JP — ITmedia

Users Report Losing All Funds From Bank Linked to PayPay; PayPay Explains Causes and Countermeasures

SecurityOctober 29, 20261 min read

Some PayPay users said money was stolen from their linked bank accounts through unauthorized transfers. PayPay says the main cause is malware on phones, often installed from fake apps outside official app stores.

What happened

In late October 2026, a post on X got a lot of attention. A user said their parent's PayPay account was misused, and all the money in the linked bank account was taken. PayPay told ITmedia that unauthorized transfers from phones infected with malware have been rising since about August. PayPay says it is working on countermeasures.

Key facts

Unauthorized transfers have been rising since about August 2026.
PayPay watches transactions 24 hours a day with AI and dedicated staff.
Suspicious transactions can be stopped or blocked right away.
PayPay warned about malware on September 7 and about spending limits on August 28.
A fake TikTok app called "TikTok 18+" is one example of a risky app.

How the scam works

Criminals spread fake apps through ads, message boards, and links outside official app stores. If you install one, malware can let someone control your phone from far away. They can then use PayPay to send money or pay for things without your permission. Some banks have also warned about fake tax apps, such as a fake e-Tax app, that steal bank app access in a similar way.

Why it matters

Many people link their bank accounts to PayPay, so one infected phone can put all of that money at risk. After the post spread, some users said they were scared and had cut the bank link. Knowing the warning signs can help people protect their money.

What to do now

Only install apps from Google Play or the App Store.
Do not allow risky phone control settings, such as VPN full control or accessibility services, for unknown apps.
Set spending limits for payments, sending money, and top-ups in PayPay.
Check your PayPay transaction history for transfers you did not make.
If you installed a suspicious app, read the PayPay compensation help page and apply if you qualify.

Glossary

PayPay: A Japanese mobile payment app that lets people pay, send money, and top up using a bank account or balance.
e-Tax: Japan's government online system for filing taxes. Fake versions of its app have been used to scam bank users.
ITmedia: A Japanese online tech news company that published this article.

Matsuya suspends official app and website after detecting unauthorized access; mobile ordering and bento reservations also unavailable

Matsuya Foods, which operates the Matsuya beef bowl chain, announced by October 29 that it had suspended its official app and website after detecting unauthorized access from outside. The bento reservation service "Matsuben Net," mobile ordering, and the "Matsuben Delivery" service are all unavailable, and the company says it is working to identify the cause and scope of impact.

Security전자신문Oct 29

Signs Suggest Hackers Took Over 25 Servers by Exploiting PHP Flaw; South Korea Also Targeted

Researchers at Dream Research, the security unit of Israeli cybersecurity firm Dream, reported signs that attackers exploiting a recently discovered PHP vulnerability took over 25 servers, including a U.S. government-related system. Of about 240 firewalls in South Korea, the U.S., Japan, and Taiwan that were targeted, 24 had root access obtained, and the investigation found no confirmed evidence of a China-linked group or AI-written attack code.

SecurityITmediaOct 29

METI's "Dentrinet" Suspended After Unauthorized Access; Site for Electricity and Gas Operators' Periodic Reports

The Ministry of Economy, Trade and Industry's Electricity and Gas Market Surveillance Commission announced on October 28 that Dentrinet, the website where retail electricity and gas businesses periodically submit reports, was accessed without authorization and its system was shut down. Whether any information was leaked is still being checked, and reports are being accepted by email until the system is restored. The commission confirmed the unauthorized access on October 28 after it occurred in the early hours of October 27, and is investigating the cause and considering measures to prevent a recurrence.

SecurityThe VergeOct 29

A hacker stole more than 40,000 DHS employee records

A hacker stole personal information on more than 41,000 Department of Homeland Security employees, including staff at ICE and CBP, according to TechCrunch and Wired. The exposed data includes names, job titles, phone numbers, email addresses, and office locations, and it also links the agencies to specific surveillance tools. The hacker, known as "Department of Peace," reportedly accessed the data through Okta, an identity and access management service used by the DHS.