Breach · · 3 min read
Ticketing service GETTIIS says about 318,000 member records were taken in one night
A flaw in a related app let someone copy GETTIIS member data on October 18. What was in it, what wasn’t, and the two steps that matter most.
GETTIIS is a Japanese ticketing service run by Link Station, a company based in Aomori. On October 19 and 20, 2026, it published two notices saying that someone had taken GETTIIS member information during a few hours on October 18. If you’ve bought concert, theatre or event tickets through GETTIIS, here’s what the company says was taken and what to do.
What happened
According to Link Station’s second report, the company noticed suspicious activity on October 18 and started investigating. It found that between about midnight and 7 a.m. that day, a third party exploited a vulnerability in Gettii-Lite, another service the company runs, and used it to obtain GETTIIS member information from a server.
The company lists these records:
- member IDs: 317,971
- hashed passwords: 311,451
- email addresses: 311,426
- names: 309,759
- phone numbers: 309,668
- credit card-related information: 29,515
- gender: 5,900
- dates of birth: 5,192
- postal codes: 489
These are counts per field, not a count of people, the company notes in its Japanese notice.
What the card data is, and isn’t
“Credit card-related information” sounds alarming, so it’s worth being precise. The Japanese notice says this is the first four and last four digits of the card number, the cardholder name and the expiry date, stored encrypted. GETTIIS says it doesn’t store full card numbers or security codes, and that the leaked information alone can’t be used to make a card payment. Aomori Broadcasting’s report (in Japanese) carries the same details.
Passwords were stored hashed, not in plain text. Hashing makes passwords hard to recover, but how hard depends on the method and on how strong the password was, which the notice doesn’t say. That’s why the company is asking everyone to change it.
Link Station says it has replaced the affected server, fixed the vulnerability, emailed affected members, reported to the relevant authorities and is consulting with police.
What this means for you
For most members, the realistic risk isn’t a fraudulent card charge. It’s that a name, email address and phone number tied to a ticketing account make convincing bait. Expect messages about “problems with your tickets,” refunds or this breach.
If you used the same password anywhere else, that matters more than anything else in this story.
What you can do
- Change your GETTIIS password. The company has a page explaining how.
- Change that password everywhere you reused it, and give each account its own. A password manager makes this painless, and passkeys remove the problem where a site supports them.
- Check what was stored about you. The notice explains how: log in, open “Account information” from the menu and look at your user information and whether a card is registered.
- Treat ticket and refund messages with care. GETTIIS says it will never ask for your password, card number or PIN by email, phone or any other way. Go to the site yourself rather than following a link.
- Keep an eye on your card statement. The company says the card data can’t be used for payments on its own. A glance at your statement costs nothing, and your card issuer can help if you see anything odd.
Questions go to Link Station’s personal information desk at pms@linkst.jp.
How Frame helps
Frame keeps a catalog of known breaches and lets you add the ones you know you were part of to a verified email. Frame shows what each one exposed, gives you a short checklist (change the password, turn on two-factor), and counts it in your exposure report. Automatic breach lookups aren’t live yet. We never collect or store the leaked records themselves.
Sources
- Link Station, Notice and Apology Regarding the GETTIIS Member Data Breach Due to Unauthorized Access (Second Report), October 20, 2026
- Link Station, 不正アクセスによるGETTIIS会員情報の漏えいに関するお詫びとお知らせ（第二報） (in Japanese), October 20, 2026
- Link Station, How to change your password, October 2026
- Aomori Broadcasting (NNN), チケット販売サービス「GETTIIS」でクレジットカード関連情報含む会員情報の約31万件が漏えい (in Japanese), October 22, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.