Notice and Apology Regarding the GETTIIS Member Data Breach Due to Unauthorized Access(Second Report)

Important

Notice and Apology Regarding the GETTIIS Member Data Breach Due to Unauthorized Access(Second Report)

2026/10/20

Link Station Co., Ltd.

We have confirmed that a third party gained unauthorized access to a server used for "Gettii-Lite," a service operated by our company, and obtained member information belonging to "GETTIIS," which is managed by our company.

"Gettii-Lite" is a service for event organizers to register events, while "GETTIIS" is a ticket purchasing service for customers.

Please note that "Gettii" and "Gettii-EC" operate in separate system environments from "Gettii-Lite," and no impact on these services has been identified in connection with this incident.

We sincerely apologize for the significant inconvenience and concern this incident has caused our customers and all parties concerned.

Following our initial announcement, we would like to provide an update on the number of records affected and the actions taken,

based on the findings of our subsequent investigation.

Apology and Notice Regarding the Leakage of GETTIIS Member Information Due to Unauthorized Access (… (Published October 19, 2026)

1. Details of the Incident

On October 18, 2026, we detected suspicious activity involving our systems and began an investigation.

Our investigation confirmed that, between approximately 12:00 a.m. and 7:00 a.m. on the same day, a third party exploited a vulnerability in the "Gettii-Lite" application and unlawfully obtained "GETTIIS" member information.

2. Types and Numbers of Information Records Leaked

The information affected by this incident consists of "GETTIIS" member information.

Our investigation has identified the following types and numbers of records that were leaked

Member IDs: 317,971 records
Hashed passwords: 311,451 records
Credit card-related information: 29,515 records
Names: 309,759 records
Gender: 5,900 records
Dates of birth: 5,192 records
Postal codes: 489 records
Phone numbers: 309,668 records
Email addresses: 311,426 records

The figures above represent the number of records for each information category and do not represent the total number of individuals affected.
The credit card-related information consists of encrypted data containing the first four and last four digits of card numbers, cardholder names, and expiration dates.
We do not store complete credit card numbers or card security codes. The information leaked in this incident alone cannot be used to complete credit card transactions.
Passwords were stored in hashed form. Plaintext passwords were not leaked.

As of this announcement, no leakage of information other than the categories listed above has been identified.

■ How to Check Your Registered Information Affected by the IncidentCustomers who have received an individual email notification from us confirming that their information was affected can review their registered information through their GETTIIS My Page.

Log in to GETTIIS.
Select "Account information" from "MENU" in the upper-right corner of the screen.
Review the following sections under the registration information editing menu.

[User information]Member ID, name, phone number, email address, postal code, gender, and date of birth

[Edit credit card information]Whether credit card information is registeredThe information displayed in these sections corresponds to the categories of registered information affected by this incident.Please note that if you changed your registered information after the unauthorized access occurred, your current information may differ from the information registered at the time of the incident.

3. Current Response Status

We have completed the replacement of the affected server and implemented measures to address the vulnerability exploited in the unauthorized access.We have also notified the affected customers individually by email.We have submitted reports to the relevant authorities and will continue to take necessary actions, including consulting with and providing information to the police.

4. Requests to Customers Althoug

Although GETTIIS passwords are stored in hashed form, we ask that you change your password as a precaution to protect your account.For instructions on how to change your GETTIIS password, please refer to the following page:Instructions for Changing Your GETTIIS PasswordIf you use the same password for GETTIIS and other services, please also change your passwords for those services to different, unique passwords.Please remain vigilant against suspicious emails, text messages (SMS), and phone calls that may attempt to exploit this incident.We will never ask you to disclose your password, credit card number, or PIN by email, telephone, or other means.

5. Next Steps

We will continue investigating the cause and scope of this incident and strengthening our security measures to prevent similar incidents from occurring again.Any additional findings or actions required of our customers will be announced on this page or through other appropriate channels.

6. Contact Information

Link Station Co., Ltd. PMS Personal Information Inquiry Desk Email: pms@linkst.jp (Inquiries accepted 24 hours a day; responses will be provided in order.)

Once again, we sincerely apologize for the significant inconvenience and concern this incident has caused our customers and all parties concerned.