PAL: credential stuffing on its PAL CLOSET online store, 194,307 of 1,722,379 login attempts succeeded

1. 2025-06-15

   Suspected credential-stuffing logins using credentials obtained elsewhere ran through the 16th. [1]

2. 2025-06-16

   It invalidated the passwords of all members. [1]

3. 2025-06-20

   It announced the incident, emailed the members with confirmed unauthorized logins and reported it to the Personal Information Protection Commission. [1] [2]

There were 1,722,379 login attempts and 194,307 succeeded. The member page shows name, kana, gender, date of birth, postal code, address, phone number and barcode number. The system cannot identify which members' pages were viewed. Credit card data is not on the page and is not held. [1] [3]

Passwords were stored hashed, and it found no sign that IDs and passwords leaked from inside. No secondary harm such as fraudulent orders was confirmed at the time of the announcement. [1]