Science & Tech · Cybersecurity · 9 hrs ago
Rakuten Mobile says payment certificates may have been viewed by outsiders
Rakuten Mobile said outsiders may have been able to view payment certificates downloaded from its my Rakuten Mobile service in Japan.
The certificates contain customers’ names, addresses, phone numbers, data use, charges and billing details.
The risk involved someone using a program and unusual steps that are not part of normal service use.
The company fixed the system on June 20, 2026, after finding the flaw in a security test.
It has found no evidence that anyone viewed the certificates or that related harm occurred, and says financial details and call histories were not included.
Current and former customers were included in the company’s email notifications, and the company has reported the matter to the relevant authorities.
It says it will strengthen regular system checks and other safeguards to help prevent a repeat.
Rakuten Mobile said payment certificates downloadable from its my Rakuten Mobile service may have been viewable by outsiders.
The certificates could include names, addresses, phone numbers, data usage, charges and billing details.
The company said it has not confirmed any third-party viewing or related harm.
It completed system fixes by June 20, 2026, and reported the matter to the relevant authorities.
Rakuten Mobile notified current and former customers by email, according to one report.
- Who
- Rakuten Mobile and users of its my Rakuten Mobile service, including former customers.
- What
- A system vulnerability may have allowed outsiders to view downloadable payment certificates. The company has not confirmed any actual viewing.
- When
- Rakuten Mobile announced the issue on October 13, 2026. One report says the vulnerability was found in June; another says the discovery date was not disclosed.
- Where
- The my Rakuten Mobile service.
- Why
- A person using a specific program and unusual operations could potentially view another user's payment certificate.
This story does not have two clearly opposing sides.
Rakuten Mobile's security testing found the vulnerability, according to one report; another report said the discovery date was not disclosed.
Rakuten Mobile completed system fixes.
Rakuten Mobile announced the issue and notified users by email, including former customers.
- Affected service
- my Rakuten Mobile
- Potentially exposed information
- Names, addresses, phone numbers, data usage, charges and billing details
- Information not included
- Credit card and other financial information, or call histories
- System fix completed
- June 20, 2026
- Announcement date
- October 13, 2026
What people are saying
We will strive to prevent recurrence through regular system inspections and stronger checking systems, and work to further improve our services.
Sources
Related news
Ivanti patches VPN flaws exploited to gain root access
Cyberattack disrupts refrigeration at hundreds of French supermarkets
US arrests two Americans in alleged North Korean laptop farm scheme
Cyberattack disrupts IT systems at three TFG London fashion brands
Canadian cybersecurity executive arrested in ShinyHunters investigation
Norway fines Microsoft-owned Xandr $9.6 million over Grindr data sharing
Ledger links CryptoBilis wallet implants to confirmed crypto thefts
GitLab fixes maximum-severity flaw that could let attackers run server code
DDoS attack disrupts Canonical websites for more than four hours
Ahold Delhaize takes systems offline after cybersecurity incident
GitHub adds 48-hour limit after npm publishing flaw exposed 1,500 packages
