CAMPFIRE confirms personal data of up to 225,846 unique users may have been exposed

The Japanese crowdfunding platform CAMPFIRE said on 24 April 2026 that personal data may have leaked from part of the systems that manage customer information, affecting 225,846 unique users, and that credit-card data is not included ^[1][2]. In its 2 June investigation report the company said an employee-issued GitHub credential was unintentionally uploaded to a server used for personal development and then misused, leading to unauthorized access to part of an internal cloud administration area; forensics found no trace that files containing personal data were transferred out, but because some areas had no logs the company could not rule out that data had been viewed, so it still treats the information as at risk of leakage ^[2]. The company warns people to beware of scams impersonating CAMPFIRE to ask for PINs or passwords, says it will never ask for a PIN by phone or email, asks recipients not to open unexpected mail or click links or attachments, and recommends checking bank statements and changing passwords if the same email and password are used on other services ^[1].

Industries mainly affected: Finance