From our other sites
The story
E-Store Inc., which runs the e-commerce platform support service “Shop-Serve,” announced that the personal information of roughly 23.35 million customers and users had been leaked. The exposed data includes names, addresses, phone numbers, and employers, with partial credit card information also compromised for about 2.09 million people. The unauthorized access itself was confirmed on August 1, but the full scope wasn’t revealed until October 16. On the thread, users questioned the gap between discovery and disclosure, and the discussion spread to the recent, nearly simultaneous leaks at Nikkei and Fancl/Attenir, with debate over the security of major online retailers like Amazon and Rakuten.
23.35 Million Online Shopping Customers’ Data Leaked — E-Commerce Support Platform Shop-Serve [Unauthorized Access][Personal Data Leak]: Asahi Shimbun
October 16, 2026, 9:03 PM — Miho Tanaka
E-Store Inc., which operates the e-commerce platform support service “Shop-Serve,” announced on the 16th that the personal information of approximately 23.35 million online shopping customers and users had been leaked. The affected data includes names, addresses, phone numbers, and places of employment, with partial credit card information included for about 2.09 million of those people. The company says it confirmed the leak, caused by unauthorized access, on August 1, and has since cut off communications from the attacker. As of the 16th, it states that “no secondary damage has been confirmed.”
Source: asahi.com / Original article here
What people said
Perfect timing to slip it in under all the other leak news!
I got an email about it.
Ages ago already.
Rakuten had its own thread about card leaks, but I bet their shopper info has leaked too.
Maybe they figure no one's targeting them?
…just kidding.
Yeah, foreign internet companies are the way to go.
You can't trust domestic services.
If they don't even use security tokens,
you shouldn't trust a domestic service at all.
Amazon's surprisingly solid, actually.
I use a dedicated email address just for Amazon, and I never get spam on it
— mail only ever comes from Amazon itself.
Is Rakuten Ichiba really okay, though?
Whether it's actually leaked or not, just assume it's already out there.
It's less "leaked" and more like they're selling it themselves to the dark web or some government.
It's fine — they've been leaking everything since order #1, so whether it's 1 order or 100, it's all the same.
The Chinese Communist Party's got their back,
so if anything that makes it safer.
https://www.itmedia.co.jp/news/article/2610/16/2000002337/
Is that basically their entire subscriber base?
Now that you mention it, I haven't heard of Asahi, Mainichi, or Tokyo Shimbun getting breached.
If you're gonna get hacked, don't collect personal info in the first place.
Online stores don't need to require registration just for points and stuff.
Just don't come crying for a product warranty later, okay?
Even without registering, they're still storing your info anyway.
The IC chip and private key are fine.
https://www.kanaloco.jp/news/economy/article-1313058.html
> Leaked data includes email addresses, names, addresses, phone numbers, dates of birth, customer numbers, and passwords.
Passwords too?? That's the bad kind of leak.
Honestly, these companies are done for…
And no email notice either — makes me furious.
Any place where payment is that easy to set up makes me a little nervous, honestly.
If you've got a security token set up for login,
you're probably fine for now.
Registering a payment method with a service that doesn't even offer
one-time passwords is just insane.
If Amazon ever goes down, the internet itself is basically over.
There was news today that Mercari data is being sold on the dark web.
Oh, right, that. I wonder how that's going to play out?
That kanji's rough for old folks to read.
"Flow" (流) would've been easier on them, lol
The Kumamoto gas leak explosion,
water leaks (more like flooding), too.
Just go under already, you crooks.
I got an email about it on September 21.
This announcement is the final report — the initial report was already published on August 1.
https://estore.jp/press/20260802/
And top them up at a convenience store instead of linking a credit card or bank account directly.
The security-conscious folks have been doing that all along.
Modern credit cards have these virtual card options now, right?
The single-use, one-and-done kind.
And with Apple Pay or Google Pay, the merchant shouldn't even see your actual card number.
Background and Key Points of This Discussion
Japan’s Act on the Protection of Personal Information requires companies to notify affected individuals and disclose a leak “promptly” after it’s discovered, but it sets no concrete deadline, and it’s not unusual for public disclosure to lag by months while a company prioritizes confirming the facts and reporting to regulators. In this case too, the unauthorized access was confirmed on August 1 and an initial report was published on August 2, but the final report covering the full scope didn’t come until October 16. Thread commenters criticized the company for “sitting on it for two months,” but in fact the initial disclosure was made back in August — this was the final report once the full extent of the damage had been confirmed, a distinction that’s easy to miss from the headline alone. Likewise, the phrase “partial credit card information” leaves open the possibility that full card numbers or security codes weren’t necessarily exposed, a nuance that got blurred together in the thread’s discussion. Around the same time, leaks were also reported at Nikkei Shimbun and at Fancl/Attenir, feeding a broader distrust of the security practices of online retail and e-commerce services in general.
*This article is compiled and summarized from the 5channel (News Express+) thread “23.35 Million Online Shopping Customers’ Data Leaked — E-Commerce Support Platform Shop-Serve.”
Leave a Reply