Prestige International (TSE: 4290) said a third party gained unauthorised access to a group business system and took customer personal data out of it, in a notice dated November 2, 2026. The data belongs to road-service customers of client companies that PCS, a group company, serves under outsourcing contracts.
What was taken
The affected system is the one PCS uses to take and dispatch road-service requests for those clients. Prestige International put the count at up to about 5.5mn records. That is a maximum that includes duplicates, and the company said the number of unique people is still being checked.
The records cover names, addresses, phone numbers, email addresses, vehicle details (registration and chassis numbers), accident and breakdown intake information, and, for some customers, financial-institution account details. The company said no credit-card data leak has been confirmed so far. It also said some information about its partner companies may be included, and it is still checking.
Timeline and response
Prestige International detected the intrusion on October 29 and disabled the credentials that had been misused. After confirming that the access was continuing, it shut the system down on October 30. It is working with an outside specialist firm to establish the cause and the scope. The company said it is reporting to the Personal Information Protection Commission and consulting the police.
Road-service operations have continued through alternative arrangements while the system is down. Customers will be notified after talks with the client companies. The company plans system fixes and tighter monitoring.
Customer warning and financial impact
Prestige International said it has found no secondary harm, such as misuse of the data, linked to the incident. It warned of suspicious calls, emails and text messages posing as the group, group companies or insurers, and said neither it nor its group companies would ask for passwords or account PINs by phone or email.
The effect on consolidated earnings is under review. The company said it will announce promptly if it decides the guidance for the year ending March 2027, published on October 29, needs revising, or if new facts emerge. The notice gives no cost estimate.