SONICWIRE: Notice Regarding Potential Leakage of Customer Information Due to Unauthorized Access

[MagicalMiku]

[Important] Notice Regarding Potential Leakage of Customer Information Due to Unauthorized Access to "SONICWIRE" and "D2R" October 20, 2024 Please note that the date for the resumption of both services has not yet been determined. We sincerely apologize for the significant inconvenience and concern this has caused.
Additionally, as part of our investigation, we have suspended services for the SONICWIRE-related e-commerce store ( https://ec.crypton.co.jp ) that we operate.

press release(translated):
https://www.crypton.co.jp/cfm/news/2026/10/20info
Notice Regarding Potential Leakage of Customer Information Due to Unauthorized Access
We have discovered that a third party gained unauthorized access to the services we operate, "SONICWIRE" and "D2R." It is possible that the personal information of registered users of these services has been accessed or acquired.
We deeply apologize for the significant trouble and concern this has caused our customers and all other affected parties.

We have currently suspended the operation of these services while we investigate the cause and the scope of the impact. We are also implementing measures to prevent any recurrence.
The facts known at this time and our current response are outlined below.

Details
1. Background
On Saturday, October 17, 2026, at approximately 20:00, we identified potential unauthorized access to "SONICWIRE" and "D2R." We immediately began assessing the situation and took emergency actions, such as disabling compromised accounts and restricting IP addresses for our internal domains. By approximately 23:39 that same day, we completed the suspension of the servers for the affected services to prevent further damage.

2. Customer Information Potentially Compromised
The following information may have been accessed or acquired by a third party. We are currently conducting an ongoing, detailed investigation.

[SONICWIRE Members (including newsletter subscribers)] – Up to approximately 420,000 records
Full name, email address, hashed password (hash value only), address (if provided for the issuance of invoices or quotes), and system-specific identification data (such as registration date, last login date, etc.)

[D2R Registered Stores] – We are contacting the affected stores individually. Name, store name, login ID, and hashed password (hash value only).

* The above represents the full scope of data that may have been compromised, as identified by our company as of October 19, 2026. The specific data points affected may vary depending on the information registered by each individual user.

* The "SONICWIRE" and "D2R" systems do not store customer credit card information, and at this time, there is no evidence that such information has been compromised. We are continuing our investigation to determine whether there has been any impact related to past payment information or other data.

3. Request to Our Customers
There is a possibility that the potentially compromised information could be misused, leading to the receipt of suspicious emails (phishing emails) that appear to come from our company or our affiliates. To prevent secondary harm, we kindly ask for your cooperation with the following:

■ Changing Your Account Password
To protect your account, we have invalidated all existing passwords. We apologize for the inconvenience, but please set a new password the next time you log in after the service is restored.

■ If You Use the Same Password for Other Services
While the potentially compromised passwords have been "hashed"—a process that makes it extremely difficult to recover the original password—there remains a theoretical risk that a third party could recover the password and attempt to use the same email address and password combination to access other services. If you use the same password for other services, please change those passwords promptly to prevent unauthorized access.

■ Beware of Suspicious Emails and Communications
You may receive emails or other communications that appear to be from our company or our affiliates. Please exercise extreme caution: do not open URLs or attachments contained in suspicious emails or SMS messages, and do not enter or provide any personal information or passwords.

* Affected customers will receive an email at their registered address containing an apology and further instructions regarding this matter.

4. Our Response and Future Actions
Following the detection of unauthorized access, we utilized "Mythos" to assess the situation and promptly implemented emergency measures, including the suspension of the "SONICWIRE" and "D2R" services. We have also strengthened security measures across all other services we operate and continue to maintain close monitoring; no further unauthorized access has been detected since our initial response. Furthermore, we notified the police on Sunday, October 18, and submitted a report to the Personal Information Protection Commission today, Monday, October 19.

As of October 19, 2026, the date for the resumption of these services remains undecided. Additionally, as part of our investigation, we have suspended the SONICWIRE-related e-commerce store ( https://ec.crypton.co.jp/ ) that we operate. Moving forward, we will continue a thorough investigation—including engaging external specialized organizations—and will undertake a comprehensive review of our system security, monitoring protocols, and information management framework to ensure that such an incident does not recur.

Should any new information arise that warrants public disclosure, or once a timeline for the resumption of services is established, we will provide updates promptly via this news release.

We once again offer our deepest apologies for the significant inconvenience and concern this has caused our customers and all other affected parties. We take this matter with the utmost seriousness and are committed, as an entire organization, to preventing a recurrence and restoring your trust.

Crypton Future Media, Inc.

