Yomiuri Giants Fan Club Breach Leaks 807,030 Email Addresses

The Yomiuri Giants, one of Japan's best known professional baseball clubs, said on 13 November 2026 that a cyberattack on the system that manages members of its official fan club, CLUB GIANTS, leaked 807,030 member email addresses. The club says it lost access to the server on the morning of 12 November and then found that the addresses had been taken.

The club says credit card data was not part of the leak, because it does not hold card details in that system, and that no misuse had been reported when it published its notice. It warned members that suspicious emails pretending to come from the club or related organisations may follow.

What the Giants disclosed

In its notice of apology, published on the Yomiuri Giants official website, the club says an outside party attacked the server that stores fan club member records. Once the server stopped responding on 12 November, the club investigated and confirmed that member email addresses had leaked. It says it has taken measures to block the attack and that it is still checking whether any other member information was affected.

The club reported the incident to the Personal Information Protection Commission, Japan's data protection authority, the same day it went public. It has not named a vendor or said how the attacker got in. Unlike several recent Japanese leaks, nothing published so far links this incident to ARARA, the email delivery provider whose breach exposed addresses for SEGA, the City of Osaka and hundreds of other brands.

Why a fan club list is a phishing target

A fan club list is a clean, engaged audience: people who signed up to hear from one brand and who expect ticket, renewal and merchandise emails from it. That is exactly the context a phishing campaign wants. A fake "renew your membership" or "claim your ticket priority" message sent to 800,000 confirmed fans reads far more plausibly than random spam.

It is also one more large Japanese email leak in a short span. In the same week, Monex Securities disclosed that up to 1.13 million email addresses may have leaked through a contractor, and the ARARA breach kept adding victims.

Action checklist

• Enforce DMARC on every domain your brand sends from, including ticketing and shop subdomains, so spoofed mail is rejected. See DMARC reject vs quarantine for the move to p=reject.
• Watch your DMARC reports for new sources sending as your domain, an early sign of an impersonation run.
• Keep renewals and payments out of email links: tell members to sign in through your app or a typed address, and repeat it in every membership email.
• Send a short, link free warning from your authenticated main domain if your audience overlaps with a leaked list, and describe what your real messages look like.
• Review where member lists live: limit who can export them, remove addresses you no longer need and check that vendors holding them report incidents quickly.

Sources

1. Yomiuri Giants: notice of apology about the leak of email addresses caused by a cyberattack, published on the club's official website on 13 November 2026 (primary source, in Japanese)
2. Personal Information Protection Commission, Japan (authority the club reported the incident to)
3. ANN via KSB: Giants fan club leaks about 800,000 email addresses, 13 November 2026 (third-party report, in Japanese; the club's notice page could not be retrieved directly)

Related on SMTPedia

• Monex Securities breach may expose up to 1.13 million email addresses
• SEGA newsletter breach at ARARA exposes 2.2 million email addresses
• DMARC reject vs quarantine: when to move and how