ITmedia reports that the prefectures and designated cities that issue Takarakuji announced on November 11 that a third party had logged into some member accounts on the suspended Takarakuji official site and may have viewed member data including names, addresses, phone numbers, email addresses, ticket purchase and winning history, the bank name and first four digits of payout accounts, and the last four digits of credit card numbers [1][2]. The issuers say they have found no fraudulent ticket purchases or payouts via altered account details and no sign of server or database intrusion or member data leakage; the number affected was not disclosed and affected members will be emailed, while the site and app were suspended from November 5 and by November 6 respectively [1][2]. The issuers say the incident may be credential stuffing using email addresses and passwords obtained elsewhere, so users who reuse their Takarakuji email and password on other services should change those passwords and avoid entering credentials on suspicious emails or sites [1][2].
MediumActiveOfficially confirmed
Japan lottery site suspended as third parties log into member accounts, possibly viewing personal and purchase data
1 min read
- Disclosed
- Nov 5, 2026
- Published
- Nov 12, 2026
- Last updated
- Nov 12, 2026
- CVSS basis
- Our assessment
- Technology
- E-commerce platform
- Attack vector
- Unknown
- Actor type
- Unknown
- Motivation
- Unknown
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Government
What to do nowOur advice
Timeline
Technical details
Remediation
References
Official / primary1
- [2]全国都道府県及び全指定都市(宝くじ)2026-11-11Accessed 2026-11-12Snapshot 2026-11-12 sha256 3d0c525d34a2
“調査の結果、宝くじ公式サイトにおいて、一部のお客さまについて第三者による不正ログインがあり、お客さまのパスワードが意図せず変更される事象に加え、当該第三者により会員情報(※)が閲覧された可能性があることを確認いたしました。”
Media1
- [1]ITmedia NEWS2026-11-12Accessed 2026-11-12Snapshot 2026-11-12 sha256 d4700147abbf
“宝くじを販売する全国の都道府県と指定都市は11月11日、停止中の「宝くじ公式サイト」で第三者が一部会員のアカウントに不正にログインし、購入したくじの当落を含む会員情報を閲覧した可能性があると発表した。”
Expert help
Still not sure whether this affects you?
Tell us about your environment. We'll check it against this advisory, assess the risk, and give you concrete patch and monitoring steps.
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.