{
  "id": "giftee-prismatix-data",
  "url": "https://ohshit.app/incidents/giftee-prismatix-data/",
  "title": "Giftee suspends consumer features after a Prismatix intrusion",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-11-12",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "SaaS",
    "Data breach",
    "Japan"
  ],
  "ecosystems": [],
  "summary": "Giftee says an unauthorized party accessed Prismatix, its membership and login provider. Some consumer members’ email addresses and password information may have been exposed. Giftee suspended major consumer features while it investigates with the provider.",
  "splash": "Members of Giftee’s consumer service whose account data was held by Prismatix.",
  "wipe": "Change passwords reused elsewhere, verify messages through official Giftee channels, and check for reopening instructions.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Replace passwords reused on other services",
      "hint": "Go directly to each service that shares your Giftee password and choose a unique replacement. Start with email and financial accounts, and enable multifactor authentication where supported."
    },
    {
      "title": "Verify notices and follow the recovery instructions",
      "hint": "Find customer support through Giftee’s corporate notice. Avoid login or reset links in unexpected messages. Check the official site for service reopening and any account-specific instructions."
    }
  ],
  "sources": [
    {
      "name": "Giftee’s November 12 and 13 notices",
      "url": "https://giftee.co.jp/press/news/info20261113/",
      "says": "Explains the supplier dependency, feature suspension, possible account data exposure and password reuse advice.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": null,
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 11, 2026",
      "title": "Giftee suspends major consumer features",
      "body": "The company pauses features to contain possible effects and check safety."
    },
    {
      "date": "Nov 12, 2026",
      "title": "Giftee discloses unauthorized access at Prismatix",
      "body": "Giftee says it uses the provider for membership management and login authentication."
    },
    {
      "date": "Nov 13, 2026",
      "title": "Giftee identifies potentially exposed account fields",
      "body": "The follow-up names email addresses and password information for some members. Investigation continues."
    }
  ],
  "body_markdown": "Giftee uses Prismatix to manage consumer member data and authenticate sign-ins. The attack path, password storage format and affected member count remain undisclosed. The November 13 update identifies email addresses and password information as possibly exposed. Giftee says it is working with Prismatix on investigation and recovery and will publish the reopening date once it verifies safety."
}