Joshin network intrusion may have leaked up to 6 million member records
Joshin member database, Joshin subscription service and renovation photo upload system
Joshin, the Osaka-based operator of the Joshin electronics retail chain, detected unauthorized access to its network on Oct 16 2026 and cut off the affected servers, which left some services offline. In its second report on Oct 26 it said data that may have leaked includes up to about 6 million records from its member database (name, address, phone number, member number), up to about 230,000 records from its Joshin subscription service (including login IDs, initial passwords, handwritten signatures, billing history and device IDs), and up to about 800 records from a renovation photo upload system (including two driver's license images, one My Number card and five bank account numbers). Joshin says the counts are possible exposure, not confirmed leaks, that it holds no credit card data, and it warns customers about phishing emails, SMS and calls impersonating the company.
Why this severity: Up to about 6 million customer records (names, addresses, phone numbers) and about 230,000 subscription accounts with login IDs and initial passwords possibly exposed; leak not yet confirmed by Joshin
- Started
- Oct 16, 2026
Affected
- Joshin member information database server (up to ~6M records)
- Joshin subscription service (up to ~230K records)
- Renovation photo upload system (up to ~800 records)
Fixed in
No fixed release yet
Timeline3
Second report: up to ~6M member records, ~230K subscription records (login IDs, initial passwords) and ~800 renovation-system records may have leaked; no credit card data held.
Joshin publishes its first notice of a system outage caused by unauthorized access, and files it with the Tokyo Stock Exchange on Oct 19.
Joshin detects an anomaly on its network, finds traces of unauthorized access and disconnects the affected servers; some services go offline. Police and Japan's Personal Information Protection Commission are notified.
Advisories1
News & write-ups4
Notes & caveats
Counts are maximum possible exposure per Joshin, not confirmed leaks; no attacker or ransomware group named yet. Update when Joshin confirms scope or attribution.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
