Prestige International Breach May Have Leaked 5.5m Roadside Records

Drivers who called for help after a breakdown in Japan may now have their names, car details and some bank information in the hands of an attacker. Prestige International, a Tokyo-listed company that runs roadside assistance on behalf of insurers and other clients, said on 2 November that an intrusion into its group systems leaked “up to approximately 5.5 million records”.

The Prestige International breach matters because most of the people affected have probably never heard of the company. They dealt with their insurer or car-related service; Prestige’s subsidiary Prestige Core Solution (PCS) handled the call, dispatch and coordination behind the scenes. Clients including Sony Assurance and AXA Direct published their own notices the same day.

What the Prestige International breach exposed

According to the company’s English notice, also filed with the Tokyo Stock Exchange on TDnet, the affected systems are those PCS uses for “call reception, dispatching, and coordination of roadside assistance services” outsourced by client companies.

The leaked information concerns customers who used those services. Prestige lists names, addresses, telephone numbers and email addresses; “Vehicle-related information (registration numbers, vehicle identification numbers (VIN), etc.)”; “Incident and breakdown intake details”; and “Financial institution account information (partial)”. The company says the 5.5m figure “represents the maximum potential number including duplicates” and that the number of unique individuals is “under careful review”. It adds that “No leakage of credit card information has been confirmed at this time” and that some partner or contractor data may also be included.

Access continued after the first fix

The timeline suggests the attacker was not easy to remove. Prestige says it detected unauthorised access on 29 October and invalidated compromised credentials, but “unauthorized access was subsequently confirmed to be continuing”, so the systems were shut down on 30 October. It is investigating with outside specialists, reporting to the Personal Information Protection Commission and consulting the police.

Roadside help has not stopped. The company says assistance “continue[s] to operate through alternative operational procedures” while the systems are down, and that no secondary damage has been confirmed.

Outsourced call centres hold more than their size suggests

This is the latest in a run of large Japanese breaches. TSN has covered Nojima’s leak of about 7m member records, Muji’s app breach, the So-net breach and the Arara Message email-service breach, which also hit many brands through one supplier.

Prestige and Arara share a pattern. A single service provider, unknown to most of the public, holds data for many client companies, so one intrusion reaches customers of brands that were never breached themselves. For insurers, that is a supervision problem as much as a security one: the data was collected in their name, and their customers will hold them responsible.

The mix of data is what makes this one awkward. A breakdown record ties a person’s name, phone number and car to a specific incident and, in some cases, to bank details. That is ideal material for a convincing scam call: a caller who knows your car, your registration and the date you broke down can sound very much like your insurer. Prestige’s warning reflects that. It tells people to be cautious of calls, emails and SMS messages claiming to be from the company, its group, “insurance companies, or related entities”, and says it “will never ask for passwords, bank account PIN numbers, or sensitive credentials via phone or email”.

The word “partial” also needs care. The company has not said which parts of account details were taken, so it is too early to judge the fraud risk from those fields alone.

What affected customers can do

• Treat unexpected calls, texts or emails about a past breakdown, claim or refund with suspicion, and call your insurer on a number you already have.
• Never give a password or bank PIN in response to such a contact. Prestige says it will never ask for them.
• Watch for notices from your insurer or service provider, which Prestige says it will coordinate with client companies.

Prestige says the effect on its consolidated results is under review and that it will announce any revision to its forecast for the year ending 31 March 2027. The next figure to watch is the unique count of people affected.

Sources

• Prestige International: Notification and Apology Concerning Information Leakage Caused by Unauthorized Access to the Group’s Business Systems (English translation, PDF, 2 November 2026)
• Prestige International: TDnet filing (PDF, Japanese, 2 November 2026)
• Sony Assurance: notice on the incident (Japanese, 2 November 2026)
• AXA Direct: notice on the incident, first report (Japanese, 2 November 2026)

Related stories

• Arara Says Email Service Breach Has Grown to About 77m Addresses
• Nojima Says Online Store Hack Leaked About 7m Member Records
• Muji Says App Breach May Have Exposed Up to 27.26m Customer Records
• So-net Says Hack Exposed 2.59m Records and 54,401 Mail Passwords