Timeline of events and response
What was discovered and what we did, in chronological order. Any correction to published information is recorded in the correction history below.
- Occurred
Unauthorized access to WASABI SWITCH by a third party (first incident)
Date of occurrence identified by the subsequent investigation.
- Discovered
Stores report that customers are receiving suspicious emails
The emails contained real order information and, pretending to offer a refund, asked recipients to contact a LINE account.
- Published
Published "Warning about suspicious emails"
- Occurred
A second unauthorized access with a different cause is detected
The entry route has been identified and countermeasures are under way.
- Published
Published the first report on the data leak
We announced that information had been leaked as a result of the access on October 14.
- Action
Added security improvements (encrypted storage of credentials) to the first report
- Published
Published the second report on temporary account deactivation
Some accounts that should have been inactive were found to be active.
- Action
futureshop revokes API keys; integration suspended
- Action
All WASABI SWITCH accounts temporarily deactivated
- Published
Published notice on the futureshop integration suspension
- Published
Published a request to reissue Rakuten Ichiba API license keys
As a preventive measure, stores were asked to reissue their API license keys after deletion (later corrected).
- Action
Rakuten Ichiba integration temporarily suspended following a notice from Rakuten
Rakuten asked that API license keys not be used until safety is fully ensured. We corrected our guidance and asked stores to hold off on reissuing keys.
Correction history
- Oct 17, 2026 00:28 JSTRequest to reissue Rakuten Ichiba API license keys (published around 22:10, October 16)
Following a notice from Rakuten Ichiba, we corrected our guidance to ask stores to hold off on reissuing API license keys, and temporarily suspended the integration.