PHP Vulnerability Responses by Company

Benefit One

Companies / web services
Aliases / services
Benefit One / トク買 / Tokukai / 株式会社ベネフィット・ワン / Benefit One日本
Official website
https://corp.benefit-one.co.jp/
Sources identifying the operating company

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Tokukai for Credit Saison members

Response status
Not listed
Response information checked
2026-10-30

Current re-audit: official_incident_notice · Research date: 2026-10-30

Unauthorized access to contractor Forestec on October 14–20, 2026 exposed data on 29,465 current/former Tokukai members, including names, birth dates, emails, customer IDs and fee-collection reference numbers. Payment-card data and Credit Saison’s systems were excluded. Potentially exposed payment-integration credentials were changed on October 26 to block that route; no fraudulent settlement was found. Tokukai was suspended.

Scope: A PHP connection and response to the current PHP vulnerabilities are not listed.

What users should do

Do not disclose card numbers or passwords in suspicious emails, calls or texts. Former members may not receive individual mail; check your status through the dedicated contact in the official notice.

Official service URL

Source URLs

  1. Official operator identityhttps://corp.benefit-one.co.jp/company/news/news/2026/20261028/20261028.pdfService and operation documentation
Related official sources
  1. Official operator identityOfficial information directoryIdentifies Benefit One as the operator.
  2. 2026-10-28: official service noticeOfficial notice; link to this PHP incident unconfirmedVerifies affected data, service scope and user guidance.

Comments