Tsukaeru.net says its customer portal was breached, and some shared servers were rolled back

Tsukaeru.net, a Japanese hosting and cloud company, said a third party got into its systems and that customer information stored in its contract and purchase portal, Tsukaeru Portal, has leaked. It published a first report on November 7, 2026, and said the investigation is still going.

What happened

In its November 7 notice (in Japanese), the company said it found something wrong with a server it manages on November 6, opened an investigation, and then confirmed unauthorised access and a leak of customer information from Tsukaeru Portal. It has not yet published the exact data fields, or how much of the stored information was viewed or taken. The path in and the period of access are also still under review.

The notice is careful about what it does and does not know:

• Credit-card details are not stored in Tsukaeru Portal, so there was no card leak from that portal.
• The company updated the portal software and restored it from a backup taken before the intrusion. It is still checking what the access means for related login credentials.
• It is investigating 127 virtual private servers (VPS) on host machines where it found unauthorised access. That 127 is the number under review, not a count of VPS instances already shown to have been entered or to have had data taken. Customers on those VPS accounts are being contacted separately.
• Some shared servers were also accessed. The company restored them from backup and is still reviewing whether customer data there was viewed or taken.
• Because the shared-server restore used a backup from November 2, website updates and mail sent or received after that backup was taken, through the early morning of November 7, have been lost.
• Apart from those VPS hosts and shared servers, the company said it has not confirmed unauthorised access to other service environments.

To limit further harm it has been stopping or restricting affected systems, updating software and changing related credentials. It is also still checking whether leaked information has been misused.

What this means for you

If you use Tsukaeru Portal, treat the login there as exposed until you know otherwise. The company reset portal passwords. It says those passwords were stored encrypted, but that a third party may have been able to recover them. Anyone who reused the portal password on email or another site should change those other logins too. The notice singles out email-account passwords.

Customers whose sites or mail run on shared servers may also be dealing with lost updates and lost mail from November 2 through the morning of November 7, even if their data was not shown to have been copied. VPS customers should wait for the individual update before assuming their server was or was not entered.

What you can do

1. Reset your Tsukaeru Portal password from the login screen’s “forgot password” link, then sign in and follow the prompts to set up two-factor authentication again, as the company asks.
2. If you reused that password on email or anywhere else, change those accounts to unique passwords and turn on multi-factor authentication where you can.
3. Treat unexpected mail, calls or texts that claim to be from Tsukaeru or a supplier as suspect. Do not open unfamiliar links or attachments, and do not send a password or a login code back to anyone who asks.
4. If you run a site or mailbox on the company’s shared servers, check what content and mail are missing after the November 2 restore, and restore anything you still have copies of.
5. Follow the company’s page for updates, by opening the official site the way you usually do, not through a link in a new message. See how scammers use leaked data to make a message feel personal if a note arrives that seems to know your account.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give a host its own address, so a fake “reset your hosting password” note that arrives at the wrong one stands out. Frame never collects or stores the leaked records themselves.

Related coverage

• DreamHost says intruders took FTP passwords and some webmail logins over about two months: another hosting company recently telling customers that control-panel access led to leaked logins.
• How scammers use leaked data to make phishing personal: what to expect after a host or a customer portal is named in a leak.

Sources

• Tsukaeru.net, Apology and report on unauthorised access and the leak of customer information (in Japanese), November 7, 2026