Key takeaways

  • Seicomart (セイコーマート), the convenience store chain based in Hokkaido, said on September 29, 2026 that an attacker reached the server holding its member data through the server behind its smartphone app.
  • It has since confirmed that data on 574,647 members, about half of its app users, was viewed: names, gender, dates of birth, addresses, phone numbers, email addresses and membership dates.
  • Passwords were not leaked, according to Seicomart. It does not hold credit card data, and purchase history was not leaked.
  • The intrusion came to light after a single member's loyalty card was fraudulently cancelled on September 24. Seicomart is now ending online self-service for member data.

Update, October 5: Seicomart's third and fourth reports confirm that the data was viewed, not just possibly, and put the number at 574,647. It has reported the breach to the authorities, is working with the police, and will no longer let members view or change their details in the app or on the web. See Follow-up reports.

What happened#

Seicomart, often called "Secoma", runs 1,189 convenience stores: 1,087 in Hokkaido, 92 in Ibaraki and 10 in Saitama, as of the end of August 2026. Its loyalty program, Seicomart Club, uses a physical card and a smartphone app. The app also carries Peco Money, the chain's electronic money.

According to Seicomart's two reports, both published on September 29:

Date and time (JST) Event
Sep 24, 22:00–23:00 A member's club card is cancelled without authorization
Sep 28, after 17:00 Investigation finds the member server may have been accessed by a third party, via the app's server
Sep 28, 20:00 Seicomart cuts the connection to the server. New sign-ups, profile changes, card changes, cancellations and My Page logins are suspended
Sep 29 First report published
Sep 29 Second report: purchase history not leaked; website, online shop and reservation logins also suspended
Sep 30 Third report: data on 572,022 people confirmed as viewed. Reported to the authorities
Oct 5 Fourth report: 574,647 people. Online self-service for member data to be discontinued

Seicomart says no other accounts were fraudulently cancelled, and it has seen no misuse of Peco Money.

What may have been exposed#

Data Status
Name, gender, date of birth, address, phone number, email address Viewed (confirmed in the third report)
Club card membership start and end dates Viewed (confirmed in the third report)
Passwords Not leaked
Credit card information Not held by Seicomart
Purchase history Not leaked

Only Seicomart Club members who had registered with the app are affected: 574,647 people, about 49% of app members. Customers who never registered with the app, and members who left the club card by September 24, are not affected. From October 5, Seicomart is telling every app member through an in-app notice whether they are affected.

Service disruption#

While it investigates, Seicomart has suspended:

  • New club membership sign-ups, profile and card changes, and cancellations
  • Logins to My Page, the official online shop and the product reservation site. Reservations can still be made as a guest
  • Online orders for its Pecomarket service. In-store orders through multifunction copy machines still work

Points that were due to expire at the end of September have been extended by one month.

Follow-up reports#

Third report (September 30). Seicomart confirmed that data on 572,022 people was viewed, about 49% of app members. It said it had reported the breach to the authorities under Japan's privacy law. It declined to describe how the attacker got in, saying it is working with the police and other bodies. Peco Money, points, member prices and coupons all work in stores.

Fourth report (October 5). The number rose slightly to 574,647. Seicomart will discontinue new sign-ups, viewing and changing member details, and changing the registered card in the app and on the web. Members will instead submit requests in store or through a form in the app or on the web, and Seicomart staff will make the changes. Members who cannot log in to the app can use the plastic Pecoma card, or have one reissued in store and call the Club Card Desk (0120-515-413).

What we don't know yet#

Seicomart has not said:

  • How the attacker got from the app's server to the member server
  • When the access began, or whether data was copied out as well as viewed
  • Whether the fraudulent cancellation was the attacker testing access, or something else
  • When app logins will resume

Our analysis#

One odd cancellation led to 575,000 members#

The first sign of trouble was small: one loyalty card cancelled without the member's knowledge. Four days later, Seicomart concluded that the member server itself may have been accessed. Catching an intrusion from a single anomalous account action is worth credit. But the four-day gap between the anomaly and the conclusion, and the lack of detail about how access to one account led to the whole member server, are what the follow-up needs to explain.

The app is the way in#

Seicomart says the attacker reached member data through the server behind its smartphone app. Loyalty apps sit between the public internet and a company's customer database, and their back-end systems often grant broad access to member records. If an attacker can make the app's server request other members' records, or reach the database behind it directly, one weakness can expose every account. Seicomart has not described what happened, so this is a general point rather than a finding. It is also the second app-based incident at a Japanese consumer service this week, after Nippon Rent-A-Car.

Closing the door rather than fixing it#

The most unusual step is in the fourth report. Instead of restoring the app's member functions once they are secure, Seicomart is removing them: members will no longer be able to view or change their own details online. That gives up convenience to shrink what is reachable from the internet. Seicomart has not explained the decision, and the investigation results have not been published.

Fast, and useful in the details#

Seicomart went public the day after concluding the server was accessed, and published a second report the same day. The second report answers the questions customers actually ask: was my purchase history included, am I affected if I only use the online shop, and what happens to my expiring points. The notices also say plainly what Seicomart will never ask for by email: passwords, the Pecoma card PIN, credit card or bank details.

A heavy week for Japanese consumer services#

In the last seven days, Keio, Tokyo Metro, Times Car, Nippon Rent-A-Car and now Seicomart have all disclosed incidents involving customer systems. None of the companies has suggested any connection between the incidents, and they differ in method and scale. For customers, the practical lesson is the same across all of them: expect phishing that uses the brand names in the news this week.

What this means for readers#

  • If you have a Seicomart Club card or the Seicomart app, including as a visitor to Hokkaido, watch for messages that claim to be from Seicomart. Seicomart says it will never ask for your password, Pecoma card PIN, credit card or bank details by email.
  • If you use the same password elsewhere, Seicomart says passwords were not leaked, but changing reused passwords is still good practice after any breach.
  • Check the app's notices. From October 5, Seicomart is telling each app member whether they are affected.
  • Some online member services will not return. Changes to member details will be handled in store or through a form. In-store shopping, Peco Money and points work as normal.

Japanese terms at a glance#

Japanese Reading Meaning
セイコーマート（セコマ） Seikōmāto (Sekoma) Seicomart, a convenience store chain based in Hokkaido
セイコーマートクラブ Seikōmāto Kurabu Seicomart's loyalty program
ペコママネー Pekoma Manē Peco Money, Seicomart's electronic money
退会処理 taikai shori Membership cancellation
第三者に閲覧された可能性 daisansha ni etsuran sareta kanōsei "May have been viewed by a third party"

We will update this article when Seicomart publishes more.