[Contained][Severity: Critical][API abuse]

Yojiya: 131,557 members’ data confirmed exposed; up to 134,344 may be affected

Member-data API abuse exposed names, contact details and purchase statistics: 131,557 people confirmed, with a potential ceiling of 134,344.

Disclosed

2026-11-09

Organizations involved

Leaked or at risk

134.3K

134,344

Downtime

Unknown

People affected or at risk

131.6K

131,557

Confirmed count and potential ceiling

Abuse of the member-information API was identified early on 7 November. As of 9 November, exposure is confirmed for 131,557 people, with a potential maximum of 134,344. Some store, online-shop and app members are affected; fields include names/readings, addresses, phone numbers, birth dates, gender, email, member numbers and purchase statistics. Payment information and login passwords are not held. [1]

The company invalidated/reissued API credentials, blocked source IPs and added API restrictions. It is investigating how keys escaped with the provider and external specialists; this notice does not name the provider. Stores, the online shop and the app remain available, but point redemption based solely on orally stated member/phone numbers is suspended. Misuse of personal data has not been confirmed. [1]