[Contained][Severity: Major][Web app exploit]

ZIGZAG: break-in at the WorldShopping cross-border shopping service leaked names and addresses of 301 overseas customers

Part of WorldShopping, which lets overseas customers buy from Japanese online shops, was broken into; data of 301 customers in Taiwan, Hong Kong, the US and elsewhere leaked.

Disclosed

2026-10-19

Organizations involved

Leaked or at risk

301

Downtime

Unknown

What happened

2026-10-15
Until 16 October, a third party accessed part of the service's systems and took customers' personal data. [1]
2026-10-16
The company noticed suspicious outside access and began to investigate. [1]
2026-10-19
Disclosed in a stock exchange filing. [1] [2]

Impact

301 customers (as of 19 October) living in Taiwan, Hong Kong, the US, South Korea, China and elsewhere: email addresses, names, addresses, phone numbers and order details, with the items varying by person. Card data and passwords are not included. [1]

Data held for online shops through WorldShopping BIZ is not affected. The service runs as usual. [1]

Response

The company blocked the entry path and fixed flaws in its email system and input forms. It disabled and reissued the credentials the attacker used. It is reporting to the Personal Information Protection Commission and to authorities in countries and regions where the law requires it, and is emailing the affected customers. [1]