H2O Retailing says a reservation-site intrusion leaked data from about 1.26 million H2O ID records

TLDR

• H2O Retailing and Hankyu Hanshin Department Stores say part of about 1.26 million H2O ID records leaked.¹²
• Exposed fields include name, email, address, phone number and date of birth; no misuse has been confirmed so far.¹²
• The company has reported the incident to the Personal Information Protection Commission and the police, and warns of impersonation contacts.¹²

ITmedia reports that H2O Retailing and Hankyu Hanshin Department Stores announced on 19 October that unauthorised access to their systems had leaked part of about 1.26 million H2O ID records, which ITmedia and ASCII.jp describe as nearly all of the common ID's members.¹² The affected items are the H2O ID, name, gender, email address, postal code, address, phone and mobile numbers, age, date of birth and the services used.¹² The Asahi Shimbun's English report also lists the last four digits of card numbers among the H2O ID data, whereas ITmedia and ASCII.jp attribute card data (card type, last four digits, cardholder name and expiry) only to the HANKYU HANSHIN E-STORES and Remo Order sites, where they say the extent of any leak is still under investigation.¹²³

On timing, ITmedia says the company confirmed unauthorised access through its reservation site on 16 October, blocked the traffic and halted the whole reservation site that day, then confirmed access to HANKYU HANSHIN E-STORES and Remo Order on 17 October and stopped both, with the leak itself established on 19 October.¹ ASCII.jp says the breach was discovered on the 19th, and the Japanese Asahi report says access came through three sites between 16 and 17 October.²⁵ ITmedia says no misuse or secondary damage has been confirmed, that full card numbers and security codes are not held, and that no leak of login passwords has been confirmed.¹ The company has reported the incident to the Personal Information Protection Commission and the police, is emailing members, and warns of impersonation contacts.¹²

The Yomiuri Shimbun reported other disclosures in its 19 October roundup. It says Nifty may have leaked up to 542,513 records belonging to people who applied for its services since 2019, and that Estore Corp., which runs the ShopServe e-commerce platform, put the number of affected people at about 23.36 million, including about 2.1 million with partial credit card information.⁴ It also says Trustbank suspended its Furusato Choice donation service over suspected unauthorised access.⁴⁵ Yomiuri adds that JETRO reported 743 records.⁴ The Asahi Shimbun places Estore among the disclosures of recent days, so the Estore figure may predate 19 October.³ The Asahi also cites the MM Research Institute as counting 454 reported leaks from January to September, about 1.5 times the year-earlier figure, and 19 cases of at least one million records as of mid-October.³

Why it matters: because H2O ID is a common login across the group's department store services, one intrusion reached nearly the whole membership base, and the exposed contact details and birthdates are the kind of data used in impersonation and phishing attempts, which the company itself warns about.¹²