[Contained][Severity: Critical][Intrusion]

FANCL and Attenir: unauthorized access to their online shops

The FANCL and Attenir online shops were accessed without authorization from 3 to 10 October, and member data leaked: 393,785 FANCL records (368,184 people) and 441,162 Attenir records (417,312 people). An internal check found it on 15 October, and the companies stopped the function that caused it. Names, addresses, phone numbers, birth dates, email addresses and hashed secondary passwords are affected; payment data is not.

Disclosed

2026-10-16

Organizations involved

Leaked or at risk

441.2K

441,162

Downtime

Unknown

Timeline

Started 2026-10-03
Detected 2026-10-15
Disclosed 2026-10-16
13 days

Attack or cause

Method: [Intrusion]
Impact: [Data leak]
Entry point: Web app

Data exposed or at risk

[Name][Postal address][Phone number][Date of birth][Gender][E-mail address][Passwords]

Organizations involved

[Breached][Critical]Kanagawa, Yokohama, NakaManufacturing393,785 leaked
FANCL Corporation
[Breached][Critical]Kanagawa, Yokohama, SakaeManufacturing441,162 leaked
Attenir Corporation

						Note
FANCL Corporation	[Breached]	[Critical]	Kanagawa, Yokohama, Naka	Manufacturing	393,785
Attenir Corporation	[Breached]	[Critical]	Kanagawa, Yokohama, Sakae	Manufacturing	441,162

Open in organization search

Sources

[1][Official]第三者による不正アクセスに伴う個人情報漏えいに関するお詫びとお知らせFANCL and Attenir · 2026-10-16