PEPPY: shops stopped and images deleted; data for 6,503 veterinary clinics at risk

1. 2026-11-03

   A third party accessed the cloud storage area used by PEPPY Co., Ltd. and deleted product images, invoice-related data and images uploaded by users. [1]

2. 2026-11-04

   After detecting the incident, it temporarily suspended the PEPPY online shop and the PEPPYvet veterinary shop to check safety and limit damage. [1]

3. 2026-11-07

   After disabling the affected credentials and taking other steps, it restored PEPPY and PEPPYvet. Some product images, pages and past invoices remained unavailable. [1]

Invoice-related data handled by PEPPYvet included veterinary clinic names, representatives’ names and addresses. Information for up to 6,503 clinics, including former customers, may have been exposed, but exfiltration has not been confirmed. No access traces were found in the shops’ customer and order databases, and no misuse of customer data was known. [1]

Some dog and cat images uploaded by users to PEPPY were deleted. Images uploaded from 22 July 2026 onward could not be restored. [1]

It disabled the credentials used for the intrusion and reviewed access permissions. It is investigating the cause and scope with external specialists and plans to strengthen access controls, backups and monitoring. [1]