@cosme breach leaks data on about 3 million members, including skin and hair types
@cosme member accounts (istyle)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
istyle, which runs Japan's @cosme beauty review and shopping site, said on Nov 2 2026 that unauthorized access to @cosme, confirmed on Oct 28, leaked part of the member data tied to @cosme common IDs for about 3 million people, including members who have since left. The leaked fields are user IDs, nicknames, names, postal codes, addresses, phone numbers, email addresses, gender, birth dates, skin type and hair type. Login passwords and credit card data were not included. istyle has not disclosed how the attacker got in, is investigating with an outside security firm and says it has seen no misuse so far.
Why this severity: About 3 million members' names, addresses, phone numbers, emails and birth dates confirmed leaked; no passwords or card data; the access method has not been disclosed
- Started
- Oct 28, 2026
Affected
Not published yet
Fixed in
No fixed release yet
Timeline3
istyle's planned completion date for emailing affected members individually from the cosme.net domain.
istyle discloses the breach: about 3 million members, including people who have since left, had user IDs, nicknames, names, postal codes, addresses, phone numbers, emails, gender, birth dates, skin type and hair type leaked. Login passwords and card data were not included. It has reported to Japan's Personal Information Protection Commission and is investigating with an outside security firm.
istyle confirms that a third party's unauthorized access to @cosme leaked part of the member data registered to @cosme common IDs, and starts containment.
Advisories1
News & write-ups3
Notes & caveats
istyle says the user ID that leaked is auto-assigned and is not used to log in. It has not said when the access began or how it happened.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
