Attackers broke into the system that Prestige Core Solutions (PCS), a subsidiary of Tokyo-listed Prestige International, uses to take roadside assistance calls and send out help for car insurers, leasing companies, carmakers and dealers. In a disclosure dated November 2, 2026, Prestige International said up to about 5.5 million records were taken. The data includes names, addresses, phone numbers, email addresses, number plates, chassis numbers, accident and breakdown details and, for some customers, bank account information. The 5.5 million figure counts records, not people, and includes duplicates. The company says it is still working out how many individuals are affected. Sony Assurance, AXA General Insurance, ENEOS and Nippon Car Solutions have told their own customers they are affected. Their notices give different dates and different scopes.
What Happened
Prestige International says it detected unauthorized access to a group business system on October 29. It revoked the credentials the attackers had misused that day. INTERNET Watch reports that the access continued after the revocation, so the company shut the system down on October 30. The parent company disclosed the breach on November 2, and Asahi Shimbun and INTERNET Watch reported it the same evening and on November 4.
The clients learned about it at different times, and their notices don't fully agree with each other:
- Sony Assurance says PCS told it about the unauthorized access at about 11:00 on October 30. That was the day the system went down. Sony says PCS is still checking whether any of its policyholders' data was taken, and it will post an update when it gets the answer. Only claims Sony sent to PCS for roadside assistance are potentially affected. Sony also says its roadside assistance phone line has been hard to reach since the attack. It asks customers who arranged their own tow to keep the receipt and contact the desk later.
- ENEOS says it found out at about 10:20 on November 2 that data on its car-lease customers had leaked. It gives the access window as October 29 to 30 and counts up to 8,500 affected contracts. ENEOS also says PCS has put security measures in place, confirmed the system is safe, and resumed handling ENEOS's work. Lease services continue as normal. ENEOS stresses that its own systems were not breached.
- AXA General Insurance and Nippon Car Solutions have also announced exposure, according to INTERNET Watch and Japan Cyber Watch. Japan Cyber Watch reports that the insurers are still checking how many of their customers are affected. It also reports that Nippon Car Solutions is the only client so far to name a cause. That claim has not been independently confirmed.
According to the summary of its notice published on Japan IR, Prestige International has reported the incident to Japan's Personal Information Protection Commission and is consulting the police. It is investigating the cause with outside specialists and is still assessing the impact on its financial results. On contacting affected people, Asahi Shimbun quotes the company as saying it will "respond appropriately after consulting with our business partners".
Accounts differ on how much of the operation is still offline. Prestige International says the affected system was suspended on October 30, and Sony Assurance describes ongoing trouble at its call desk. ENEOS says PCS has already resumed its contracted work after confirming the system is safe. These accounts may refer to different parts of PCS's operations. The company has not said which services are running or when.
What Was Taken
Prestige International's disclosure, as reported by Asahi Shimbun and INTERNET Watch, says the stolen data relates to customers who used roadside assistance through PCS's clients:
- Names, addresses, phone numbers and email addresses
- Vehicle details, including registration (number plate) numbers and chassis numbers
- Details of accident and breakdown calls
- For some customers, bank account information
Every report gives the same top-line figure: up to about 5.5 million records, duplicates included. No one has published a count of unique individuals. Prestige International says it has found no credit card data in the leak, and Asahi Shimbun reports that no fraud or other harm from the leak has been confirmed so far.
The client notices show that the data held differs from one client to another. ENEOS's list of leaked fields for its lease customers includes date of birth and contract details such as plan and lease term, which the parent company's summary does not mention. ENEOS also says its customers' data did not include credit card numbers, bank account details or login passwords. The bank data in Prestige International's notice therefore applies to some client groups and not others. ENEOS notes that its figures cover only its own customers and differ from PCS's totals.
The combination of fields matters. A name, home address, phone number, plate number and a record of a recent accident or breakdown is enough to write a convincing fake message from an insurer about a claim, a tow bill or a refund. Adding bank account details for some customers makes payment-redirection fraud more likely.
