On October 26, 2026, a group calling itself Mumei no Kai ("the Nameless Society") posted an "Update #3" on an online message board claiming it had breached Tokyo Himitsu Kichi, a women-only adult relaxation service operated by male therapists across Japan. The group threatened to publish members' booking histories and personal details unless a cryptocurrency ransom was paid. The Tokyo Reporter reports the attackers say they contacted the operator on or after October 13, set a negotiation deadline of October 25, and said they would escalate public releases once it passed. According to a 2024 Shueisha Online report cited by The Tokyo Reporter, the operator is HKC Co., Ltd., and HKC had not commented as of the Tokyo Reporter's October 31 article.

Why It Matters

This is the [Pornhub Premium/Mixpanel breach](/stories/pornhub-data-breach-shinyhunters) at a smaller scale but with more sensitive data. A browsing log can be denied. A record tying a named woman to a dated, paid in-person booking with a named therapist, plus staff notes about her home, cannot. Women-oriented paid-intimacy services (*joseiyō fūzoku*) are a fast-growing, mostly informally run niche in Japan, and this incident shows how much of that business sits on franchise-grade booking systems and social-media DMs rather than hardened infrastructure. The lesson applies well beyond Japan, to every sexual-wellness business holding identity-linked intimate data: in-person services, telehealth, connected devices and creator platforms. Keep as little as possible, never store passwords in plaintext, keep free-text staff notes out of customer records, and assume your data will eventually be cross-referenced against other breaches. Watch for a statement from HKC, any police or Personal Information Protection Commission involvement, and whether real extortion attempts against members appear.

Every number here is the attackers' own claim and has not been independently verified. The group says it holds data covering 96 outlets, 58,573 members and 5,331 workers. Japanese security outlet Security Measures Lab (Rocket Boys), which has been tracking the leak site, reported on October 31 that the attackers had posted a second batch. That batch includes masked samples of what they say are customer lists with registered names, phone numbers, home addresses, visit counts and cumulative spend; internal staff notes on clients; an excerpt of 100 order records; order history going back to 2020, including people who have stopped using the service; and therapist HR files linking work names and photos to real names. The attackers also claim to have matched about 2,700 users to their real names by cross-referencing other leaked databases, and that reception and manager account passwords were stored in plaintext. Security Measures Lab stresses that it has confirmed the postings exist but not that the data is authentic, where it came from, or how far it spread.

The outlet's guidance to users is practical: watch for extortion threats to tell family or employers, impersonation from people who seem to know your booking history, and stalking risk where addresses are involved. It also warns that paying would not guarantee copies are deleted. The service takes some bookings through therapists' Instagram and Bluesky DMs, so the attackers' claim to hold SNS credentials puts those message histories at risk as well.

Sources

Update — 2026-11-01

Initial entry — story first created.