World Co., Ltd. disclosed on October 30, 2026 that an outside party accessed the business server of its consolidated subsidiary Tin Pan Alley on October 17, entered it and extracted data, so part of the member information stored there may have leaked. The data possibly leaked is names, addresses, phone numbers, dates of birth, gender and email addresses, about 1.2 million records in total, with the affected members and counts still being confirmed. Leaks of credit card or other payment data and of face data have not been confirmed. The company isolated the server on October 28, blocked the route that day and stopped some related internal business systems, and it has consulted the police and reported to the Personal Information Protection Commission.
World (subsidiary Tin Pan Alley)Member information server
3MediumPossibleAnnounced Checked against sources (2026-10-30)
An intruder entered a business server of subsidiary Tin Pan Alley on October 17 and extracted data. About 1.2 million member records may have leaked; details are under review.
- Cause
- Unauthorized access
- Occurred
- 2026-10-17
- Sector
- Retail & e-commerce
- Operational impact
- Some services stopped
Data involved
| Data | Status | Count | Group | Evidence |
|---|---|---|---|---|
| Name | Possible leak | Not disclosed | ティンパンアレイの会員 | Source(opens in a new tab) |
| Postal address | Possible leak | Not disclosed | ティンパンアレイの会員 | Source(opens in a new tab) |
| Phone number | Possible leak | Not disclosed | ティンパンアレイの会員 | Source(opens in a new tab) |
| Date of birth | Possible leak | Not disclosed | ティンパンアレイの会員 | Source(opens in a new tab) |
| Email address | Possible leak | Not disclosed | ティンパンアレイの会員 | Source(opens in a new tab) |
| Other | Possible leak | Not disclosed | ティンパンアレイの会員 | Source(opens in a new tab) |
| Other | Possible leak | about 1,200,000 records | ティンパンアレイの会員 | Source(opens in a new tab) |
Counts are the figures the organization announced. Because the same person may be counted more than once, we do not add the rows together.
What users should do
- Watch for emails and texts pretending to be the company
General steps based on the type of data involved. Check the organization’s notice or help line to see whether you are affected.