Step Golf says member records, face photos and some unencrypted bank details may have leaked

Step Golf, which runs indoor golf schools in Japan under the STEPGOLF name, said in a second report on November 10, 2026 that unauthorised access to its business and reservation systems may have leaked member information, including face photos and some bank-account details stored without encryption. The counts it published are the number of records that may have been involved, not a confirmed headcount. Here’s what the company has disclosed, and what members should do.

Timeline

The company first described the incident in a notice on November 7. In the November 10 update, it says it detected unusual activity on its systems on November 5, 2026, investigated, and found unauthorised access. A review of older logs then showed unauthorised access on October 23 and October 25 as well, and that backup files of databases containing personal information were very likely taken out of the company.

Step Golf says it has reported the matter to Japan’s Personal Information Protection Commission and consulted the police. It has hired an outside security firm, blocked the access, changed credentials, and tightened access controls. Bookings and lessons, it says, are running as usual.

What may have been taken

The November 10 report covers people who, by October 23, 2026, were registered in the company’s systems as free-trial applicants or as current or former members. The possible exposure, by record count, is:

• 114,605 personal records. These may include name, address, date of birth, phone number and email address, as well as contract status, booking and purchase history, lesson notes, and information that Japanese law treats as needing special care. The company has not said which kinds of that last category were stored.
• 107,781 face photos, including photos still kept for some people who had already left.
• 12,707 bank-account records, including the bank name, branch name, account number and account holder name used for direct debit. The company says this information was not stored in encrypted form.

Step Golf is careful about the arithmetic. These figures are the number of registered records that may have leaked, not a confirmed count of records or people actually taken. The same person can appear in more than one category, so the numbers should not be added together as a total of unique people. What was stored also varies from person to person.

Credit card details and identity documents, the company says, were not held in the affected system.

What the company asks members to do

Step Golf says it has not confirmed any follow-on harm so far, but it asks people to be careful of unexpected emails, texts or calls that pretend to be from the company or from a bank. Don’t open unfamiliar links or attachments, and don’t enter PINs or passwords in response.

It notes that an account number and name alone are not enough to withdraw money, but it still asks members to watch for fraud that misuses account details, and to check bank statements for withdrawals they don’t recognise.

A dedicated email address, support@cs.stepgolf.co.jp, is open for questions. The company says a phone desk is still being set up, that it will contact affected people individually once it is ready, and that shops cannot answer detailed questions about the incident.

What you can do

1. If you took a trial, booked a lesson or held a membership at Step Golf, watch for the company’s own email rather than a surprise message that asks you to “confirm” your account or your bank details.
2. Check your bank statements for withdrawals or new direct debits you don’t recognise, especially if you had set up account transfers with the school.
3. Treat unexpected requests for photos, IDs or payment details as suspect. The company says cards and identity documents were not in this system.
4. Use the official contact address if you have questions: support@cs.stepgolf.co.jp. Don’t use a number or link from an unsolicited message.
5. Learn the patterns. See how scammers use leaked data to make phishing personal.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.

Related coverage

• Prestige International says roadside assistance records for up to 5.5 million cases leaked in Japan, including some bank details: another Japanese service incident that included some bank-account information.
• How scammers use leaked data to make phishing personal: why a message that already knows your name or membership still may not be genuine.

Sources

• Step Golf, Apology and report concerning the possible leak of personal information due to unauthorised access to our business systems (second report), November 10, 2026
• Step Golf, Apology and report concerning the possible leak of personal information due to unauthorised access to our business systems (first report), November 7, 2026