# Joshin network intrusion may have leaked up to 6 million member records · pwn.watch

> Joshin, the Osaka-based operator of the Joshin electronics retail chain, detected unauthorized access to its network on Oct 16 2026 and cut off the affected servers, which left some services offline. In its second report on Oct 26 it said data that may have leaked includes up to about 6 million records from its member database (name, address, phone number, member number), up to about 230,000 records from its Joshin subscription service (including login IDs, initial passwords, handwritten signatures, billing history and device IDs), and up to about 800 records from a renovation photo upload system (including two driver's license images, one My Number card and five bank account numbers). Joshin says the counts are possible exposure, not confirmed leaks, that it holds no credit card data, and it warns customers about phishing emails, SMS and calls impersonating the company.

Page: https://pwn.watch/i/joshin-unauthorized-access-6m-member-records-oct-2026 · generated 2026-10-27T06:43:02.033Z

## Status
- Severity: high · status: live · patch: no-fix-needed
- Product: Joshin member database, Joshin subscription service and renovation photo upload system
- Started: 2026-10-16
- Affected: Joshin member information database server (up to ~6M records); Joshin subscription service (up to ~230K records); Renovation photo upload system (up to ~800 records)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/joshin-unauthorized-access-6m-member-records-oct-2026/feed.xml
- JSON Feed: https://pwn.watch/i/joshin-unauthorized-access-6m-member-records-oct-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/joshin-unauthorized-access-6m-member-records-oct-2026.json
- This file: https://pwn.watch/i/joshin-unauthorized-access-6m-member-records-oct-2026/llms.txt

## Updates (newest first)
- 2026-10-26: Second report: up to ~6M member records, ~230K subscription records (login IDs, initial passwords) and ~800 renovation-system records may have leaked; no credit card data held. (https://www.joshin.co.jp/ja/ir/news/auto_20261026556267/pdfFile.pdf)
- 2026-10-17: Joshin publishes its first notice of a system outage caused by unauthorized access, and files it with the Tokyo Stock Exchange on Oct 19. (https://www.joshin.co.jp/ja/ir/news/auto_20261026556267/pdfFile.pdf)
- 2026-10-16: Joshin detects an anomaly on its network, finds traces of unauthorized access and disconnects the affected servers; some services go offline. Police and Japan's Personal Information Protection Commission are notified. (https://www.joshin.co.jp/ja/ir/news/auto_20261026556267/pdfFile.pdf)

## Fix brief
# Security brief: Joshin network intrusion may have leaked up to 6 million member records

Source: https://pwn.watch/i/joshin-unauthorized-access-6m-member-records-oct-2026 · status: live · severity: high · updated Oct 27, 2026, 04:48 UTC

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
Joshin, the Osaka-based operator of the Joshin electronics retail chain, detected unauthorized access to its network on Oct 16 2026 and cut off the affected servers, which left some services offline. In its second report on Oct 26 it said data that may have leaked includes up to about 6 million records from its member database (name, address, phone number, member number), up to about 230,000 records from its Joshin subscription service (including login IDs, initial passwords, handwritten signatures, billing history and device IDs), and up to about 800 records from a renovation photo upload system (including two driver's license images, one My Number card and five bank account numbers). Joshin says the counts are possible exposure, not confirmed leaks, that it holds no credit card data, and it warns customers about phishing emails, SMS and calls impersonating the company.

Severity detail: Up to about 6 million customer records (names, addresses, phone numbers) and about 230,000 subscription accounts with login IDs and initial passwords possibly exposed; leak not yet confirmed by Joshin

- Product: Joshin member database, Joshin subscription service and renovation photo upload system

## Affected versions
- Joshin member information database server (up to ~6M records)
- Joshin subscription service (up to ~230K records)
- Renovation photo upload system (up to ~800 records)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Oct 26, 2026: Second report: up to ~6M member records, ~230K subscription records (login IDs, initial passwords) and ~800 renovation-system records may have leaked; no credit card data held.
- Oct 17, 2026: Joshin publishes its first notice of a system outage caused by unauthorized access, and files it with the Tokyo Stock Exchange on Oct 19.
- Oct 16, 2026: Joshin detects an anomaly on its network, finds traces of unauthorized access and disconnects the affected servers; some services go offline. Police and Japan's Personal Information Protection Commission are notified.

## Advisories
- [不正アクセスによるシステム障害発生のお詫びとお知らせ（第 2 報）](https://www.joshin.co.jp/ja/ir/news/auto_20261026556267/pdfFile.pdf) (Joshin)

## Write-ups & news
- [Ｊｏｓｈｉｎ、不正アクセスで最大約600万件の会員情報などが漏えいの可能性](https://internet.watch.impress.co.jp/docs/news/2151273.html)
- [ジョーシンへの不正アクセス、最大623万件漏えいか　運転免許証2件・マイナカード1件なども](https://www.itmedia.co.jp/news/article/2610/26/2000002601/)
- [Joshin、顧客の個人情報最大600万件漏洩　免許証やマイナカードも](https://www.nikkei.com/article/DGXZQOUF2682P0W6A021C2000000/)
- [Joshin不正アクセス 顧客情報600万件漏えいの可能性](https://news.web.nhk/newsweb/na/nd-20261026de65988)

## Caveats
Counts are maximum possible exposure per Joshin, not confirmed leaks; no attacker or ransomware group named yet. Update when Joshin confirms scope or attribution.

---
Machine-readable: https://pwn.watch/i/joshin-unauthorized-access-6m-member-records-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.