Add preferred source
Fancl and its subsidiary Atenia said on Oct. 16 that their e-commerce sites in Japan were hit by unauthorized access, resulting in the leak of members’ personal information. The breach affected 368,184 Fancl members and 417,312 Atenia members, totaling 785,496 people. Names, addresses, phone numbers, dates of birth and other data were exposed, though passwords and credit card information were not included. The unauthorized access occurred between Oct. 3 and Oct. 10 and was discovered during an internal investigation on Oct. 15. Both companies have shut down the affected functions and reported the incident to Japan’s Personal Information Protection Commission and police. A dedicated hotline and email support will be available starting Oct. 17.
Key Elements
Fancl, a major Japanese cosmetics maker, and its subsidiary Atenia said on Oct. 16 that their e-commerce sites were subjected to unauthorized access by a third party, resulting in the external leak of members’ personal information. The number of affected members totals 785,496, comprising 368,184 Fancl customers and 417,312 Atenia customers.
The leaked data includes names, addresses, email addresses, phone numbers, dates of birth, gender and customer ID numbers. Login passwords and payment information such as credit card details were not included. At this point, there is no evidence that the leaked information has been made publicly available to an unspecified number of people, nor have any secondary damages such as fraudulent use been confirmed, according to the companies.
Timeline of the Unauthorized Access
According to both companies, the unauthorized access took place between Oct. 3 and Oct. 10. It was discovered during an internal investigation conducted on Oct. 15. The functions that caused the breach have already been shut down, and the companies reported the incident to Japan’s Personal Information Protection Commission and consulted with police on Oct. 16.
Affected members will be notified by email in sequence. Starting at 9 a.m. on Oct. 17, the companies will open a shared dedicated hotline (0120-333-600) and accept inquiries
Impact and Response
Fancl, headquartered in Yokohama, is a major cosmetics and health food company, while Atenia is its wholly owned subsidiary that operates an anti-aging skincare brand. The scale of this breach — roughly 780,000 records in total — ranks among the relatively large-scale information leak incidents in Japan’s domestic e-commerce sector.
The fact that credit card information was not included mitigates the severity of the damage to some extent. However, because names, addresses, phone numbers and dates of birth were leaked in combination, there are concerns that the data could be exploited for phishing scams or identity fraud. Both companies are expected to urge affected members to be cautious of suspicious emails and phone calls.
Japan’s Personal Information Protection Commission requires businesses to report personal information leak incidents, and it is possible that an investigation will proceed into whether the two companies’ security management systems had any deficiencies.
