Rakuten Data Sale Claim Unverified as 101M Records Surface October 6

A cybercriminal posted a claim on October 4 to sell approximately 101 million Rakuten member records for $700 on an underground forum. The sample data included names, addresses, phone numbers, email addresses, birth dates, member ranks, and Rakuten point balances. Rakuten’s group communications team stated on October 6 that no information breach has been confirmed and that the sample accounts do not match their records.

What the hacker claimed to sell

The attacker titled the post “SELLING Rakuten Japan 101M” and described the data as a “rakuten.co.jp database.” The sample included 18 records with personal details and service usage flags, such as Rakuten Card ownership status, Rakuten Mobile membership, and email newsletter subscriptions. The seller also included fields for account creation date, final login date (marked September to October 2026), and point balances. However, passwords and credit card numbers were not visible in the sample.

Rakuten’s official response

Rakuten Group denied the breach, stating “the fact of information leakage has not been confirmed.” When asked about the 18 sample records, the company said “the corresponding accounts have not been confirmed.” Rakuten emphasized that it manages customer personal information in compliance with law and its privacy policy. The company did not disclose whether it has launched an internal investigation.

Why experts doubt the data’s authenticity

Security researchers found that the 18 sample records align with Rakuten’s public PointClub membership tier conditions, showing no clear contradictions. Yet the data structure raises red flags. Rakuten’s actual database separates first and last names; the sample combines them. Phone numbers lack type designation (mobile versus landline). Service flags use simple True/False values, which seem oversimplified for a company operating multiple complex services. The seller has posted similar claims before, including 150 million Notion user records in August (later denied by Notion) and 850 million China Mobile records in September, none verified by major media.

Separate breach at Rakuten Drive

On October 6, Rakuten announced a separate incident: unauthorized access to its Rakuten Drive cloud storage service affected 15,382 accounts. The company is contacting affected users and urging password changes. This breach is unrelated to the 101 million record claim and does not confirm the larger alleged data sale.

Final Thoughts

Rakuten’s denial and structural inconsistencies in the sample data suggest the claim may be fabricated, but the company has not ruled out a breach investigation. Users should monitor for phishing and suspicious login attempts until Rakuten provides full clarity.

FAQs

Disclaimer:

The content shared by Meyka AI PTY LTD is solely for research and informational purposes.  Meyka is not a financial advisory service, and the information provided should not be considered investment or trading advice.