and ST HD: 2.5M Customer Records May Have Leaked

Japanese apparel group and ST HD says an outsider broke into several of its business servers on 22 October and may have taken personal details belonging to about 2.5 million customers. The company’s notice, published on 23 October, says the possibly exposed data includes names, dates of birth, addresses, phone numbers and email addresses. Card details and customer passwords were not included.

The company found the intrusion within about two and a half hours and cut off the attacker’s route the same day. It has told the police and Japan’s data protection regulator. Its shops and web store are still trading, although members cannot use their loyalty points for now.

In brief

What happened: and ST HD says unauthorised access to multiple business servers on 22 October may have exposed data on about 2.5 million customers and about 10,000 business partners.
Why it matters: The records combine names, birth dates, home addresses and contact details, which can be used for convincing scam messages.
What’s next: The company is contacting affected people in turn, setting up an enquiry desk and reviewing any impact on its earnings.

How the intrusion unfolded

According to the notice, the unauthorised access began at about 07:30 Japan time on Thursday 22 October (23:30 BST on 21 October). An outsider made login attempts on several company servers one after another, got in, and extracted data.

The company says it detected the unauthorised activity at about 10:00 Japan time (02:00 BST) and isolated the affected servers. By 17:00 Japan time (09:00 BST) it had cut off the access route and shut down internal business systems to stop the damage spreading. It says it then confirmed that the route could no longer be used.

On 23 October, the company consulted the police and reported the incident to the Personal Information Protection Commission (PPC), Japan’s data protection regulator. It filed the same notice with the Tokyo Stock Exchange as a timely disclosure. The filing shows the company is listed on the exchange’s Prime market under code 2685.

The company has not said how the attacker got in or who was responsible. It says it has finished identifying the access method and dealing with it.

What may have leaked

The notice lists three groups of people. For about 2.5 million customers, the possibly exposed fields are name, date of birth, gender, address, phone number, email address and member ID. For about 10,000 business partners, they are company name, ordering and returns addresses, contact name, phone number and email address. The company is still working out which employee information is involved.

The company stresses what was not taken: “payment information such as credit card information, and passwords set by customers themselves, are not included” (translated).

Its web store, also called “and ST”, was not affected by the intrusion, the company says. Even so, members cannot currently use their points in shops or online. Kyodo News, as carried by the Okinawa Times, described the company as a major apparel group whose brands include Global Work, and reported that the company said no misuse of the information had been confirmed so far.

A run of Japanese breaches and the official advice

The disclosure comes amid a run of Japanese data breaches. TSN has covered several, including the wave of admissions earlier this month, Hankyu Hanshin’s H2O ID breach and Burger King Japan’s app leak.

Japan’s computer emergency response team, JPCERT/CC, first issued an alert on 8 October and updated it on 23 October. The alert says leaks of personal data through unauthorised access have been reported “one after another” at Japanese organisations since around September (translated). JPCERT/CC says the attacks are not built on a single common software flaw. Instead, attackers scan each target for known weaknesses and abuse APIs. The 23 October update adds attempts that use AI-based penetration-testing platforms. JPCERT/CC notes that its list does not mean the same method was used in every case.

JPCERT/CC recommends that organisations limit API request rates, enforce access controls on every API endpoint, and give tokens only the permissions they need. It also tells them to review how they detect intrusions and respond in the first hours, to warn customers about secondary harm in advance, and to delete data once its retention period or purpose has ended. and ST HD has not linked its incident to the cases JPCERT/CC describes, and the alert does not name the company.

Detection took hours, but extraction started first

Measured against its own timeline, and ST HD’s response was quick. The company spotted unauthorised activity about two and a half hours after the first login attempts, isolated the affected servers at that point, and closed the access route within the working day. It then checked that the route was shut, consulted the police and reported to the PPC the next day, and published its account through both its website and the stock exchange. For a listed retailer, that is a clear and early public record.

The limitation sits in the same timeline. The notice says login attempts, intrusion and data extraction happened in sequence before detection, so the speed of the response could limit the damage but not undo the copying that came first. JPCERT/CC’s advice reflects the same gap: it asks organisations to check how they detect intrusions and respond in the first hours, and to warn customers about secondary harm before any breach happens. The company has said it identified the access method but has not described it, so outsiders cannot yet judge whether the weakness was particular to and ST HD or common across the sector. Its promised follow-up, and any earnings disclosure, will be the next test of how fully it accounts for the incident.

Card data was spared, so members face phishing risk instead

The company’s statement that card data and customer passwords were not included rules out the most direct financial harm. Leaked passwords would not be the immediate problem here, and nor would fraudulent charges on stored cards.

What the notice does list is a full contact profile: name, birth date, gender, home address, phone, email and member ID for about 2.5 million records. That combination is what scam messages need to look genuine, so the main risk for members is fraud by email, text or phone that pretends to come from the retailer. The roughly 10,000 business-partner records carry a similar risk for staff who handle orders and returns. Employee data is still being assessed, so staff may face the same exposure once that review is finished. The company is contacting affected customers and partners in turn. Members should treat unexpected messages that mention their member ID or recent orders with caution, and contact the company only through the channels on its own website.

What happens next

and ST HD says it will contact affected customers and partners, open an enquiry desk, and report promptly if the incident is expected to have a material effect on its earnings. It is still determining how many employees are affected. The figure to watch is the employee count, the one part of the notice the company has not yet filled in.