Nojima Says Online Store Hack Leaked About 7m Member Records

Japanese electronics retailer Nojima says a hacker broke into the member system behind its online shop and leaked about 7 million member records. In a notice dated 2 November, the company said it detected the unauthorised access on Sunday 1 November and confirmed the same day that personal data had left its systems.

The Nojima data breach covers two sites: the Nojima Online web store and the company’s used-smartphone buy-back site. Both have been suspended. On 3 November Nojima added that it had forced a password reset for customers it suspects are affected, which makes this a story about what members should do now as much as about the scale.

What Nojima says leaked

According to Nojima’s notice, the Nojima data breach covers about 7 million records and excludes members who had already closed their accounts. Nojima counts records rather than people, so the number of individuals may differ.

For each member, the data includes name (in kanji and katakana), date of birth, gender, postcode, address and phone number, plus login ID, encrypted password and email address. Nojima says both sites are set up not to retain payment data, so no credit card information was held there.

The company says it has blocked outside access and stepped up monitoring, consulted the local police, and is preparing a report to the Personal Information Protection Commission and other bodies, which it plans to file promptly. Whether any of the data has already been misused, or caused further harm, is still under investigation. Both sites will stay offline until Nojima has confirmed they are safe, and it will announce the restart on the sites themselves.

Nojima data breach: the 3 November password reset

The Nojima Online notice page, updated on 3 November, adds one step that was missing from the first announcement. “With the safety of customers’ accounts as our top priority”, Nojima says, it has forced a reset of login passwords for customers suspected to be affected by the leak.

Members are asked to go to the site’s password reset page, enter their registered email address and phone number, and set a new password through the link that arrives by email. The company asks customers to choose a password that is hard to guess and not to reuse one they use elsewhere. Questions go to the Nojima Customer Centre on 0120-574-853, open 9:30 to 19:00 Japan time, or through an online form.

A clean card record is not a clean bill of health

Nojima’s decision not to hold card data is doing real work here: a breach of 7 million records without a single card number is a far smaller fraud problem than it could have been. But the fields that did leak are the ones that make impersonation easy. A full name in two scripts, a home address, a date of birth and a phone number are enough to make a fake delivery notice, repair callback or buy-back valuation sound genuine, and Nojima’s own warning points to exactly that risk of spoofed emails, texts and calls.

The passwords are the second concern. Nojima calls them encrypted but has not said how, and encryption that can be reversed is weaker than strong one-way hashing. The forced reset protects Nojima Online accounts, but it does nothing for any other service where a member used the same email and password. That is why the company’s line about not reusing passwords matters more than it looks, and why members should change any matching password elsewhere first.

The Nojima data breach also lands in a crowded autumn for Japanese consumer brands. TSN has covered Muji’s app breach, with up to 27.26 million records possibly exposed, and Club Tourism’s 4.32 million member records. Each announcement adds to a pool of Japanese names, addresses and phone numbers that scammers can combine. Nojima has not yet said how the attacker got in, and that answer will show whether the problem was specific to one shop system or something other retailers should check for too.

What Nojima Online members can do now

• Reset the Nojima Online password using the steps on Nojima’s official notice page, rather than through a link in an email or text.
• Change the password on any other account that used the same one, starting with email and shopping accounts.
• Treat unexpected messages about Nojima deliveries, repairs, refunds or buy-back payments with suspicion, and leave unfamiliar links and attachments unopened, as Nojima advises.
• Check with the Nojima Customer Centre on 0120-574-853 if unsure whether a message is genuine.

Readers of TSN’s So-net breach coverage will recognise the pattern: leaked contact details are often worth more to fraudsters than the systems they came from. Nojima says it will publish more once its investigation into the scope and cause is complete.

Sources

• Nojima: Apology and notice regarding personal data leak following unauthorised access to Nojima Online (PDF, Japanese, 2 November 2026)
• Nojima Online: notice and password reset steps (Japanese, updated 3 November 2026)

Related stories

• Muji Says App Breach May Have Exposed Up to 27.26m Customer Records
• Club Tourism Says Hack May Have Exposed 4.32m Member Records
• So-net Says Hack Exposed 2.59m Records and 54,401 Mail Passwords
• Arara Says Hackers Took 3.01m Email Addresses From Its Mail Service