Hankyu Hanshin Department Stores says hackers obtained part of the personal information of almost all members of its H2O ID membership system. In a notice published on 19 October, it put the scale at about 1.26 million H2O ID records. Names, home addresses, phone numbers, email addresses and dates of birth are among the details involved.
For Hankyu and Hanshin customers, the immediate risk is fraud by impersonation. The leaked data is exactly what scammers need to send convincing fake messages, and the company is warning members to treat unexpected emails, texts and calls with suspicion.
In brief
- Hankyu Hanshin Department Stores says part of the personal data of about 1.26 million H2O IDs leaked, covering almost all members.
- The leaked fields include names, gender, addresses, phone numbers, email addresses, ages and dates of birth.
- The company is still investigating whether data from its HANKYU HANSHIN E-STORES and Remo Order services was taken.
How the breach unfolded
According to the company, it found unauthorised access to its customer-management system on Friday 16 October, coming in through the Hankyu and Hanshin department store reservation site. It blocked the malicious traffic and shut down that site’s entire system the same day.
The problem then spread to other services. On Saturday 17 October, the company says, it confirmed unauthorised access to its online shop, HANKYU HANSHIN E-STORES, and to Remo Order, and stopped both systems. On Monday 19 October its investigation found that part of the personal data for about 1.26 million H2O IDs held in the customer-management system had leaked.
The company’s Japanese notice is blunt about the scope. It says that while the investigation continues, part of the personal information of “ほぼ全ての” (almost all) H2O ID members has leaked. It has reported the breach to Japan’s Personal Information Protection Commission and to the police, and says it is emailing H2O ID members in turn.
What was taken, and what may have been
The confirmed leak covers the H2O ID system. The company lists the affected details as the H2O ID itself, names in kanji and kana, gender, email address, postcode, address, mobile and landline numbers, age, date of birth and the services each member used with the ID.
The online shop is a separate question. For E-STORES and Remo Order, the company says it is still investigating whether any data leaked. Those services hold order histories, address-book entries and part of members’ card details: the card type, last four digits, cardholder name and expiry date. They also hold the type and last four digits of point cards.
The company stresses what is not at risk. It says it does not store full card numbers or security codes, so the card data cannot be used for fraudulent payments, and that the point-card digits cannot be used to spend points. It adds that no leak of login passwords has been confirmed, and that no misuse or secondary damage has been found so far.
| Service | Status |
|---|---|
| Reservation site (H2O ID) | Leak confirmed, about 1.26 million IDs |
| HANKYU HANSHIN E-STORES | Leak under investigation; reopened 19 Oct |
| Remo Order | Leak under investigation |
Phishing is the main danger for members
The company warns that fraudsters may contact members by email, SMS or phone while posing as the department stores, using the leaked addresses and numbers. It says its genuine messages about the breach come only from noreply@h2o-retailing.co.jp, and has set up a dedicated call centre.
Some services are already coming back. A second notice says E-STORES reopened at 14:00 Japan time (06:00 UK time) on 19 October after the company completed prevention measures and safety checks. The company says other services will return once the cause has been found and the vulnerability fixed.
The disclosure came on a day of breach notices in Japan. According to Kyodo, as published by the Mainichi, parent company H2O Retailing also announced the incident. The trade agency JETRO, email-delivery firm Ymirlink, 2nd Retailing, Joshin and others reported unauthorised access the same day, though none has said the incidents are linked.
Our read
This is TSN’s analysis. A membership database with names, addresses, birth dates and phone numbers for almost every member is a ready-made target list for impersonation scams. The company’s decision not to store full card numbers limits the financial damage, but that protection does not extend to personal details. The open question is what the E-STORES and Remo Order investigation finds, and whether the company publishes how the attackers got in through a reservation site.
Sources
- Hankyu Hanshin Department Stores: 第三者による不正アクセス発生と個人情報漏えいに関するお詫びとお知らせ, 19 October 2026
- Hankyu Hanshin Department Stores: 「HANKYU HANSHIN E-STORES」再開のお知らせ, 19 October 2026
- Kyodo via the Mainichi: Japan trade agency, Japanese firms face unauthorized access, 20 October 2026
Related stories
- Japan’s Data-Breach Wave: What Bookoff, Times Car, skyticket, Lawson, Resorttrust and Others Have Admitted
- Nikkei Says 1.83 Million Personal Data Items Leaked From a Development Cloud
- Yamato Transport Says About 5.26 Million Pay-Later Customer Records Were Taken
- Burger King Japan Says About 11.18 Million App Member Records Leaked After Unauthorised Access
- Hollys Coffee Says Hackers Leaked Members’ IDs, Passwords and Addresses
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
