# @cosme breach leaks data on about 3 million members, including skin and hair types · pwn.watch > istyle, which runs Japan's @cosme beauty review and shopping site, said on Nov 2 2026 that unauthorized access to @cosme, confirmed on Oct 28, leaked part of the member data tied to @cosme common IDs for about 3 million people, including members who have since left. The leaked fields are user IDs, nicknames, names, postal codes, addresses, phone numbers, email addresses, gender, birth dates, skin type and hair type. Login passwords and credit card data were not included. istyle has not disclosed how the attacker got in, is investigating with an outside security firm and says it has seen no misuse so far. Page: https://pwn.watch/i/istyle-cosme-member-data-breach-3m-nov-2026 · generated 2026-11-08T20:22:39.494Z ## Status - Severity: high · status: live · patch: partial - Product: @cosme member accounts (istyle) - Started: 2026-10-28 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/istyle-cosme-member-data-breach-3m-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/istyle-cosme-member-data-breach-3m-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/istyle-cosme-member-data-breach-3m-nov-2026.json - This file: https://pwn.watch/i/istyle-cosme-member-data-breach-3m-nov-2026/llms.txt ## Updates (newest first) - 2026-11-06: istyle's planned completion date for emailing affected members individually from the cosme.net domain. (https://www.istyle.co.jp/news/info/2026/11/1102.html) - 2026-11-02: istyle discloses the breach: about 3 million members, including people who have since left, had user IDs, nicknames, names, postal codes, addresses, phone numbers, emails, gender, birth dates, skin type and hair type leaked. Login passwords and card data were not included. It has reported to Japan's Personal Information Protection Commission and is investigating with an outside security firm. (https://www.istyle.co.jp/news/info/2026/11/1102.html) - 2026-10-28: istyle confirms that a third party's unauthorized access to @cosme leaked part of the member data registered to @cosme common IDs, and starts containment. (https://www.istyle.co.jp/news/info/2026/11/1102.html) ## Fix brief # Security brief: @cosme breach leaks data on about 3 million members, including skin and hair types Source: https://pwn.watch/i/istyle-cosme-member-data-breach-3m-nov-2026 · status: live · severity: high · updated Nov 8, 2026, 16:17 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is istyle, which runs Japan's @cosme beauty review and shopping site, said on Nov 2 2026 that unauthorized access to @cosme, confirmed on Oct 28, leaked part of the member data tied to @cosme common IDs for about 3 million people, including members who have since left. The leaked fields are user IDs, nicknames, names, postal codes, addresses, phone numbers, email addresses, gender, birth dates, skin type and hair type. Login passwords and credit card data were not included. istyle has not disclosed how the attacker got in, is investigating with an outside security firm and says it has seen no misuse so far. Severity detail: About 3 million members' names, addresses, phone numbers, emails and birth dates confirmed leaked; no passwords or card data; the access method has not been disclosed - Product: @cosme member accounts (istyle) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes There is nothing to patch. If you have or had an @cosme account, expect phishing, SMS and phone scams that quote your name, address and birth date. istyle's notices come from the cosme.net domain and it says it will never ask for passwords or card details by email. ## Latest updates - Nov 6, 2026: istyle's planned completion date for emailing affected members individually from the cosme.net domain. - Nov 2, 2026: istyle discloses the breach: about 3 million members, including people who have since left, had user IDs, nicknames, names, postal codes, addresses, phone numbers, emails, gender, birth dates, skin type and hair type leaked. Login passwords and card data were not included. It has reported to Japan's Personal Information Protection Commission and is investigating with an outside security firm. - Oct 28, 2026: istyle confirms that a third party's unauthorized access to @cosme leaked part of the member data registered to @cosme common IDs, and starts containment. ## Advisories - [不正アクセスによる個人情報漏えいに関するお詫びとお知らせについて](https://www.istyle.co.jp/news/info/2026/11/1102.html) (istyle Inc.) ## Write-ups & news - [アイスタイル、アットコスメ会員300万人の情報流出　肌や髪データも](https://www.nikkei.com/article/DGXZQOUC025YN0S6A101C2000000/) - [アットコスメ、会員約300万人分の情報漏えい　不正アクセスで](https://www.itmedia.co.jp/news/article/2611/02/2000002795/) - [「@cosme」に不正アクセス、約300万人の会員情報が漏えい](https://scan.netsecurity.ne.jp/article/2026/11/06/56696.html) ## Caveats istyle says the user ID that leaked is auto-assigned and is not used to log in. It has not said when the access began or how it happened. --- Machine-readable: https://pwn.watch/i/istyle-cosme-member-data-breach-3m-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.