Topic
Japanese electronics retailer EDION found attackers reading the log files of its online store, which held card numbers with security codes, gift card PINs and passwords. Investigating that, it found its PC payment page had been altered to steal card details since November 4, the day before. Card data 'non-retention' did not help.
Nitori Holdings, Japan's largest furniture and home goods chain, says up to 37.62 million records may have leaked after unauthorized access found on November 6, with signs of access from mid-October. The data covers individual members, people who bought without an account, corporate members and orders placed through its shops on online malls. No passwords or card data. The cause has not been disclosed.
IncidentsUpdated
Ryohin Keikaku, which runs MUJI, first said only email addresses, birth dates and gender of app users may have leaked. Its second report widened that to online store customers, about 520,000 names and addresses, and full card numbers of about 1.09 million MUJI Card holders, received from Credit Saison for a points scheme that stopped using them in 2021 but never deleted.
IncidentsUpdated
Attackers took names, birth dates, addresses and password hashes for 6.38 million Bookoff members (6.43 million records) from its domestic member system in October 2026.
IncidentsUpdated
Japanese convenience store chain Lawson says attackers took names, birth dates and some addresses tied to 2.15 million Lawson ID accounts in September via its app. It later corrected its notice: email addresses did not leak.
Japanese convenience store chain Lawson says a third party used its real mail server to send about 700,000 English-language scam emails with disguised senders.
IncidentsUpdated
Shoemaker Moonstar announced suspected unauthorized access in March and found no leak. It now says data on up to 593,000 online store customers likely leaked in May, and learned of it from a customer's phishing email.
IncidentsUpdated
Japanese fashion retailer ABAHOUSE learned its member and order data had been taken only when customers reported scam refund emails quoting their real orders.
IncidentsUpdated
Hokkaido convenience store chain Seicomart says an attacker reached its member database through its app server and viewed data on 574,647 members.
IncidentsUpdated
Keio, the Tokyo rail and retail group hit by ransomware on September 26, 2026, says a group claiming the attack has published part of its data. Qilin listed Keio on its leak site on October 16. What Keio has confirmed so far.