Why It Matters
Most people in this data never chose PCS. They bought car insurance or signed a lease, and the roadside assistance desk behind that product was run by a contractor they had probably never heard of. One compromised system has now exposed customers of at least four brands, and each brand can only tell its customers what the contractor tells it. Sony Assurance's notice says this directly: it is waiting for PCS to confirm whether its policyholders' data was taken.
This fits a wider pattern this year. Japan Cyber Watch tracks breaches of a million or more records disclosed in Japan in 2026. Its tally passed 50 entries in early November, and Prestige International was added alongside Nojima, @cosme and Arara Message within the same few days. The publication found that about one in three of those breaches hit a vendor or platform rather than the brand customers deal with, and that half the companies have not said how the attackers got in.
The incident also disrupted a safety service. Roadside assistance is what stranded drivers call after a crash or breakdown. Sony Assurance's warning about hard-to-reach phone lines shows that a breach at a contractor can affect people stuck at the roadside, not just their data.
The Attack Technique
Prestige International has not said how the attackers got in, and the investigation is ongoing. The one detail it has given is significant: the attackers were using valid credentials, and revoking those credentials on October 29 did not stop them. Access continued until the system was taken offline on October 30.
That pattern usually means one of the following:
- the attackers had more than one set of credentials, or could steal new ones
- they had already set up another way back in, such as a web shell, a new account, a stolen session token or an API key, before the known credentials were revoked
- the original weakness that let them in was still open
The company has not said which of these applied. No group has claimed the attack, and no ransom demand or encryption of systems has been reported. Japan Cyber Watch reports that Nippon Car Solutions' notice names a cause. That has not been confirmed by Prestige International or by any other source, so the method of entry should be treated as unknown.
What Organizations Should Do
- List every contractor that holds your customers' data, and know how fast they must tell you about a breach. Sony Assurance heard on October 30 and ENEOS confirmed leaked data on November 2. Contracts should require early notice, a specific list of affected fields, and per-client record counts, not just the contractor's total.
- Plan containment on the assumption that revoking credentials won't be enough. When stolen credentials are found, also revoke active sessions and tokens, rotate API keys and service-account secrets, check for new accounts and changed permissions, and look for web shells or remote-access tools. Be ready to isolate the system quickly if access continues.
- Keep less data in contractor systems. A roadside assistance desk needs a location, a vehicle and a callback number. It rarely needs a bank account or date of birth stored indefinitely. Limit the fields you share and require contractors to delete case data on a fixed schedule.
- Warn affected customers about targeted scams now, before the investigation is finished. The leaked data includes accident details, plates and contact information, so expect fake emails, texts and calls about claims, tow fees and refunds. Tell customers which channels you will and won't use to contact them, as Sony Assurance and ENEOS have done.
- Have a fallback for critical outsourced services. If a contractor's system goes down, decide in advance who answers the phone, how drivers get help, and how they are reimbursed for help they arranged themselves.
- Watch for fraud using affected customers' bank details. Where bank data may have been exposed, flag those accounts and treat any request to change payout details with extra checks until the contractor publishes the final scope.
Sources: Prestige International Breach: One Roadside Assistance Contractor,... | Prestige International Inc. Notice of Personal Information Leakage... | Prestige International: Unauthorized Access Leaks Up to Approximate... | Japan's 2026 Data Breaches by the Numbers: What 37 Breaches of a Mi... | 当社の委託会社の業務システムへの不正アクセスについて ソニー損保からのお知らせ 自動車保険ならソニー損保におまかせ！ | カーリースの管理業務委託先システムへの不正アクセスによる個人情報漏洩について｜ENEOS | ロードサービス向け業務システムを手がけるプレステージ・コアソリューション、不正アクセスで最大550万件の情報漏えい（INTERNET... | ロードサービス事業で最大550万件の情報漏洩 車両番号や口座番号（朝日新聞） - Yahoo!ニュース