Key information
Japanese second-hand retailer BOOKOFF Group Holdings announced a significant data breach involving its domestic member system. On October 13, 2026, the company confirmed that unauthorized third-party access occurred between October 4 and October 6, 2026, resulting in the exposure of 6,427,735 records belonging to 6,383,279 individuals, including 212,371 former members.
The breach impacted users registered through the official app, online store, and website. Exposed information includes names, birth dates, genders, email addresses, phone numbers, postal codes, addresses, loyalty card numbers, member IDs, and hashed passwords. BOOKOFF clarified that while hashed passwords cannot be read directly, members should still update them. Fortunately, credit card and bank account details were not stored in the compromised system, and identity documents from physical or mail-in acquisitions remained secure.
BOOKOFF stated that it blocked the unauthorized access points by October 6, 2026, and is currently conducting a comprehensive security review with external experts. The company has notified the Personal Information Protection Commission and local police regarding the incident.
Starting October 15, 2026, the company will notify affected members via email. BOOKOFF warned users to remain vigilant against phishing attempts, emphasizing that official communications will not request passwords or financial information, nor will they include direct links to password reset pages.
