{
  "id": "vpreca-contractor",
  "url": "https://ohshit.app/incidents/vpreca-contractor/",
  "title": "LifeCard confirms V-Preca data theft affecting 69 accounts and restores service",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-10-31",
  "date_is_approximate": false,
  "updated": "2026-11-02",
  "tags": [
    "LifeCard",
    "V-Preca",
    "third party"
  ],
  "ecosystems": [],
  "summary": "LifeCard confirms theft of V-Preca customer data at GMO Payment Gateway affecting 69 accounts, including three with full card credentials. LifeCard says those three accounts were closed on October 31, no misuse was found, and the suspended service has resumed.",
  "splash": "69 V-Preca accounts at contractor GMO Payment Gateway; exposed fields differ by account",
  "wipe": "Follow official V-Preca notices, check service availability and verify unexpected support or payment requests",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify service availability through official support",
      "hint": "Use the November 2 service-resumption notice and official maintenance FAQ, which now reports no maintenance. The earlier registration/login outage and unknown reopening date are superseded. During the pause, shopping remained available except for cards already security-locked; check your own card status through official support."
    },
    {
      "title": "Use the official notice for repayment and support updates",
      "hint": "LifeCard says it is arranging accommodations for postpaid-charge repayments and will announce details. Do not pay an unsolicited account or disclose credentials in response to a supposed restoration message; confirm through your established V-Preca support route."
    },
    {
      "title": "Verify your notification and check card activity",
      "hint": "LifeCard will contact the 69 affected accounts individually. Three accounts with full card credentials were closed on October 31; confirm account-specific instructions with official support, review your V-Preca transactions and report unfamiliar activity. No misuse found at publication does not guarantee that exposed information cannot be abused later."
    }
  ],
  "sources": [
    {
      "name": "LifeCard October31 V-Preca security notice",
      "url": "https://vpc.lifecard.co.jp/news/2026/detail/important-notice2.html",
      "says": "Confirms contractor intrusion, possible data exposure, investigation and partial suspension; scope and counts are not established.",
      "primary": true
    },
    {
      "name": "V-Preca official maintenance FAQ",
      "url": "https://support.vpc.lifecard.co.jp/%E3%82%B7%E3%82%B9%E3%83%86%E3%83%A0%E3%83%A1%E3%83%B3%E3%83%86%E3%83%8A%E3%83%B3%E3%82%B9%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6-663973daed6bb900247d3a1e",
      "says": "The undated FAQ now reports no system maintenance; its earlier registration/login outage notice is superseded by the dated November 2 resumption notice.",
      "primary": true
    },
    {
      "name": "LifeCard November2 V-Preca data-theft follow-up",
      "url": "https://vpc.lifecard.co.jp/vpreca_assets/pdf/important-notice3.pdf",
      "says": "Names GMO Payment Gateway, confirms theft affecting 69 accounts in three field categories, three October31 closures and no confirmed misuse or secondary harm; still describes partial suspension.",
      "primary": true
    },
    {
      "name": "LifeCard November2 V-Preca service-resumption notice",
      "url": "https://vpc.lifecard.co.jp/vpreca_assets/pdf/important-notice4.pdf",
      "says": "Confirms safety checks and necessary measures are complete and the suspended service has resumed; no restoration time is given.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "LifeCard confirms data theft; no misuse found on three fully exposed card accounts.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 31, 2026",
      "title": "LifeCard discloses contractor access and possible customer-data exposure"
    },
    {
      "date": "Oct 31, 2026",
      "title": "LifeCard closes three accounts with fully exposed card credentials",
      "body": "The November 2 follow-up retrospectively confirms the closures; it reports no misuse of those three accounts."
    },
    {
      "date": "Nov 2, 2026",
      "title": "Follow-up confirms theft affecting 69 accounts at GMO Payment Gateway",
      "body": "The table lists 63 accounts with contact details, three with full V-Preca credentials and names, and three with partial card numbers. LifeCard will notify affected customers individually."
    },
    {
      "date": "Nov 2, 2026",
      "title": "Separate notice confirms the suspended service has resumed",
      "body": "LifeCard says required safety checks and measures are complete. This supersedes the partial-suspension status in the same-day investigation follow-up; neither notice gives a restoration time."
    }
  ],
  "body_markdown": "LifeCard initially disclosed possible customer-data exposure and a partial service suspension on October 31. Its November 2 follow-up confirms that data was stolen at its V-Preca contractor, **GMO Payment Gateway**, and lists **69 affected accounts**, not a count of unique people:\n\n- **63 accounts:** names, email addresses, telephone numbers and partial addresses.\n- **3 accounts:** V-Preca numbers, V-Preca security codes, expiry dates and names.\n- **3 accounts:** partial V-Preca numbers.\n\nLifeCard says the three accounts with full card credentials were closed on October 31 and that it had found no misuse of those three accounts or secondary harm from this incident. It will notify affected customers individually. The theft of information is now confirmed; theft of balances is not established.\n\nThe investigation follow-up still describes a partial suspension. A separate November 2 notice confirms that the suspended service **has resumed** after LifeCard completed the checks and measures it considered necessary; the maintenance FAQ now says there is no maintenance. The notices give no restoration time or technical root cause. Restoration does not undo the data exposure or establish that the investigation has concluded.\n\nThe original notice also promised accommodations for postpaid-charge repayments, with details to follow. Verify any account-specific repayment or recovery instructions through official support. Broader LifeCard or payment-network compromise is not established."
}