Prestige confirms roadside-assistance data theft involving up to 5.5 million records

Prestige International confirms that an intruder accessed its group business system and removed customer information handled by subsidiary Prestige Core Solution (PCS). The affected system receives and arranges roadside assistance for client companies. This is confirmed exfiltration, rather than merely an allegation of an exposed server.

The maximum is roughly 5.5 million records including duplicates; the number of unique individuals remains under review. Fields include names, addresses, telephone numbers, email addresses, vehicle registration/chassis information, accident or breakdown intake information, and some bank-account information. Some partner-company information may also be included and is being checked. No credit-card leakage or resulting secondary misuse had been confirmed as of November 2; the November 6 confirmation below supersedes that card-data assessment.

Misused credentials were invalidated after detection on October 29. Access continued, prompting the October 30 shutdown. The company is investigating cause and scope with external specialists; reporting to Japan’s Personal Information Protection Commission and consultation with police are underway. It plans system changes and stronger monitoring, and will coordinate affected-customer notices with client companies. No initial-access vulnerability, final unique-person count or restoration deadline is disclosed. Roadside-assistance work continues through alternative operations despite the affected system being stopped. The confirmed mass disclosure supports L4.

November 6 scope correction: The November 2 notice had not confirmed credit-card leakage. The second report now confirms three cases of card-number leakage, recorded in some call-intake records and included in exfiltrated information. This does not establish three unique people, a new additive incident total, or exposure of card security codes. Issuers have been notified; customer contact and protective measures will be coordinated with them. The company still reports no confirmed secondary misuse and continues roadside assistance through alternative operations while the affected system is suspended.

November 6 customer notices. BMW Japan and BMW Japan Finance identify PCS as the contractor for their affected roadside-assistance and related operations. Their notice lists possible fields for the supplier’s system overall. The fields and count specific to BMW customers remain under investigation. BMW Japan says it reported to Japan’s Personal Information Protection Commission on November 2. Zurich Japan confirms its customer data was included and limits the affected scope to roadside-assistance cases outsourced to PCS through January 31, 2026. Neither customer notice gives a separate count. BMW’s notice repeats the supplier’s November 2 assessment on cards, when no card leakage had been confirmed. Prestige’s second report confirms three cases across the supplier incident and does not identify the client companies involved.