giftee Group, Inc. expects to book an extraordinary loss of about ¥550mn in the fourth quarter of its year ending December 2026 after a third party exploited a vulnerability in part of a subsidiary's system to issue e-gifts without authorisation. The company set this out in an extraordinary report filed with the Kanto Local Finance Bureau on October 27.
What happened
The incident occurred on October 25, according to the report. Unauthorized access, using a vulnerability in part of a system run by the consolidated subsidiary giftee, Inc., led to e-gifts being issued illegitimately through that system. After discovering the problem, the company identified the vulnerability used and shut the affected system down the same day, which cut off further illegitimate issuance through that route. It does not plan to bring the system back into use.
Who bears the cost
The report says no reduction in or damage to assets held by customers of giftee's services has been confirmed. The monetary loss from the unauthorized issuance falls on the group. The company expects to book about ¥550mn as an extraordinary loss in consolidated results for the fourth quarter of the year ending December 2026.
The company says it does not currently expect a material effect on revenue or operating profit. The ¥550mn figure is an expectation, and the report gives no breakdown of how it was calculated.
Service and data
The response caused temporary disruption to some e-gift exchange services, which the company says are being resolved in stages. Other main services are running as normal. As of the filing, the company says it has not confirmed any leak of personal information from the incident.
The filing was made under Article 19(2)(19) of the Cabinet Office Ordinance on corporate disclosure. The company cites it as the rule covering events that significantly affect its financial position, results or cash flows.