Checklist for Service Suspension Decisions and Conditions for Restarting When Unauthorized Access Is Suspected

This article organizes, for e-commerce and membership sites, what to stop and when to stop it when unauthorized access is suspected, and under what conditions to restart services step by step. It is based on the thinking of public guidance (IPA, JPCERT/CC, NIST, etc.) and uses the potential for damage expansion and the ability to verify safety as central criteria.

A concrete checklist for suspension decisions is provided (10 items: unfamiliar operations in administrative screens, possible access to personal or card information, continued tampering or anomalous communications, unknown intrusion route, etc.), and it is recommended that if even one item is answered “yes” or “unknown,” the relevant function should be considered for suspension. Suspension should be considered in four stages: full stop, member functions stop, purchase/payment stop, and continue with increased monitoring.

As examples, in October 2026 コミックシーモア and ふるさとチョイス stopped services before causes and scope were clarified, and later each company confirmed leaks of member information (ふるさとチョイス announced 4,454,097 records). The article also explains initial actions in the first 24 hours after suspension (evidence preservation, first notification, contacting relevant parties) and the importance of isolating affected systems from the network rather than simply cutting power.

Regarding restarting, the article advises not to promise a restart date in advance; instead, functions should be brought back in order once restart conditions are met (root cause identified, intrusion route closed, tampering removed, authentication data changed, monitoring strengthened, etc.). It emphasizes that restarting card payments requires the judgment of card companies and payment service providers and cannot be done solely on the company’s own decision.

Finally, it recommends summarizing suspension and restart rules on a single sheet in peacetime, preparing decision authorities, contact points, reporting deadlines, and loss estimates for anticipated suspensions, and validating them with an annual tabletop exercise. This article can be regarded as a practical guide focused on a working checklist and procedures.