In October 2026, TV Asahi reported that a computer hidden behind a refrigerator in a Kobe hotel room had allegedly been used to send phishing emails through the hotel’s Wi-Fi. The emails pretended to come from a credit-card company and directed people to fake websites. The alleged activity took place in May 2025. [1]

Investigators reportedly found approximately 2.4 million email addresses on the computer and records showing roughly 480,000 phishing emails had been sent, according to Sun TV. [2]

How leaked information can lead to more scams

In a separate case, MUJI’s operator, Ryohin Keikaku, reported on November 4, 2026 that customer information may have been accessed without permission. Card issuer Credit Saison said this included full MUJI Card numbers, dates of birth and, for some customers, names and contact details. [3] [4]

In the same notice, MUJI said it had not confirmed misuse of the information, but warned customers about emails and calls pretending to come from MUJI or a card provider. It said it would not ask for card information by email or phone. [3]

Japan’s Innovation Platform Agency (IPA) warns that leaked names and contact details can be used for scam emails, text messages and phone calls. For example, a scammer could address you by name in a fake card alert and ask you to supply more information. Knowing your name does not mean the sender works for your card company. [5] [6]

How to check a message

Scammers can also fake the sender’s name and email address. They may claim that an account has been blocked or that an urgent payment problem needs attention. Those are reasons to check the request, not instructions to act immediately. [6]

For a card alert, open the card provider’s app that you already use, rather than following the message’s link. Or call the number printed on your card, not a number supplied in the message. Ask whether the company sent the alert and what you need to do. [6] [7]

If you have already shared information

If you entered a password after following a link and now suspect a scam, change it promptly. Open the account’s app or use a website address you previously saved, rather than returning through the message’s link. Change that password on every account where you used it. [6]

Attackers can try your stolen email address and password on other services. For example, a password stolen from a shopping account could also give them access to your email if you use the same login details for both. Changing it on the shopping account alone would leave your email account at risk. [8]

Use a different password for every account. A password manager makes this easier. It is an app that can create long, random passwords and store them for you, so you do not have to invent or remember each one. [9]

Protect the password manager with a long password you do not use anywhere else. Turn on two-step verification where available, so signing in requires another check in addition to your password. [9] [10]

If you shared card details, contact your card provider promptly about blocking or replacing the card. Check your statements and report any purchases you do not recognize. [5] [7]

What security education should teach

Email filters and other technical protections remain important. The National Police Agency recommends message-blocking features to reduce phishing messages. [6]

SAYA recommends teaching people how these scams work, not simply telling them to be careful. Lessons should explain why a message can look convincing, what should make someone question a request, and how to check it without using the sender’s links or contact details.

Employees and families should practice these steps using examples they might encounter, such as a card alert or a breach notice. They should also know who to contact after a mistake. Employers should make it clear how to report a suspicious message, including when someone has already clicked a link or shared information.