On October 13, 2026, Rakuten Mobile announced that the payment certificates in “my Rakuten Mobile,” its page for members, could have been viewed by third parties.
A disclosure first. I am an employee of Rakuten Group. However, this article is based only on the publicly available official notice and the report by Keitai Watch. I have not used any internal information. This is my personal view.
Bottom line
- The target is the payment certificate that can be obtained from “my Rakuten Mobile”
- It was found through vulnerability testing. The system fix was completed on June 20, 2026
- According to the official notice, after checking the records that could be checked, no viewing by a third party has been confirmed at this point
- The information that could have been viewed: name, address, phone number, data usage, charges, and other billing detail information, etc.
- Financial information such as credit cards, and call history, are not included
- The number of people affected, the period during which viewing was possible, and similar details are not written, as far as I could confirm
What the official notice says
The source is Rakuten Mobile’s official notice (October 13, 2026).
What happened
- Vulnerability testing carried out by Rakuten Mobile itself found that payment certificates might be viewed by a third party
- The method envisioned was for a third party to use a specific program or similar to deliberately perform special operations that are not done in normal use
Information that could have been viewed
- Included: name, address, phone number, data usage, charges, other billing detail information, etc.
- Not included: financial information such as credit cards, call history, etc.
The company’s response
- Completed system fixes and other measures on Saturday, June 20, 2026
- Has already reported to the relevant authorities (the name of the authority is not written)
- Says it will work on regular system inspections and on strengthening its checking framework going forward
- Advises users to watch out for suspicious contact and the like that pretends to be from the company
Contact point
- Phone: 0800-600-6660 (open every day of the year, 9:00-17:00)
- Other contact points such as a form or email are not written in the notice
What is not written
This is probably what readers most want to know.
- The number of people affected. It is also not written whether they are current or past subscribers
- Since when the vulnerability existed (the period during which viewing was possible)
- The date it was found (June 2026 is mentioned, but not the exact day. The fix was completed on June 20)
- Whether there will be individual notification to the people affected, and how they would be contacted
- Specific actions users should take (such as changing passwords)
- The name of the relevant authority, and the date of the report
- A wording of apology (I could not find one within what I checked)
“No viewing has been confirmed at this point” is the result of checking the records that could be checked. I think the accurate reading is that it does not state flatly that no viewing took place. (This is my reading.)
A separate incident is listed on the same page
On Rakuten Mobile’s official site, “Announcement Regarding the Leak of Specified User Information” (updated October 13, 2026), this matter and a different one are listed side by side. To avoid confusion, I’m writing them separately.
| Case A | Case B (this one) | |
|---|---|---|
| When it was recognized | February 2025 to January 2026 | June 2026 |
| Cause | Access by a third party using an ID and password obtained illegally outside the company | Payment certificates could be viewed through special operations |
| Type of information | Date of birth, address, phone number, email address, phone numbers called, SMS send/receive destinations, communication time, data usage, etc. | Name, address, phone number, data usage, charges, billing detail information, etc. |
| Viewing by a third party | It became viewable (multiple times) | Not confirmed at this point |
| Response | Contacting the people affected, requesting a password change, etc. | System fix completed on June 20, 2026 |
The name “my Rakuten Mobile” does not appear on the page. Case B may correspond to this payment certificate matter, but within what I could confirm, the page has no statement explicitly saying they are the same.
My general advice
The following are general tips that are not limited to this matter. They are not an official instruction.
- Be careful about contact that pretends to be from the company. The official notice also gives the same caution. Do not open links in SMS or email; check through the official app or a bookmark instead
- Even if you are asked for a password, PIN, or verification code by phone or by an on-screen prompt, do not give it
- Considering that your name, address, and phone number may be known, when you get a suspicious call or mail, do not believe it right away; check through an official contact point
- Review whether you are reusing the same password as on other services
- If you are worried, contact the contact point given in the official notice
How to tell whether a message is suspicious is summarized in another article. A list of contact points is in the article on where to make inquiries.
Reference: related articles from the same week
- Rakuten Drive unauthorized access (October 2026)
- This week’s roundup of unauthorized access reports, and preparations you can make yourself
Summary
- Payment certificates in “my Rakuten Mobile” could have been viewed by third parties (announced October 13, 2026)
- The fix was completed on June 20, 2026. No viewing by a third party has been confirmed at this point
- The information that could have been viewed: name, address, phone number, data usage, charges, billing detail information, etc. Financial information and call history are not included
- The number of people affected, the period, whether individuals will be contacted, and similar details are not written, as far as I could confirm
- The official notice also advises caution about suspicious contact
Conditions and content may be updated. For the latest information, check Rakuten Mobile’s official notice. The content of this article is as of October 14, 2026.
Sources:
- Rakuten Mobile “Notice” (October 13, 2026) https://network.mobile.rakuten.co.jp/information/news/other/3888/
- Rakuten Mobile “Announcement Regarding the Leak of Specified User Information” (updated October 13, 2026) https://corp.mobile.rakuten.co.jp/guide/privacy/tokuteiriyoujoho/announcement/
- Keitai Watch “Rakuten Mobile system vulnerability: addresses, phone numbers and more may be viewed by third parties” (October 13, 2026) https://k-tai.watch.impress.co.jp/docs/news/2147800.html
This article contains affiliate advertising. If you apply for a product or service through links on this site, we may receive compensation from partner companies. Additionally, the operator is an employee of Rakuten Group and may receive compensation through an employee referral program. Article content and evaluations are based on the operator's actual experience and research, regardless of advertising. For details, see the Disclaimer & Affiliate Disclosure. Disclaimer & Affiliate Disclosure
This article contains machine translation. For official terms, please refer to the multilingual pages on the official Rakuten Mobile website.
If you have concerns about Rakuten Mobile's coverage area or signal conditions, you can inquire through the official signal improvement survey request form .
