Hankyu Hanshin Department Stores: unauthorized access to booking and other sites leaks H2O ID member data
On 16 October, unauthorized access to the customer management system was found via the reservation site run by Hankyu Hanshin Department Stores. On 17 October access was also found on the HANKYU HANSHIN E-STORES and Remo Order shopping sites, and all three services were shut down. On 19 October it found that names, genders, emails, addresses, phone numbers, birth dates and more of about 1.26 million records, nearly all members of the group-wide H2O ID, had leaked. Whether the two shopping sites leaked data is under investigation.
Disclosed
2026-10-19
Organizations involved
2
Leaked or at risk
1.3M
1,260,000
Downtime
Unknown
Timeline
- Detected 2026-10-16
- Disclosed 2026-10-19
- 3 days
Attack or cause
- Method
- [Intrusion]
- Impact
- [Data leak][Service outage]
- Entry point
- Web app
Data exposed or at risk
Services hit
Organizations involved
[Breached][Critical]Osaka, Osaka, KitaWholesale and retail trade1,260,000 leaked
Hankyu Hanshin Department Stores, Inc.[Breached][Critical]Osaka, Osaka, KitaWholesale and retail trade
H2O Retailing Corporation
Sources
- [1][Official]第三者による不正アクセス発生と個人情報漏えいに関するお詫びとお知らせHankyu Hanshin Department Stores · 2026-10-19
- [2][News]阪急阪神百貨店などの共通ID、ほぼ全会員分漏えい 約126万件 予約サイトに不正アクセスITmedia NEWS · 2026-10-19