Note
The betting app had the account
Three hundred and seventy-three people. The worse file.
Chariloto said a third party used a flaw in the keirin and autorace app between about 09:30 and 13:00 on 21 October. It found odd logs on the 22nd, stopped the app, patched on the 23rd, and brought the app back the same day. Today it finished the count. 373 Charica members. No misuse confirmed. The Personal Information Protection Commission has a first report.
The field list is the reason 373 is not a small incident. Member ID, name, date of birth, gender, postcode, address, email, second email, nickname, phone, rank, auto-charge type, notification flags, Charica balance. Bank name, branch, account type, account number, kana name on the account. Card name, last four digits, expiry, brand. Payback balance, deposit and withdrawal history, settlement history, that day’s buy and payback, remaining stake. The slip: venue, race, ticket type, selections, stake, hit, payout. Passwords are out. The full card number is out. The security code is out.
What 373 will be asked to cover
It will be briefed as a rounding error next to Sagawa. The account number next to the slip is a script for a call that already knows Tuesday’s race. It will be briefed as “no cards.” Last four, expiry, and brand are already enough for a mail that asks for the middle. Do not type the middle. The app being back is a patch. It is not a finding that the account came back.
If you are not in the 373, you are not in this file. If you are, the bank and the slip are the incident. They say they will not ask for a password, a PIN, or a card by phone or mail. A reset that arrives first is someone else. Change the bank login you reused, from a machine that is not this app.
Three hundred and seventy-three is a member slice. The account number is the part that keeps working after the app looks normal.
Cite: Fabio Correia, “The betting app had the account”, 2026-10-24. https://www.fabiocti.com/notes/the-betting-app-had-the-account/. Markdown: https://www.fabiocti.com/notes/the-betting-app-had-the-account.md
Comments
Public thread on the canonical URL. GitHub login keeps this off a spam hole; replies are copied here on the next build so crawlers and models see them in the HTML.
No public replies yet.
Add a comment