Fuji-Q Highland Hit by Credential Stuffing Attack; 159 Member Accounts Accessed

According to Security NEXT, the official Fuji-Q Highland app and CLUB Fuji-Q membership website suffered a password list (credential stuffing) attack between September 4 and 7, 2026 ^[1]. Attackers used email addresses and passwords obtained from external sources to impersonate members and successfully logged into 159 accounts, potentially accessing names, phone numbers, dates of birth, and partial payment card information ^[1]. The company has reset passwords for the accounts confirmed to have been accessed, reported the incident to the Personal Information Protection Commission, and notified affected customers via email ^[1].

Industries mainly affected: Hospitality & food service

The company has reset passwords for the accounts confirmed to have been accessed, reported the incident to the Personal Information Protection Commission, and notified affected customers via email ^[1].