Universal Music: unauthorized access to UNIVERSAL MUSIC STORE and other online stores
On 31 October 2025, Universal Music said customer data may have leaked through unauthorized access to its UNIVERSAL MUSIC STORE online shop. After social media posts suggested a leak, it began investigating on 25 October, found traces of unauthorized access, stopped part of the store the same day and reopened on 28 October. On 18 May 2026 it said the investigation was complete and confirmed that 3,105,585 customer records from UNIVERSAL MUSIC STORE and THE BEATLES STORE leaked: names, addresses, phone numbers, emails, purchase histories, birth dates, genders and more. Passwords and card data were not held in the system.
Disclosed
2025-10-31
Organizations involved
1
Leaked or at risk
3.1M
3,105,585
Downtime
Unknown
Timeline
- Detected 2025-10-25
- Disclosed 2025-10-31
- 6 days
Attack or cause
- Method
- [Intrusion]
- Impact
- [Data leak][Service outage]
- Entry point
- Unknown
Data exposed or at risk
Services hit
Organizations involved
[Breached][Critical]Tokyo, ShibuyaInformation and communications3,105,585 leaked
Universal Music LLC
Sources
- [1][Official]不正アクセス発生によるお客様の個人情報流出の可能性のお知らせとお詫びについてUniversal Music Japan · 2025-10-31
- [2][Official]ECサイトにおける不正アクセスに関する調査結果のお知らせとお詫びUniversal Music Japan · 2026-05-18
- [3][News]ユニバーサル ミュージック、ECサイト利用者310万人の個人情報漏えいを確認 昨年公表の不正アクセスでITmedia NEWS · 2026-05-18