Key takeaways

  • Seicomart (セイコーマート), the convenience store chain based in Hokkaido, said on September 29, 2026 that an attacker reached the server holding its member data through the server behind its smartphone app.
  • About 570,000 loyalty accounts may be affected. Names, gender, dates of birth, addresses, phone numbers, email addresses and membership dates may have been viewed.
  • Passwords were not leaked, according to Seicomart. It does not hold credit card data, and purchase history was not leaked.
  • The intrusion came to light after a single member's loyalty card was fraudulently cancelled on September 24. Online member services are suspended while Seicomart investigates.

What happened#

Seicomart, often called "Secoma", runs 1,189 convenience stores: 1,087 in Hokkaido, 92 in Ibaraki and 10 in Saitama, as of the end of August 2026. Its loyalty program, Seicomart Club, uses a physical card and a smartphone app. The app also carries Peco Money, the chain's electronic money.

According to Seicomart's two reports, both published on September 29:

Date and time (JST) Event
Sep 24, 22:00–23:00 A member's club card is cancelled without authorization
Sep 28, after 17:00 Investigation finds the member server may have been accessed by a third party, via the app's server
Sep 28, 20:00 Seicomart cuts the connection to the server. New sign-ups, profile changes, card changes, cancellations and My Page logins are suspended
Sep 29 First report published
Sep 29 Second report: purchase history not leaked; website, online shop and reservation logins also suspended

Seicomart says no other accounts were fraudulently cancelled, and it has seen no misuse of Peco Money.

What may have been exposed#

Data Status
Name, gender, date of birth, address, phone number, email address May have been viewed
Club card membership start and end dates May have been viewed
Passwords Not leaked
Credit card information Not held by Seicomart
Purchase history Not leaked

Customers who registered only with Seicomart's online shop and do not have a member card or the app are not affected.

Service disruption#

While it investigates, Seicomart has suspended:

  • New club membership sign-ups, profile and card changes, and cancellations
  • Logins to My Page, the official online shop and the product reservation site. Reservations can still be made as a guest
  • Online orders for its Pecomarket service. In-store orders through multifunction copy machines still work

Points that were due to expire at the end of September have been extended by one month.

What we don't know yet#

Seicomart has not said:

  • How the attacker got from the app's server to the member server
  • When the access began, or whether data was actually taken rather than possibly viewed
  • Whether the fraudulent cancellation was the attacker testing access, or something else
  • Whether it has reported the incident to the Personal Information Protection Commission or the police. Neither notice mentions it

Our analysis#

One odd cancellation led to 570,000 accounts#

The first sign of trouble was small: one loyalty card cancelled without the member's knowledge. Four days later, Seicomart concluded that the member server itself may have been accessed. Catching an intrusion from a single anomalous account action is worth credit. But the four-day gap between the anomaly and the conclusion, and the lack of detail about how access to one account led to the whole member server, are what the follow-up needs to explain.

The app is the way in#

Seicomart says the attacker reached member data through the server behind its smartphone app. Loyalty apps sit between the public internet and a company's customer database, and their back-end systems often grant broad access to member records. If an attacker can make the app's server request other members' records, or reach the database behind it directly, one weakness can expose every account. Seicomart has not described what happened, so this is a general point rather than a finding. It is also the second app-based incident at a Japanese consumer service this week, after Nippon Rent-A-Car.

Fast, and useful in the details#

Seicomart went public the day after concluding the server was accessed, and published a second report the same day. The second report answers the questions customers actually ask: was my purchase history included, am I affected if I only use the online shop, and what happens to my expiring points. The notices also say plainly what Seicomart will never ask for by email: passwords, the Pecoma card PIN, credit card or bank details.

A heavy week for Japanese consumer services#

In the last seven days, Keio, Tokyo Metro, Times Car, Nippon Rent-A-Car and now Seicomart have all disclosed incidents involving customer systems. None of the companies has suggested any connection between the incidents, and they differ in method and scale. For customers, the practical lesson is the same across all of them: expect phishing that uses the brand names in the news this week.

What this means for readers#

  • If you have a Seicomart Club card or the Seicomart app, including as a visitor to Hokkaido, watch for messages that claim to be from Seicomart. Seicomart says it will never ask for your password, Pecoma card PIN, credit card or bank details by email.
  • If you use the same password elsewhere, Seicomart says passwords were not leaked, but changing reused passwords is still good practice after any breach.
  • Online member services are suspended for now. Seicomart has not reported any disruption to in-store shopping, and says it has seen no misuse of Peco Money.

Japanese terms at a glance#

Japanese Reading Meaning
セイコーマート（セコマ） Seikōmāto (Sekoma) Seicomart, a convenience store chain based in Hokkaido
セイコーマートクラブ Seikōmāto Kurabu Seicomart's loyalty program
ペコママネー Pekoma Manē Peco Money, Seicomart's electronic money
退会処理 taikai shori Membership cancellation
第三者に閲覧された可能性 daisansha ni etsuran sareta kanōsei "May have been viewed by a third party"

We will update this article when Seicomart publishes more.