Paycloud Holdings said a third party gained unauthorised access to the servers of Value Card, a house electronic-money issuing service run by its consolidated subsidiary Value Design, and that some of the information the service manages leaked externally. The company disclosed the incident in a TDnet notice dated October 23, 2026.
What was exposed
The leaked data comprises ID numbers, PIN numbers and balance information, totalling 1,424,748 records. Of these, 569,224 are issued IDs and 855,524 are unissued IDs, defined as IDs before an end user has bought them. The company confirmed the incident on October 19 and says no personal information is involved.
The figure counts records, not people. The notice does not say how many individuals hold the 569,224 issued IDs.
Response and cause
Paycloud said issued IDs faced a risk of misuse but that this has been dealt with, and that there has been no actual damage from misuse. That is the company's own statement. It warned that the handling may inconvenience some users.
The company said it cut the access route promptly, took measures to stop the damage spreading and reported the incident to the relevant authorities. It attributes the breach to a vulnerability in a web server in part of the subsidiary's system environment.
What comes next
Paycloud said it has found no impact from unauthorised access beyond the incident itself. It plans to work with an external specialist body to recheck vulnerabilities across all its services and to share information on the attack with client companies and the relevant authorities. The notice says the effect on Paycloud's results is under review, and the company will disclose anything material it finds. It gives no estimate of cost.