> JapanHacked_
[Investigating][Severity: Critical][Intrusion]

istyle: @cosme leak exposes names, addresses and profiles of about 3 million members

@cosme was accessed without authorization and data of about 3 million common ID members, including former members, leaked: names, addresses, dates of birth, skin type and more.

Disclosed

2026-11-02 13:00

Organizations involved

1

Leaked or at risk

3M

3,000,000

Downtime

Unknown

What happened

  1. istyle confirmed that member data had leaked through unauthorized access to @cosme. [1]

  2. istyle disclosed the leak. [1] [2] [3]

Impact

About 3,000,000 holders of the @cosme common ID are affected, including people who have left. The data are the system-assigned user ID, nickname, name and its reading, postal code, address, phone number, email address, gender, date of birth, skin type and hair type. Passwords and card data are not included, and no misuse has been found. [1] [3]

Response

An outside investigator is assisting, and the Personal Information Protection Commission has been notified. Affected people will be contacted by 6 November. [1]

Timeline

  1. Detected 2026-10-28
  2. Disclosed 2026-11-02
  3. 5 days

Attack or cause

Method
[Intrusion]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Name][Postal address][Phone number][E-mail address][Gender][Date of birth][Member or customer ID]

Services hit

Organizations involved

Sources

  1. [1][Official]不正アクセスによる個人情報漏えいに関するお詫びとお知らせについてistyle · 2026-11-02 13:00
  2. [2][News]アットコスメ、会員約300万人分の情報漏えい　不正アクセスでITmedia NEWS · 2026-11-02 14:40
  3. [3][News]「アットコスメ」不正アクセス 約300万人分漏えい 肌質 髪質もNHK · 2026-11-02 15:04