Apology and Notice Regarding Potential Leakage of Personal Information Due to Unauthorized Access at Consolidated Subsidiary

Details and Impact of Unauthorized Access

On April 20, 2026, an attack using unauthorized programs was detected on the members-only server of 2Rinkan Yellow Hat Co., Ltd., a consolidated subsidiary. Emergency measures were promptly taken to disconnect the network. As a result of the investigation, it was determined that members' personal information may have been leaked externally. The potentially leaked information includes names, addresses, phone numbers, dates of birth, gender, email addresses, member numbers, point balances, app user IDs and passwords, and vehicle information. Credit card information is managed on a separate server and is not considered to have been leaked.

Response Status and Future Measures

Following discovery of the unauthorized access, the affected server was disconnected from external networks, and parts of the 2Rinkan app service were suspended. Investigations and advice are being conducted by external cybersecurity experts to implement measures to prevent recurrence. Reports have been filed with the Personal Information Protection Commission and consultations with police have taken place. Apologies and reminders have been communicated to customers via the website, in stores, and through individual emails. A dedicated inquiry contact desk is being prepared and will be announced once ready. Should material impact on business performance be confirmed, timely disclosure will be made.