The Breach
Tokyo Himitsu Kichi ("Tokyo Secret Base") is one of Japan's best-known chains of escort services for female customers. It has confirmed that a third party broke into the reservation-management system its stores share and that customers' personal information leaked.
The admission came in a notice titled "Notice Regarding the Leak of Personal Information." It was posted at 1:50 p.m. on October 30, 2026, on the website of the group's Kobe store, according to Security Taisaku Lab, a Japanese cybersecurity news site that first reported the attack.
The notice said the confirmed intrusion route had been blocked. It said the group had checked with the system's management company that no further reservation data could be taken that way. The group also said it was working with "relevant authorities and specialist firms" to find the cause and tighten security.
The notice did not say what kinds of data leaked, how many people were affected, when the breach happened, or whether the material the attacker posted is genuine, Security Taisaku Lab reported.
The Attacker's Claims
The breach came to light through a forum post dated October 26. It was signed by an account calling itself "Mumei no Kai" ("The Nameless Society"). Shueisha Online reported that it is unclear whether the account is one person or a group.
In the post, the attacker named the chain and its operating company. It claimed to hold data covering:
- 58,573 members, meaning customers
- 5,331 workers
- 631,481 order and usage records
- 96 stores
Security Taisaku Lab said the post included a sample of 15 member entries with registered names, phone numbers, addresses, visit counts and total spending. Some fields were masked and others were not. The post also contained material that, the attacker said, linked workers' photos and stage names to their real names, bank accounts and work histories.
The attacker said it had contacted the operator several times since October 13. It said it demanded payment in cryptocurrency and that no deal was reached by an October 25 deadline, according to Security Taisaku Lab.
In a follow-up on October 31, the attacker made a further claim. By cross-referencing the stolen records with other leaked databases, it said, it had matched about 2,700 customers to their real names and about 1,400 to home addresses down to the street number. It also said it would release customer data in stages. The attacker said its demand was aimed at the company, not at individual customers.
None of these figures has been independently verified. Security Taisaku Lab said the sample data exists, but the authenticity of the full dataset, the intrusion route and the real scope of the damage remain unconfirmed. Shueisha Online also stressed that the numbers are the attacker's claims, not confirmed victim counts.
Why It Matters
Japan's market for women's escort services, known as joseifūzoku, has grown quickly over the past decade. Most of these businesses operate as "delivery" services, in which a male therapist visits a client's home or hotel. They are registered under the Businesses Affecting Public Morals Regulation Act (fūei-hō), the law that licenses Japan's adult-entertainment trade.
Many customers sign up under a nickname or a separate phone number. They believe that keeps their identity safe. Experts quoted in both outlets warned that it may not.
The Security Taisaku Lab writer who broke the story told Shueisha Online that if the stolen records share details with data from other breaches, users "could have their identities inferred." Reservation dates, locations and customer-service notes could be matched against customer lists leaked from online retailers, the writer said.
Shueisha Online interviewed women who use such services. They described their fear of exposure to family members, partners and employers. The outlet said it contacted the chain's main store, which promised to call back but had not done so by publication.
Security Taisaku Lab warned of possible secondary harm. It listed sexual extortion, threats to tell families or employers, and stalking or burglary using leaked addresses. It said blocking the intrusion route does nothing to recover data that has already left the company.
The site advised affected users to:
- treat unexpected calls and messages with suspicion
- consider changing their phone numbers
- contact the police consultation line, #9110, if they are threatened
Neither outlet reported that the operator had filed a police report or notified Japan's Personal Information Protection Commission. Neither reported any arrest in connection with the attack.
Industry Fallout
After Security Taisaku Lab published its first report on October 29, other women's escort shops and independent therapists began posting statements on how they handle personal data, Shueisha Online reported. Some were unconnected to the chain.
The breach is one of the largest reported data incidents in Japan's adult-entertainment sector. In this business, a customer's visit history is among the most sensitive information a company can hold.
Sources: Shueisha Online, November 3, 2026 (via Yahoo! News Japan), which reported the incident without naming the chain; Security Taisaku Lab (rocket-boys.co.jp), reports dated October 29 and October 31, 2026, updated November 1, which named the chain and cited the operator's October 30 notice posted on its Kobe store's website. All figures for members, workers, records and identified customers come from the attacker and have not been verified. This site has not seen the leaked data and does not reproduce any personal information. Glossary: fūei-hō = Businesses Affecting Public Morals Regulation Act; joseifūzoku = sex-industry services for female customers.