Step Golf (STEPGOLF) data breach

Step Golf (STEPGOLF) announced a data breach on Nov 7, 2026 involving up to 114,605 records (duplicates possible), exposing names, addresses, dates of birth and phone numbers. It was caused by a cyberattack. No settlement or compensation has been announced.

What happened

Step Golf, which runs the STEPGOLF chain of indoor golf schools in Japan, said outsiders broke into its business and booking systems and that database backup files containing personal data very likely leaked. It noticed abnormal activity on November 5, 2026, and access logs showed earlier intrusions on October 23 and 25. In its second notice on November 10 it put the data at 114,605 personal-data records (name, address, date of birth, phone, email, contract, booking and purchase history, lesson notes and sensitive personal information), 107,781 face photos and 12,707 sets of bank account details for direct debit, which were stored unencrypted. The counts are registered entries, not confirmed people. Card data and ID documents were not held in the system.

What should I do?

1. Check your bank account for direct debits you don't recognize, since account numbers and holder names were stored unencrypted.
2. Be wary of emails, texts and calls pretending to be Step Golf or your bank, and don't enter PINs or passwords from links in them.
3. Use the dedicated contact address (support@cs.stepgolf.co.jp) rather than asking at a school if you want to know whether you're affected.
4. Expect targeted scam messages that use your name, address and lesson history, and verify any request through Step Golf's official website.

More data breaches in Japan →

Check the other services you use →