Threat watch / Breach
Nojima: about 7 million member records leaked from its online shop
Japanese electronics retailer Nojima detected unauthorized access to the member management system behind its Nojima Online shop and its used smartphone buyback site on November 1, 2026, and confirmed a leak the same day. About 7 million member records are affected, with names, birth dates, addresses, phone numbers, emails, login IDs and encrypted passwords. Nojima says it holds no credit card data on these sites. It has consulted the police and plans to report to Japan's data protection authority.
- Sector
- Retail
- Way in
- Not public yet
- Product or vendor
- Nojima Online
- How it happened
- Not public yet Checked 15 Nov 2026
- What was stolen
- Member data: name (in kanji and kana), date of birth, gender, postal code, address, phone number, login ID, encrypted password and email address. Nojima says it does not hold credit card information on these two sites.[1][2] Checked 15 Nov 2026
- Who was impacted
- Members of the Nojima Online shop and of Nojima's used smartphone buyback site; members who had already left are not included in the count.[1][2] Checked 15 Nov 2026
- Threat actor
- Not attributed
Timeline
- Nojima detects unauthorized access to the member management system of Nojima Online and its used smartphone buyback site, and confirms that member information leaked. [1]
- Nojima announces the leak of about 7 million member records. It says it has consulted the local police and will promptly report to Japan's Personal Information Protection Commission. It does not say how the attackers got in. [1][2]