary's EC site. That case originated in phishing against staff credentials, and its final investigation report of 13 October 2026 confirmed 136,464 affected individuals. The company has stated that the cause and the intrusion route of the subsidiary incident differ from those of the October case at the parent company. The two incidents took place on separate systems and are not combined into a single victim count.
Top comments (0)