The disclosures describe card credentials and balance information. The provider’s total is a record count that includes IDs not yet purchased by end users, rather than a count of affected customers or a sum of money stolen. [S2]

The provider’s count includes IDs awaiting purchase

ID records

Source

Paycloud Holdings October 23 disclosure

Japan, Value Card system; position disclosed October 23, 2026, with confirmation dated October 19. Unissued IDs are defined as IDs before an end user purchases them. These are records containing ID, PIN and balance information, not unique users, active cards, transactions or money lost. The provider’s categories are not equated with MOS’s circulation categories.

Show data tableHide data table

Scroll left or right to see all columns

Value Card records disclosed as leaked (ID records)
Category	Disclosed records
Issued IDs	569,224 ID records
Unissued IDs	855,524 ID records

Paycloud listed 569,224 issued IDs and 855,524 unissued IDs. It said it confirmed the incident on October 19, blocked the unauthorized access route and took measures against further damage. Issued IDs had presented a misuse risk, the company said, but countermeasures had been applied and it reported no actual harm from unauthorized use at the time of the notice. [S2]

The company attributed the attack to exploitation of a web-server vulnerability in part of its subsidiary’s environment. It did not identify the vulnerability in the disclosure. Paycloud said relevant authorities had been notified and that outside specialists would help recheck vulnerabilities across services. Its financial impact remained under review. [S2]

Valuedesign provides merchant-specific prepaid money infrastructure, purchase-data analysis and smartphone applications. It is wholly owned by Paycloud Holdings. That operating model puts a shared technology provider behind programs presented to customers under individual merchants’ brands. The incident therefore involves both the provider’s response and each issuer’s handling

An attack on Valuedesign ’s Value Card prepaid system exposed 1,424,748 records containing ID numbers, PINs and balances, according to an October 23 disclosure by parent Paycloud Holdings . MOS Food Services separately reported exposed MOS Card information and forced PIN changes, showing how a provider-level breach can reach a retailer’s own stored-value program. [S1][S2][S3] The disclosures describe card credentials and balance information. The provider’s total is a record count that includes IDs not yet purchased by end users, rather than a count of affected customers or a sum of money stolen. [S2] The provider’s count includes IDs awaiting purchase Value Card records disclosed as leaked Paycloud’s exact breakdown of the 1,424,748-record total. Disclosed records Issued IDs: 569224 ID records Unissued IDs: 855524 ID records Japan, Value Card system; position disclosed October 23, 2026, with confirmation dated October 19. Unissued IDs are defined as IDs before an end user purchases them. These are records containing ID, PIN and balance information, not unique users, active cards, transactions or money lost. The provider’s categories are not equated with MOS’s circulation categories. Paycloud Holdings October 23 disclosure Paycloud listed 569,224 issued IDs and 855,524 unissued IDs. It said it confirmed the incident on October 19, blocked the unauthorized access route and took measures against further damage. Issued IDs had presented a misuse risk, the company said, but countermeasures had been applied and it reported no actual harm from unauthorized use at the time of the notice. [S2] The company attributed the attack to exploitation of a web-server vulnerability in part of its subsidiary’s environment. It did not identify the vulnerability in the disclosure. Paycloud said relevant authorities had been notified and that outside specialists would help recheck vulnerabilities across services. Its financial impact remained under review. [S2] Valuedesign provides merchant-specific prepaid money infrastructure, purchase-data analysis and smartphone applications. It is wholly owned by Paycloud Holdings. That operating model puts a shared technology provider behind programs presented to customers under individual merchants’ brands. The incident therefore involves both the provider’s response and each issuer’s handling

Your free reader account