EPARK PeakManager

Summary

A reservation platform operated by EPARK PeakManager experienced a data breach exposing approximately 33 million customer records. The incident was part of a broader wave of cyberattacks against Japanese organizations that spanned multiple industries and involved ransomware, stolen credentials, and exploited web-facing systems, contributing to widespread operational disruption and downstream effects on organizations relying on the affected services.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

During the third quarter of 2026, reports of cyberattacks targeting organizations in Japan increased by 48 percent compared with the second quarter, rising from 621 to 918 incidents according to the Recorded Future Intelligence Platform. Among the significant breaches disclosed during that period was an incident involving the EPARK PeakManager reservation platform, from which roughly 33 million records were leaked in July. The platform functioned as a reservation system. Breach disclosures from Japanese organizations in Q3 highlighted operational disruption, exposure of sensitive data, and phishing-enabled account compromise as recurring risks. Victim organizations spanned the retail, rail, logistics, media, education, and software industries, with intrusions involving ransomware, stolen cloud credentials, and exploited web-facing systems.

The scale of the attacks meant that single incidents routinely affected millions of user records or organizations downstream that relied on the targeted services. The EPARK PeakManager leak was cited alongside other major incidents, including the compromise of 6.6 million accounts from Times Car in September. Later in the year, on October 7, a ransomware incident affected IDCFrontier, a Japanese cloud provider, disrupting 495 companies and local governments. Almost a week later, on October 13, a data breach affected the Japanese software company Sourcenext, in which an unidentified third party misused the company's member information retrieval API to compromise 22,519,960 customer records. New incident-reporting requirements under Japan's Active Cyber Defense law took effect on October 1, 2026, imposing mandatory reporting obligations on designated critical infrastructure operators.

Sources

Sources available to members: 1 source.