[Investigating][Severity: Critical][Web app exploit]

CBcloud: PickGo breach leaks 7NOW and Demae-can customer data

A PickGo breach exposed 7NOW and Demae-can customer data; their largest stated cohorts are 164,180 and 799 names respectively.

Disclosed

2026-11-02

Organizations involved

Leaked or at risk

164.2K

164,180

Downtime

Unknown

What happened

CBcloud detected unauthorized access to PickGo on 1 November. It fixed a functional flaw, disabled misused accounts, blocked access sources and restricted some functions and access from outside Japan. It is investigating possible exposure of shipper and delivery-partner data. [1]

Customer impact

On 3 November, 7NOW and Demae-can each confirmed theft of customer data from delivery contractor CBcloud. Some order dates, items and store details were also included. Both exclude payment-card and login information and report no known misuse. 7NOW continues normal operation. Demae-can suspended its CBcloud connection around 14:00 on 2 November and resumed it around 21:00 after safety checks. [2] [3]

Timeline

Detected 2026-11-01
Disclosed 2026-11-02
1 days

Attack or cause

Method: [Web app exploit]
Impact: [Data leak][Service outage]
Entry point: Web app

Data exposed or at risk

[Name][Postal address][Phone number][Purchase history]

Supply chain

CBcloud Co., Ltd.

[Breached]

CBcloud Co., Ltd.

[Breached]

Organizations listed on this site: 3

Services hit

Service	Role	Impact level
7NOW	[Through a supplier]	[Critical]
PickGo	[Breached]	[Critical]
Demae-can	[Through a supplier]	[Major]

Open in service search

Organizations involved

[Breached][Critical]Okinawa, NahaInformation and communications
CBcloud Co., Ltd.
[Through a supplier][Critical]Tokyo, ChiyodaWholesale and retail trade164,180 leaked
Seven-Eleven Japan Co., Ltd.
164,180 kana-name-only records, 4,762 with kana names and addresses, and 209 also with phone numbers and postcodes. No combined total was published.
[Through a supplier][Major]Tokyo, ShibuyaInformation and communications799 leaked
Demae-Can Co., Ltd.
799 names, 794 addresses and 33 phone numbers/postcodes; these overlapping categories are not added.

						Note
CBcloud Co., Ltd.	[Breached]	[Critical]	Okinawa, Naha	Information and communications	Unknown
Seven-Eleven Japan Co., Ltd.	[Through a supplier]	[Critical]	Tokyo, Chiyoda	Wholesale and retail trade	164,180	164,180 kana-name-only records, 4,762 with kana names and addresses, and 209 also with phone numbers and postcodes. No combined total was published.
Demae-Can Co., Ltd.	[Through a supplier]	[Major]	Tokyo, Shibuya	Information and communications	799	799 names, 794 addresses and 33 phone numbers/postcodes; these overlapping categories are not added.

Open in organization search

Sources

[1][Official]「ピックゴー」への不正アクセス及び個人情報流出の可能性について（第1報）CBcloud · 2026-11-02
[2][Official]当社デリバリーサービス「7NOW」の委託先への不正アクセスに伴う、お客様情報の漏えいについてのお知らせとお詫びSeven-Eleven Japan · 2026-11-03
[3][Official]委託先による不正アクセスに伴う、お客様情報の漏えいについてのお知らせとお詫びDemae-can · 2026-11-03