Sharefull data breach
Was I affected?
Sharefull confirmed a breach involving up to 7.5 million records (duplicates possible), exposing names, phone numbers, email addresses and addresses. You may be affected if you have a worker account on the Sharefull app, or if your company posted jobs on Sharefull. Sharefull is contacting affected people individually by email and other means; its Sharefull Shift service is not affected so far.
| Announced | Nov 9, 2026 |
|---|---|
| When it happened | Unauthorized access around 11:30 pm on November 4, 2026; found around 9:45 am on November 5 and cut off by 2 pm that day |
| Country | Japan |
| Records exposed (may include duplicates) | 7.5 million |
| Data exposed | Names, Phone numbers, Email addresses, Addresses, Dates of birth, Bank or financial details and Other details |
| Status | Confirmed by the company or a regulator filing |
What happened
Sharefull, which runs the Japanese short-shift job app of the same name, said on November 9, 2026 that an outsider broke into its internal management system and that data in up to about 7.5 million user accounts may have been taken. For workers, the data includes name (with phonetic reading), phone number, email address, home address, date of birth, the bank account used for wage payments (without PINs or passwords), a link to the stored face photo, emergency contacts with their relationship and phone number, residence status details and account attributes. Up to about 7,500 hiring companies are also involved, with company and contact-person details and some sales records. Sharefull says wage and point data, work records, ID document images and card data were not in the affected data, and it has reported the incident to police and is filing with Japan's Personal Information Protection Commission.
What should I do?
- Be wary of emails, texts and calls claiming to be from Sharefull, a bank or an employer, and don't open links or attachments you weren't expecting.
- Sharefull says it will never ask for bank PINs or passwords by phone or email; never give them out in reply to a message.
- Check the bank account you registered for wage payments for transactions or messages you don't recognize.
- Let the person you listed as your emergency contact know they may receive scam calls that use your name.
- If you posted jobs as a company, watch for fake invoices or requests to change payment details that appear to come from Sharefull or job seekers.
How Korea fines a breach this size
For comparison, Korea's privacy regulator fined Louis Vuitton Korea ₩21.4 billion (about US$14M) in February 2026 over a breach of 3.6 million people. Korean law fines the security failure itself, not only misuse of the data.
Check the other services you use →
Sources
- 社内管理システムへの不正アクセスによる個人情報および法人情報流出の可能性に関するお詫びとお知らせ (Notice on a possible leak of personal and corporate data caused by unauthorized access to an internal management system) · Sharefull (in Japanese) · official
- スキマバイト「シェアフル」に不正アクセス 最大750万アカウント漏えいか 給与振込用の口座情報なども · ITmedia NEWS (in Japanese) · news
- 「シェアフル」に不正アクセス、個人情報最大750万件流出の可能性。給与振込用口座や緊急連絡先含む · INTERNET Watch (in Japanese) · news