We have recently discovered that some of our servers were subjected to unauthorized Access by a third party, potentially resulting in the leakage of personal information (up to 1,518 records) of our customers. We deeply apologize for the great inconvenience and concern this has caused our customers. We take this incident very seriously and will implement measures to prevent recurrence.

We would like to report the details of this matter as follows:

1. Background

On February 5, 2026, our Chairlift ticket issuance system experienced a malfunction. Upon requesting an investigation from the system's management company, it was confirmed that some servers had been attacked with ransomware.
Following a subsequent investigation by the company, it was discovered that personal information was contained within the server where the encrypted data was stored.

At present, there is no evidence that the information was taken outside, but an investigation is ongoing. We have already contacted customers individually who may have had their information leaked.

2. Status of personal information leaks

Personal information of up to 1,518 customers who purchased GALA 24-25 Season Passport between December 16, 2020 and February 1, 2026 has been leaked. The information that may have been leaked is as follows:

・Name
・Address
·telephone number
・Face photo

*Please note that there has been no evidence of credit card information being leaked to the outside.

3. Cause of this case

A security flaw was discovered in the configuration of the network router used for external Access to our business system.

4. Measures to prevent recurrence

We take this incident very seriously and, based on the results of our investigation, will strengthen our system security measures and monitoring system to prevent recurrence.

The system in question was made available again on February 7th, with the exception of some functions, after implementing necessary security measures and not using the attacked server. This incident was also reported to the Personal Information Protection Commission on February 7th, 2026.

5. A request to our customers

We do not require any special action at this time, but please be very careful of suspicious communications like the following.

Unfamiliar phone calls or mail
・Contact to request confirmation of personal information
・Suspicious information requesting money or procedures