FANCL, the Japanese cosmetics and supplements company owned by Kirin Holdings, and its subsidiary ATENEA say their online shops were accessed without authorisation over eight days in October, and that member data was leaked. Together the two companies report 368,184 FANCL members and 417,312 ATENEA members affected. They say no payment information was taken, and they have not disclosed how the attackers got in.
What the companies disclosed
In a joint notice dated 16 October 2026, FANCL and ATENEA said an internal investigation on 15 October found that their e-commerce sites had been accessed without authorisation between 3 and 10 October. They set up an emergency response headquarters that day, confirmed that some member information had leaked, then identified and shut down “the function that caused” the breach.
The companies gave these figures:
- FANCL: 393,785 records covering 368,184 people.
- ATENEA: 441,162 records covering 417,312 people.
The leaked information includes email addresses, names, postal addresses, phone numbers, dates of birth, gender, customer numbers, security-question items (but not the answers) and other registration details such as points and membership status. Some sub-email addresses and their passwords were also exposed. These were secondary passwords that some members had set, stored in hashed (scrambled) form, and the companies say members’ main passwords were not affected. Credit card and other payment details were not included.
What is not known
The companies say they are withholding details of the cyberattack “to prevent further damage”, so the attacker and the way in remain undisclosed. They say they have found no other unauthorised access or malware infection and no impact on their business, and that so far they have seen no sign the data has been published, misused or reported by customers. They reported the incident to Japan’s Personal Information Protection Commission and the police on 16 October.
Kirin’s view
Parent company Kirin Holdings also disclosed the incident. According to Japan IR’s English summary of Kirin’s filing, Kirin is examining the impact on its consolidated results and will disclose it separately if it proves material. Japan IR notes that its summary is AI-generated from the stock exchange filing.
Advice for members
FANCL and ATENEA warn that the leaked data could be used in impersonation emails and phishing scams. They urge members to be careful with unexpected emails, text messages and calls, and not to open unfamiliar links or attachments. They say they will never ask for passwords or card details, and they recommend changing passwords regularly. Affected members will be contacted individually by email. A joint hotline for both brands opens at 9am (Japan time) on 17 October, staffed from 9am to 5pm including weekends and holidays, and customers can also write to the companies by email.
Timeline in brief
- 3-10 October: unauthorised access to the FANCL and ATENEA online shops, according to the companies.
- 15 October: an internal investigation finds the access. The same day, an emergency response headquarters is set up, the leak is confirmed and the function responsible is stopped.
- 16 October: the companies report to the Personal Information Protection Commission and consult the police. FANCL, ATENEA and Kirin disclose the incident publicly.
- 17 October: the customer hotline opens.
The companies say they will publish any new facts promptly.
Why it matters
This is a large leak from consumer online shops, where many customers are long-standing members whose names, addresses and birth dates are now exposed. It adds to a series of large data leaks disclosed by Japanese companies this year. It is a separate incident from Nikkei’s development-cloud leak, disclosed the same day.
What this means
- About 785,000 people across FANCL (368,184) and ATENEA (417,312) are affected, according to the companies. Payment data and main passwords were not included.
- How the attackers got in has not been disclosed. The companies say they stopped the function responsible.
- Members should expect, and be wary of, phishing that uses their real names, addresses or birth dates.
Sources
- FANCL and ATENEA: Notice on personal information leak due to unauthorised access (Japanese, PDF)
- Japan IR: Summary of Kirin Holdings disclosure on FANCL data leak
Related stories
- Burger King Japan Says About 11.18 Million App Member Records Leaked After Unauthorised Access
- Japan’s Commune Confirms About 307,000 Community Members’ Data Leaked; Sansan and Panasonic Say Their Forums Were Hit
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
