Security notice
Let visitors attach files to your contact form? SOFT99 says an attacker uploaded a program through one and reached its shop's data.
On November 10, 2026, SOFT99, a Japanese car care products maker, said its official online shop had been broken into through its own contact form. It says an outsider uploaded a program file through the form's image attachment feature, used it to place a file that could take commands from outside, and then, with the site's own permissions, looked around the server and read its settings files. Personal data on up to 136,968 customers may have leaked, including names, addresses, email addresses, phone numbers, birth dates, purchase and delivery details, and the last 4 digits, expiry date and name of their cards. The shop is closed. This is not a named software flaw, so there is no CVE or patch to install. If your site lets visitors attach files to a form, check what it accepts and where those files go. (SOFT99 notice, Nov 10)
What happened
- Found on November 5. SOFT99 says a contractor it works with told it on November 5, 2026 that it had seen suspicious activity on the shop. (SOFT99 notice, Nov 10)
- Way in: the contact form. The contractor's investigation found that an outsider uploaded a program file through the image attachment feature of the shop's inquiry form, used it to place a file that could receive commands from outside, and then, with the permissions of the site's own program, looked through the server and read its configuration files. (SOFT99 notice, Nov 10)
- What SOFT99 has done. It says it has stopped the online shop to cut off access, tightened access restrictions and other security measures, and will ask outside security experts to investigate. It reported the incident to Japan's Personal Information Protection Commission on November 9. (SOFT99 notice, Nov 10)
- No further damage confirmed. SOFT99 says it has not confirmed any secondary damage from the incident so far. (SOFT99 notice, Nov 10)
- Not said. SOFT99 has not said which shop software or form tool it uses, or why the upload was accepted. (SOFT99 notice, Nov 10)
What data
SOFT99 says the following may have leaked for customers who registered or bought at the official online shop up to November 5, 2026, and that it is still confirming exactly which customers and how many. (SOFT99 notice, Nov 10)
- Up to 136,968 people.
- Data: name, address, email address, phone number, birth date, gender, purchase details and delivery details.
- Card data: the last 4 digits of the card number, expiry date and cardholder name. SOFT99 does not list full card numbers or security codes.
Who should worry
- You registered or shopped at SOFT99's official online shop.
- Your website or store has a contact, quote, support, job application or review form that lets visitors attach a file or image.
- You are not sure whether any form or plugin on your site accepts uploads. Ask.
If you never used SOFT99's shop and no form on your site accepts files, this notice does not apply to you.
What to do now
If you are a SOFT99 customer. SOFT99 warns of fake emails, texts, calls, websites and social media accounts pretending to be it or related organizations. Do not open attachments or links you do not recognize, and do not enter personal details, passwords or card details in response. (SOFT99 notice, Nov 10)
If your site lets visitors upload files. These are general steps, not from SOFT99. We are not claiming any tool, including EverThread, would have prevented or caught this.
- Turn off uploads you do not need. If people can email you files instead, remove the attachment field.
- Allow only the file types you need, such as JPG, PNG or PDF, and have your developer confirm the form checks the actual file, not just the name.
- Make sure uploaded files can never run. Ask your developer or host to store uploads outside the public web folder, or in a folder where the server will not run scripts, and to rename uploaded files.
- Keep form plugins updated. Upload flaws in form plugins are common. For example, see our notice on Contact Form 7 CVE-2026-114432.
- Look for files that should not be there. Ask your developer or host to check upload folders for scripts or unexpected files nobody on your team added.
What to send your developer, agency or host
SOFT99 said on November 10, 2026 that an attacker uploaded a program file through the image attachment feature of its online shop's contact form, used it to run commands on the server with the site's permissions, read configuration files, and may have exposed data on up to 136,968 customers. Please list every form on our site that accepts file uploads, including contact, quote, support, job and review forms. For each one, please tell us whether we need it; if we do, limit it to the file types we need, check the actual file content, store uploads outside the public web folder or where scripts cannot run, and rename uploaded files. Please also confirm our form plugins are up to date and check upload folders for unexpected files. Source: SOFT99 notice of November 10, 2026.
Common questions
Has my site been hacked?
This notice does not mean your site has been hacked. It is about a breach at SOFT99. It matters to you because the way in, a file upload on a contact form, exists on many small business sites.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see your forms' upload settings or the files stored on your server, and we cannot tell you whether you were one of SOFT99's customers.
Which software was involved?
SOFT99 has not said which shop software or form tool it uses, so we do not know. (SOFT99 notice, Nov 10)
Where can I follow official updates?
SOFT99's notice (in Japanese). All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- SOFT99 Corporation: Apology and notice about possible personal information leak due to unauthorized access to the SOFT99 official online shop, November 10, 2026, in Japanese, checked November 11, 2026
- SOFT99 Corporation: Same notice as a stock exchange filing, November 10, 2026 (PDF copy), in Japanese, checked November 11, 2026