Seven breaches, all disclosed between 13 and 18 October, and the pattern was identity files, not passwords in most cases. Loyalty signups, checkout platforms, and delivery apps hold the exact fields impersonators need. This is AliasFleet's weekly email privacy roundup. One forwarding address per site means a leak names its source. You can kill the exposed address while your real inbox stays clean.
ShopServe hit 23.35 million people, with no per-shop list
About 23,356,000 people across 7,858 shops. That is E-store's final figure for the ShopServe breach, published 16 October. Attackers pushed stored records out between 21 May and 1 August, through a flaw in the application. Names, addresses, phones, email addresses, and partial card data (first 6 and last 4 digits, plus expiry) sit in the file for about 2,096,900 people. No full card numbers. No security codes. Your email sat in the platform behind the shop. No per-shop list exists, so no notice can tell you which shop your data came through. Read the full account in our ShopServe article, and E-store's own final report.
SourceNext lost 22.5 million records through one API
Up to 22,519,960 member records at risk. SourceNext disclosed on 15 October that attackers abused a member-data API, starting around 10:00 on 9 October, until containment at 13:36 on 13 October. The set includes email addresses and passwords. Nikkei reports the decryption program was also hacked, though SourceNext itself has not described the encryption. No card data was on the affected system. Four days passed before containment, and that gap set the size of this breach. If you registered with SourceNext, treat your password as exposed. Full details in our SourceNext article.
Burger King Japan exposed 11.18 million loyalty records
Attackers reached Burger King Japan's app member system between 2 and 7 October. The company disclosed it on 15 October. About 11.18 million member records were exposed. Inside the file: names, email addresses, phone numbers, dates of birth, prefecture, gender, and member IDs. Card numbers did not leak, because the company does not hold them. A password leak has not been confirmed so far, though that finding is provisional. Call it a loyalty signup if you like. It is an identity file dressed as coupons. The kana name field means a scammer working from this file knows how to pronounce your name. Full details in our Burger King Japan article.
Gin no Sara: up to 6.5 million records, nothing confirmed out
Up to about 6.5 million records across Gin no Sara, Kamatora, and Sushi Joto may have leaked. RideOn Express disclosed that on 13 October. Names, addresses, phones, emails, dates of birth, password hashes, and order histories make up the at-risk set. Card data is not in scope. The company has not confirmed any data actually left its systems or was misused. Do not read "may have leaked" as a reason to wait. Order history lets a forgery quote your real orders. Full details in our Gin no Sara article.
Bookoff confirmed 6.38 million people, including members who left
Confirmed, this time. Bookoff's second disclosure on 13 October turned "may have leaked" into confirmed: 6,427,735 records sent out. Those records cover 6,383,279 people by email dedup, including 212,371 withdrawn members. Card data is not in the exposed list. Quitting the service did not remove those members' records from the breached system. The genuine notification going out from 15 October carries no password-reset link. Any Bookoff mail with one is a forgery. Full details in our Bookoff follow-up.
A genuine notification and a forgery now look identical. Type the company's address yourself. Or open the company's own app and check there. No link in breach mail is worth clicking.
Yamato pay-later: 5.31 million records, mostly not by email
Attackers took about 5.31 million records from Yamato Transport's Kuroneko pay-later service. The company confirmed it on 16 October. The haul breaks down as 5.26 million purchaser records, 50,000 delivery-destination records, and 4,100 merchant records, with eight years of purchase history. Email addresses appear in only about 490,000 purchaser records, around 9 percent. Most victims will be reached by SMS, calls, or post, not email. No card data or passwords were taken. A message quoting your real shop, your real item, and your real delivery address is working from this file. It is proving nothing except that the sender is working from this file. Full details in our Yamato article.
Nikkei suffered a third breach in twelve days
Stolen credentials opened the door at Nikkei. Attackers used them to reach a cloud service used for system development. They got in during the early hours of 7 October and stayed until the morning. Nikkei disclosed it on 16 October. About 1.83 million records were caught up in it. About 150,000 carried personal details. About 120,000 carried an email address. This is a separate incident from the 4 October disclosure, not a recount of it. The 120,000 emails are the usable slice. One stolen credential keeps reaching a store of personal data. Full details in our Nikkei article.
What to do with this week's leaks
Across all seven breaches, no full card numbers leaked. In most of them, passwords survived too. The impersonation kit leaked instead: your name, your address, your phone, your email, and in Yamato's case, what you bought and where it went. The defences stay the same, because the attack stays the same. Do not click links in breach mail. Verify through the company's own site or app, typed by you. Change reused passwords. Check Have I Been Pwned once each incident is listed. Give each site its own forwarding address. Then the next leak names its source, and the exposed address can be killed while your real inbox stays clean.
