Actor claims to sell 126 million records from Japan's Ponta program
An actor known as araragi is advertising on a dark web forum a CSV of 126 million records allegedly from Ponta, one of Japan's largest point programs, operated by Loyalty Marketing, Inc. The data would include names, contacts, addresses, point balances and purchase histories, offered for $500. The claim is unverified and the operator has not confirmed a breach; members should watch for phishing and points-theft scams.
What happened
An actor known as araragi announced the sale of 126 million records attributed to Ponta, one of Japan's largest point programs, operated by Loyalty Marketing, Inc. The offer includes samples with names, contacts, addresses, point balances and purchase histories. The operator has not confirmed the breach.
Why it matters
If the data is real, fraudsters hold real names, contact details and purchase histories to build convincing phishing and points-theft lures against members. For companies, the risk is fraud against customers and employees who use the program, not a flaw to fix in own systems.
What to do
Warn customers and employees about messages citing Ponta purchases, balances or expiring points. Tell them to check balances only in the official app or website and not click links received by email or message.
For the technical team
- Affected
- Ponta, um dos maiores programas de fidelidade e pontos do Japão, operado pela Loyalty Marketing, Inc. · Ponta, loyalty program operated by Loyalty Marketing, Inc. Unconfirmed claim; versions do not apply.
- Exploitation
- No exploitation reported. Sale advertised on a dark web forum by actor araragi, reported by DailyDarkWeb and DarkWebInformer. Unverified claim with no known official confirmation.
- Fix
- No fix to apply; this is an alleged data leak, not a vulnerability.
- Vector
- Not a product flaw. Alleged data leak: Ponta member database with member IDs, names, emails, phone numbers, postal codes, street addresses, point balances, point expiration dates and transaction history with partner names and amounts.
- More details
- The actor published sample records with customer data and detailed transaction histories. The CSV dataset is offered for $500 according to DarkWebInformer, which reports 126 million records; DailyDarkWeb states the total count was not stated in the post. DailyDarkWeb notes such samples can come from a partner or analytics export rather than core systems. No official confirmation known.
Timeline
New post details the claim: 126 million records for sale by actor araragi, including point balances and purchase histories.
Incident opened.
Sources 2 sources
- @DailyDarkWeb @DailyDarkWeb
- @DarkWebInformer @DarkWebInformer
