JR Central confirms data leak affecting 170,000 Smart EX ticketing users

Japan’s Central Japan Railway Company (JR Central) said a cyber‑attack on its Smart EX online ticketing platform exposed personal details of about 170,000 users.

Key takeaways

• Scope of breach: Names, email addresses, member IDs and membership types were accessed.
• Data protected: Birth dates, home addresses, phone numbers and credit‑card information were not compromised.
• Origin of attack: Hackers entered the system through Yumirulink, a digital‑marketing service that handles some Smart EX e‑mail routing.
• Limited name exposure: Only Japanese katakana renderings of user names were leaked, according to JR Central.
• Service impact: The breach does not involve automated booking confirmations or customer‑initiated changes, but promotional and earthquake‑related notifications.

Details of the incident

Smart EX allows travelers to reserve seats on Shinkansen bullet trains across eastern, western and southwestern Japan, including the Kyushu network. The service supports multiple credit‑card payments and issues QR‑code tickets via a mobile app.

JR Central said the breach was linked to Yumirulink, which forwards certain Smart EX e‑mails. Hackers obtained a list containing users’ names rendered in katakana, their e‑mail addresses, member IDs or screen names and the type of membership held.

What information remained secure

The railway operator emphasized that sensitive data such as dates of birth, residential addresses, telephone numbers and payment details were not part of the stolen set. It also clarified that the leak did not affect the automated e‑mails confirming reservations or changes made by customers.

Advice for affected users

JR Central advised users to monitor their online accounts for unusual activity and to be cautious of phishing attempts that might exploit the leaked information.

Smart EX bookings cover routes operated by JR Central, JR West and JR Kyushu, linking major cities from Tokyo to Kagoshima.