Treasure Factory Says Hackers Took 746,277 Customer Email Addresses

Treasure Factory, a major Japanese second-hand goods chain, says an intruder exploited a flaw in the system it uses to book home buy-back visits and moves, and took 746,277 customer email addresses. Eleven of those records also included a name and home address.

The Tokyo-listed company disclosed the breach on 23 October in a notice to customers and a filing to the Tokyo Stock Exchange. It says no credit card numbers, security codes or other payment details were involved, and that it has found no misuse of the data so far.

The intrusion hit the booking system for home visits and moves

According to the filing, Treasure Factory checked the access logs of its case-management system on 20 October and found that someone had exploited a vulnerability in it from the early hours to the morning of that day. The system handles bookings and related work for the company’s home buy-back service, where staff visit customers to value and buy their goods, and for its Torefac moving service.

The company cut off outside access to the system at 10:30 that morning and stopped taking applications through the buy-back and moving forms at 11:05. Customer data held by its shops and by its app sit on separate systems and were not affected, it says.

Email addresses make up almost all of the stolen data

The company says three sets of data were taken:

• Customers: 746,277 records, consisting of email addresses, 11 of which also contain a name and address
• Business partners and employees: 750 records of names and email addresses
• Devices used by partners and employees: 1,000 records of names and device identifiers

The Nikkei reported the same figures, describing the company as a major player in Japan’s reuse market. Treasure Factory warns that the addresses could be used for phishing emails and other fraudulent contact. It asks customers to steer clear of links or attachments in unexpected emails and texts, to keep passwords and card details off unfamiliar websites, and to check a caller’s identity through the organisation’s official contact details.

The company says the PHP flaws were not to blame

Treasure Factory says its investigation so far points to a vulnerability affecting access to a database, and that it is working with outside security specialists to establish the full cause and scope. It says it has confirmed that the attack did not exploit the recently disclosed PHP2Shell vulnerabilities and is unrelated to them.

This is the group’s second security incident in a short time. In August, its subsidiary Kindal suffered a breach after staff login details were stolen through phishing. Since then the group says it has reviewed two-factor authentication, account and access rights, who can export data, and security monitoring. It says the new case had a different cause and a different way in, and that it will now also tighten vulnerability management and scanning of public-facing systems, web application firewall protection and application and database security.

Reports filed, with a restart targeted for 28 October

The company has changed passwords on the accounts involved and is strengthening login security and monitoring. It plans to restart the system and booking forms around 28 October once safety checks are complete. It is reporting the breach to Japan’s Personal Information Protection Commission and consulting the police, will contact affected customers individually and is preparing a dedicated helpline. The exchange filing adds that the effect on the group’s results is still being assessed.

The disclosure adds to a run of Japanese corporate breaches this month, after Capcom’s CAPCOM ID incident, the GMO Desktop Cloud hack, and ST’s customer data breach and the Hankyu Hanshin H2O ID breach. TSN tracks them in its cyber attacks hub.

Two breaches with two causes test the whole group’s defences

The data taken this time is narrow, but the pattern matters more than the size. After Kindal, the group’s fixes centred on people and passwords: two-factor logins, access rights and export limits. This intrusion came through a software flaw in a booking system open to the public, a route those measures were never meant to cover. Two incidents in two months, through two different doors, suggest the group has been fixing problems one at a time rather than mapping everything it exposes online.

For customers, the risk is in the inbox rather than the bank account. A list of three-quarters of a million addresses tied to a known retailer is exactly what phishing campaigns need, and a fake message about a buy-back visit or a moving booking would be easy to make convincing. The company’s promise to rule out the PHP flaws was quick; the more useful disclosure will be what the database flaw was, and whether the same weakness exists anywhere else in the group before the forms reopen on 28 October.

Sources

• Treasure Factory, “不正アクセスによる個人情報漏えいに関するお詫びとお知らせ” (customer notice, Japanese), 23 October 2026
• Treasure Factory, “当社システムへの不正アクセスによる個人情報漏えいに関するお知らせ” (Tokyo Stock Exchange filing, Japanese), 23 October 2026
• Nikkei, “トレファク、不正アクセスで個人情報漏洩 約70万件”, 23 October 2026

Related stories

• GMO Says 26,739 Desktop Cloud Servers May Be Affected After Hack, Halts Service
• Capcom Says CAPCOM ID Breach Exposed 11.77 Million Email Records
• Ransomware and Major Cyber Attacks: TSN Story Hub