[Inquiry contact for users regarding this matter]
https://www.crypton.co.jp/cfm/inquiry-general

 

[Palamon]

why do i feel like ai had something to do with this hack

 

[MagicalMiku]

Usually this type of hack is made with some malware (sent as attachment in an email message to a staff phone or computer) + SIM phone number cloning to receive any SMS security code. In the past years, even big companies like Microsoft and Yahoo got their email services hacked.
420.000 records is a lot of data, so is not surprising that some hacking group wanted that. They might ask some money to Crypton or sell it on the dark web, who knows.
As I wrote in the other thread, these issues can happen anytime on any website, so it's always better to:
1) use a primary email address only for bank, phone service;
2) use a secondary email address (different password) for any registration to forums, shops, steam.. For the forums and shops you don't use often, it's ok to have same password, but for all the shops where you buy many times, always make a different password, and if you don't remember them, use a password manager.
3) when possible, don't use a credit card, instead use a charge debit card not linked to your bank.

 

[Bookworm2]

Oh, I just realized I forgot to copy down my V6 lite serial... oops. Well, at least they notice the hack in time to do something about it? It's good that they don't store credit/debit card information, though.

 

[Grzesiek11]

Usually this type of hack is made with some malware (sent as attachment in an email message to a staff phone or computer) + SIM phone number cloning to receive any SMS security code.

I mean, that's possible, but we don't know much, it could really be anything. It could be phishing like you say, but it could have also been a badly secured entry point, like a database exposed to the internet with a weak password, maybe a well known vulnerability they forgot to patch, or it could be a malicious employee. Honestly phishing seems less likely to me than most other options, because employees with direct database access, which would be most likely necessary to get password hashes, are also likely to be more aware of phishing techniques. Though it might also have been a combination of phishing and weak internal security? An employee with a low access level gets phished, allowing access to the internal network, where an unsecured database or API allows the attackers to get the data. We can only theorize.

While blaming "AI" for a lot of things that are wrong with the world is often justified in my opinion, breaches happened on the regular before LLMs as well. They have definitely lowered attack costs, but honestly, this stuff is always bound to happen.

1) use a primary email address only for bank, phone service;
2) use a secondary email address (different password) for any registration to forums, shops, steam.. For the forums and shops you don't use often, it's ok to have same password, but for all the shops where you buy many times, always make a different password, and if you don't remember them, use a password manager.
3) when possible, don't use a credit card, instead use a charge debit card not linked to your bank.

I do not think the first recommendation is that important, because e-mail addresses, even private ones, should generally be treated as mostly public information. You can't do much with an e-mail leak, other than trying to phish the user, or send spam (or both). The other two I mostly agree with.

I would go a step further and say that you should (mostly) never use the same or even similar password twice, and should use a randomly generated password stored in a password manager for everything (except your computer login password and your password manager password).

My recommendations, which are probably more trustworthy than your average YouTuber's, as they're not sponsored, are Best Password Manager for Business, Enterprise & Personal | Bitwarden | Bitwarden if you want convenience, or KeePassXC Password Manager if you want control. Both are very secure, as long as your primary password is secure (and mostly even if it isn't that secure, but let's not entertain this option).

As to secure passwords, I'll cite the classic:

(I would recommend 5-6 words, rather than 4, since computers are better at cracking passwords nowadays. Password managers can also generate random passphrases like this, so you can use them for passwords you need to remember, like well, your password manager password.)

Credit or debit cards are generally kinda an issue, because them leaking can be a big problem, but it's not that bad considering most sites won't store them directly and instead use a "trusted" payment processor. Payment processors can get hacked too, it's just less likely as they definitely care about security more than your average site. Thankfully, most banks nowadays (well, at least in Poland) require authentication for nontrivial online payments.

You can use a third party virtual payment card service like MagicalMiku says, but if you don't (they cost money to use, and also, they will have your real payment information, and they might leak it too, so it's not foolproof), it's probably not as bad as you might think. Just remember that your data can leak and be vigilant.

Name, store name, login ID, and hashed password (hash value only).

I wonder what algorithm they used for hashes. Too bad they didn't disclose that. Because...

While the potentially compromised passwords have been "hashed"—a process that makes it extremely difficult to recover the original password—there remains a theoretical risk that a third party could recover the password and attempt to use the same email address and password combination to access other services. If you use the same password for other services, please change those passwords promptly to prevent unauthorized access.

I think they're downplaying the risk here kinda. For a targeted attack (on a specific person, rather than a mass attack on all users that got their data stolen), a password hash can very well be enough. With weak algorithms like SHA-256 (which is why I wonder what algorithm they use), it's even trivial to mass recover simple passwords.

Other than that, I think they handled the situation well. Affected users were e-mailed, the public notification is solid, passwords were reset. Certainly handled it better than some other cough Internet Archive cough organizations.