i-ask breach: inquiry data may be exposed across five companies

A customer-support inquiry can hold more personal information than its sender intended. Scala Communications said on October 6, 2026 that unauthorized access to its i-ask system may have exposed inquiry records held for up to five client companies.¹

Too long; didn’t read?

• Scala reports possible exposure of up to 713,126 inquiries, including repeated contacts by the same person.¹
• Daiwa Securities, Citizen Watch and Sompo Japan published their own notices this week.^{2, 3, 4}
• The companies warn customers to be cautious about messages impersonating them.^{2, 3, 4}

What Scala says happened

According to Scala, a third party logged into the i-ask administration site without authorization overnight on October 2–3, Japan time, and installed an unauthorized program. Inquiry databases for several clients were on the same server and may have been accessed.¹

Scala says a database monitoring alert prompted an investigation, and that it cut off the access on October 3. It reports changing administrator passwords, isolating the program and involving outside investigators. Its announced further measures include stronger authentication and separation between environments.¹

Scala’s headline figure counts inquiries, not people. It says work to identify the actual number of affected individuals is continuing.¹

Three clients, different kinds of records

Daiwa Securities: In its October 5 notice, Daiwa says information concerning about 110,000 customers may have leaked, including names, email addresses and account numbers. Including inquiries without identifying information, it reports about 220,000 records. Daiwa says the information alone cannot be used to access securities accounts or trade, and it had confirmed no related unauthorized transactions at the time of its notice.²

Citizen Watch: Its October 6 notice concerns inquiry forms for Citizen, Bulova and Frederique Constant. Citizen says information relating to about 100,000 people may be involved, including contact details. Bank or card information could also be involved if customers typed it into their inquiry. Citizen says it has not confirmed unauthorized access to its own systems or related secondary harm.³

Sompo Japan: Its October 7 notice concerns support inquiries for the SMILING ROAD business dashcam service. Sompo reports about 60,000 inquiries, including duplicates. Potentially involved fields include contact details, employer information, driver IDs and driving-alert information. Sompo says bank-account, credit-card and My Number card information are not included, and it has not confirmed unauthorized access to its own systems.⁴

Those figures use different units. They cannot be added into a reliable total of affected people: Scala is still identifying individuals, while Daiwa and Sompo explicitly include inquiry records in their counts.^{1, 2, 4}

What customers should watch for

Daiwa warns that names and past inquiry details could be used in fraudulent calls or emails. It advises customers to avoid suspicious links and attachments, withhold login details and one-time passwords, and check unexpected contact through its official channels.²

Citizen says it will contact affected customers individually. Sompo also plans individual contact, with its public notice serving where direct contact is difficult. Use the relevant company’s notice to check the scope and support route for your case.^{3, 4}

Reporting checked October 8, 2026. The cover is an original generated illustration, not a screenshot of i-ask.

Sources

1. Scala Communications: i-ask unauthorized-access notice (October 6, 2026; Japanese).
2. Daiwa Securities: possible customer-information leak (October 5, 2026; Japanese PDF).
3. Citizen Watch: possible exposure through an outsourced provider (October 6, 2026; Japanese).
4. Sompo Japan: SMILING ROAD inquiry-information notice (October 7, 2026; Japanese PDF).