This week, news of unauthorized access kept coming.
“Again?” “Does this affect me?” You probably thought that. I did too.
This article lines up the facts confirmed in news reports and summarizes general steps you can take yourself.
One thing up front: the operator of this site is an employee of Rakuten Group. The Rakuten Drive case is treated by the same standard as the others, and I write only what the reports say.
Bottom line
- The three cases involve different operators and different kinds of damage. You can’t lump them together as simply “dangerous.”
- What they have in common is that not reusing passwords and two-step verification are the basics for keeping damage from spreading (this is my own general advice, not an official notice from any company).
- What you should do depends on the case. Check each company’s official notice first.
The three reported cases
1. Rakuten Drive (announced October 6)
- Stored data was accessed or viewed in 15,382 accounts
- Information such as account names was involved for 687 accounts. For 313 of those, encrypted passwords were also affected, according to reports
- The cause was that a third party illegally obtained the credentials of an administrative account
- Affected users will be contacted individually
I cover this in more detail in a separate article.
2. G Point (detected September 25, reported October 5)
According to a Keitai Watch report (October 5, 2026):
- There was unauthorized access from outside to “G Point,” a point exchange service
- Information that may have leaked is “member identifiers,” up to about 70,000 items. The report does not say a leak was confirmed
- On September 25, when the anomaly was detected, an investigation was carried out and the system was stopped the same day, cutting off outside access
- Related services are also temporarily suspended, with no date set for resuming
- Points that expire during the suspension will be protected so they don’t lapse
Not stated: what exactly a “member identifier” is, whether other information such as names or passwords is included, what actions users should take, and whether any secondary damage has occurred.
3. IDCF Cloud (October 7)
According to a Keitai Watch report (October 7, 2026):
- A third party broke into part of the systems of “IDCF Cloud,” a cloud service from IDC Frontier, and some services are experiencing problems
- It happened at around 3:40 a.m. on October 7. The affected area was the “East Japan Region 1”
- An investigation to resolve the problem is under way, and other areas that are not affected are also being checked for safety
- Affected users are being contacted individually
Not stated: the number of affected users, whether information leaked, the outlook for recovery, and what specific actions users should take.
What the three cases show side by side (within the facts)
| Case | What has been reported as the operator’s response | What has been written as guidance to users |
|---|---|---|
| Rakuten Drive | Blocking the route, stronger monitoring, limits on app downloads and new account creation | Individual contact to affected users |
| G Point | System stop, blocking outside access, temporary suspension of related services | Points protected from expiring |
| IDCF Cloud | Investigation, safety checks | Individual contact to affected users |
In every case, the details of the cause and the specific actions users should take are barely written in the body of the reports. That is exactly why it matters to wait for, and check, the official notices.
What you can do yourself (my general advice)
From here on, this is not official guidance. It’s a general way of thinking.
① Stop reusing passwords
If you use the same password on several services, a leak at one place can let someone into the others. Start with the important services and switch them to different passwords one by one.
② Turn on two-step verification
Even if a password leaks, you can make it so no one gets in without a second form of authentication. I recommend turning it on wherever it’s available. If you use verification codes sent by SMS, see also the article on when SMS doesn’t arrive.
③ Be careful about messages that pretend to be official
At times like this, fake emails and SMS messages pretending to be official tend to increase. Don’t enter your ID or password from a link. Check through the official app, or an official site you opened yourself.
④ Clean up accounts on services you no longer use
Check whether you’ve left data sitting on services you don’t use. It also helps to recall what is in the data you stored (important documents, personal information).
⑤ Be careful when using public Wi-Fi
Use banking and points apps on your own mobile connection if you can. The article on public Wi-Fi sums up the way of thinking.
Summary
- This week saw reports on Rakuten Drive (stored data of 15,382 accounts), G Point (member identifiers, possibly up to about 70,000 items) and IDCF Cloud (intrusion into part of the systems and a service disruption)
- The three cases differ in operator and in the kind of damage. They can’t be lumped together
- The body of the reports barely mentions the details of the cause or specific steps for users. Check the official notices
- General steps: stop reusing passwords, use two-step verification, be careful about messages pretending to be official, and clean up unused accounts
Preparing in your everyday life is easier in the end than panicking every time news comes out.
Sources: Keitai Watch, ASCII.jp
- Unauthorized access to G Point, possible leak of up to about 70,000 “member identifiers” (October 5, 2026) (in Japanese)
- IDCF Cloud outage, unauthorized access to “East Japan Region 1” (October 7, 2026) (in Japanese)
- Unauthorized access to “Rakuten Drive,” 15,382 items of stored data viewed and obtained (October 6, 2026) (in Japanese)
- Rakuten Drive: stored data of 15,000 accounts leaked in unauthorized access (October 6, 2026) (in Japanese)
This article contains affiliate advertising. If you apply for a product or service through links on this site, we may receive compensation from partner companies. Additionally, the operator is an employee of Rakuten Group and may receive compensation through an employee referral program. Article content and evaluations are based on the operator's actual experience and research, regardless of advertising. For details, see the Disclaimer & Affiliate Disclosure. Disclaimer & Affiliate Disclosure
This article contains machine translation. For official terms, please refer to the multilingual pages on the official Rakuten Mobile website.
If you have concerns about Rakuten Mobile's coverage area or signal conditions, you can inquire through the official signal improvement survey request form .
