TOKYO (TR) – A hacker group identifying itself as Mumei no Kai has claimed responsibility for a cyberattack against Tokyo Himitsu Kichi, a women-only adult relaxation service operated by male therapists across Japan.
The group is threatening to expose the booking histories and personal details of tens of thousands of members unless a ransom is paid in cryptocurrency.
The group made its claims on an online message board, with a poster using the handle Mumeinokai publishing what it described as an “Update #3” statement dated October 26. The attackers allege they first contacted the operator on or after October 13, set a negotiation deadline of October 25, and, when that deadline passed without a settlement, declared they would escalate the public release of stolen data.
The figures cited by the attackers, 96 outlets, 58,573 members, and 5,331 workers, are drawn from the group’s own claims and cannot be independently verified. According to a 2024 report by Shueisha Online, the operator of Tokyo Himitsu Kichi is listed as HKC Co., Ltd.
The store count cited by the attackers is said to correspond with the official site’s branch listings, though neither the accuracy of those figures nor the existence of a single shared customer database across the entire group has been confirmed.
Women only
Tokyo Himitsu Kichi markets itself on its official website as a ‘women-only adult service,’ with its flagship Tokyo location operating on an outcall basis: customers book appointments and receive visits from therapists. The service lists outlets not only in Tokyo but across other parts of Kanto, Hokkaido, Tohoku, Tokai, Kansai, Kyushu and Okinawa.
Security experts warn that the nature of the data allegedly at stake makes this attack particularly menacing. Records from such a service would link a member’s name and contact details to the specific therapist assigned, the date and time of bookings, the content of reservations, and payment amounts. If genuine, the release of such records would constitute a severe privacy violation, exposing deeply personal information that members would have had every expectation of keeping private.
The statement attributed to Mumei no Kai suggests a classic extortion-and-exposure operation, using the threat of publishing member histories and worker identities as leverage. However, the claims remain unverified. The poster’s organizational makeup, nationality, connection to any prior attacks, and the specific methods allegedly used to breach the system have not been established. There is likewise no confirmed evidence that ransomware encryption of the operator’s systems actually took place.
HKC has not commented on the alleged breach.
