hiho-mypage-2026 · Disclosed 2026-10-08
hi-ho: unauthorized customer login using information obtained through solicitation
The company confirmed impersonation using solicited information, reported 38,509 affected contracts rather than people, and ended login using phone number, postal code and birth date.
Outcome: Confirmed breach
Entry path and evidence
- Reported fact
Third parties obtained login information through calls and impersonated customers; other acquisition paths may exist.
[s1]§2 発生した事象 - Reported fact
The 38,509 count represents contracts, counting multiple contracts of one customer separately.
[s1]§4 不正ログインの件数 - Reported fact
System intrusion, vulnerability exploitation and secondary harm were not established at publication.
[s1]§7 システムへの侵入および二次被害の状況
Timeline
Disclosed unauthorized logins and responses. [s1]
Reported response
- Reported fact
Blocked suspicious sources, removed personal-detail login and began moving to stronger authentication.
[s1]§5 本件の対応
Cause and mitigation hypotheses
Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.
Evidence relevant to prevention
Operational controls to inspect
Inspect authentication based on obtainable personal details, MFA and access logs; prior MFA coverage is undisclosed.
Editorial assessment; not a determination of liability. [s1]
Unknowns and AI involvement
The reviewed primary sources do not establish attacker use of AI.
Event and detection dates, other acquisition paths and full viewing scope are undisclosed; arrest-report counts are separate.
Sources
[s1] ハイホー · Primary source
お客様情報への第三者によるアクセスが確認された事案に関するご報告 ↗Published 2026-10-08 · Reviewed 2026-10-12