Notice and Apology Regarding the GETTIIS Member Data Breach Due to Unauthorized Access(Final Report)

Important

Notice and Apology Regarding the GETTIIS Member Data Breach Due to Unauthorized Access(Final Report)

2026/11/4

Link Station Co., Ltd.

Regarding the data breach of GETTIIS member information due to unauthorized access to "Gettii-Lite," which we announced on October 19th and 20th, 2026, we have completed our investigation into the cause and scope of impact. We would like to report the results of the investigation and the status of our response.

Please note that "Gettii" and "Gettii-EC" operate in a different system environment than "Gettii-Lite," and no impact from this issue has been observed.

We once again offer our deepest apologies for the great inconvenience and concern we have caused to our customers and all those involved.

Notice and Apology Regarding the GETTIIS Member Data Breach Due to Unauthorized Access (Initial Report)(Published October 19, 2026)

Notice and Apology Regarding the GETTIIS Member Data Breach Due to Unauthorized Access(Second Report)(Published October 20, 2026)

1. Details and Cause of the Incident

On October 18, 2026, we detected suspicious access to our system and initiated an investigation. As a result, it was discovered that between approximately 12:00 AM and 7:00 AM on the same day, a third party exploited a vulnerability in the "Gettii-Lite" program to illegally obtain "GETTIIS" member information.

This unauthorized access was caused by a third party exploiting a vulnerability in a feature of "Gettii-Lite" to execute malicious programs.

* "Gettii-Lite" is a performance registration service for organizers, while "GETTIIS" is a ticket purchase service for customers.

2. Leaked information and Types and Numbers of Information Records Leaked

The investigation has revealed that the leaked information and the numbers of records remain unchanged from what was reported in the second report. Further investigation did not identify any expansion in the scope of the breach; the affected information and number of records are as follows:

Member IDs: 317,971 records
Number of hashed passwords: 311,451 records
Credit card related information: 29,515 records
Names: 309,759 records
Gender: 5,900 records
Date of birth: 5,192 records
Postal code: 489 records
Phone numbers: 309,668 records
Email addresses: 311,426 records

*The numbers above represent the number of entries for each information item, and do not represent the total number of people.

*The credit card information includes encrypted data of the first four digits and last four digits of the card number, the cardholder's name, and the expiration date. We do not store the complete card number or security code. The information leaked in this instance is not sufficient to process credit card payments.

*Passwords are stored in a hashed state, and plain text passwords have not been leaked.

3. Current status of response

We have completed the replacement of the affected servers and countermeasures against the vulnerabilities exploited in this incident, and we are also conducting inspections of related systems and implementing security measures.

We have contacted affected customers individually via email. We have also reported the incident to the relevant authorities and are taking necessary actions, including providing information to the police.

4. A request to our customers

GETTIIS passwords are stored in hashed form, but for your security, please change your password if you haven't already. Please refer to the instructions in the Second Report for how to change your password.

Additionally, if you are using the same password for GETTIIS on other services, please change those passwords to different ones as well.

Please be aware of any suspicious emails, SMS messages, or phone calls that may be taking advantage of this situation. We will never ask for your password, credit card number, or PIN via email or phone.

5. Completion of the investigation and ongoing security management

We have completed our investigation into the cause and scope of impact of this matter. We take this incident very seriously and will continue to maintain stringent security controls and ongoing monitoring.

If any further findings warrant notification, we will promptly announce them on our website and other channels. We will continue to accept customer inquiries through the contact points listed below.

6. Contact information for inquiries regarding this matter

Link Station Co., Ltd.

Contact: PMS Personal Information Inquiry Desk

Email address: pms@linkst.jp (Reception hours: 24 hours, responses will be made in order)

We sincerely apologize once again for the great inconvenience and concern we have caused to our customers and all those involved.