{
  "id": "athome-rental-management-data",
  "url": "https://ohshit.app/incidents/athome-rental-management-data/",
  "title": "At Home says 6,901 rental management records may have been exposed",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-11-13",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Data breach",
    "Property management",
    "Japan"
  ],
  "ecosystems": [],
  "summary": "At Home confirmed an unauthorized login to the administration site for its rental management service on November 9. It says 6,901 records entered by member real estate agencies may have been exposed, including contact and rental contract details.",
  "splash": "Tenants, property owners and business contacts entered by affected member agencies in At Home’s rental management service.",
  "wipe": "Verify notices with your agency or At Home and independently confirm requests to change rental payments.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Confirm whether your record is in scope",
      "hint": "Ask the agency that manages your property or contact At Home at 050-5538-0939 through the number published in the notice. Agencies should confirm their own scope and retain relevant access and notification records."
    },
    {
      "title": "Verify rent or contract requests before acting",
      "hint": "Use the phone number or contact listed in your existing contract to confirm unexpected messages about rent, renewal or bank details. Report suspected impersonation to your agency and, if you paid, contact your bank."
    }
  ],
  "sources": [
    {
      "name": "At Home’s November 13 incident notice",
      "url": "https://www.athome.co.jp/corporate/news/topics/oshirase-202611/",
      "says": "Lists the unauthorized login, provisional count, exposed fields, containment and support contact.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": null,
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 9, 2026",
      "title": "An unauthorized party logs into the administration site",
      "body": "At Home later identifies records submitted by some member real estate agencies as potentially exposed."
    },
    {
      "date": "Nov 12, 2026",
      "title": "At Home reports the incident to authorities",
      "body": "The company reports to Japan’s Personal Information Protection Commission, JIPDEC and JUAS."
    },
    {
      "date": "Nov 13, 2026",
      "title": "At Home publishes its initial findings",
      "body": "The company gives a provisional count of 6,901 records and says it is identifying and contacting affected agencies and other parties."
    }
  ],
  "body_markdown": "At Home says the records may include names, birth dates, phone numbers, addresses and contract data such as building names, unit numbers and contract status. The company has not confirmed any bank-account data leak, and the system does not hold credit card data. At disclosure it had not confirmed publication, misuse or impact on its other services.\n\nThe company says it blocked access from the source, is reviewing logs and is working to notify affected parties individually. The entry path and the amount actually taken remain under investigation."
}