2rinkan confirms API abuse exposed data of about 3.18 million members

2rinkan Yellow Hat confirmed on its website that its member server was accessed without authorization, and that an investigation found attackers had abused the app's API to obtain data on 3,179,454 points, mobile and app members ^[1]. The data include names, addresses, phone numbers, dates of birth, sex, email addresses, membership numbers, app user IDs and passwords, point balances and vehicle information; the company says credit-card data were not stored in-house and did not leak. It first disclosed the incident on 23 April 2026 and, in a 19 June final report, revised the count down from a second-report maximum of 3,455,754 ^[1]. The company asks people not to open links in, or reply to, unexpected emails or messages; the app is due to resume around October 2026, when all members will be signed out and must set a new password. Questions can be directed to 0120-853-049 on weekdays 10:00–19:00 ^[1].

Industries mainly affected: Retail

1. Do not open links in, or reply to, unexpected emails or messages ^[1].