Moonstar said on October 15 that data on up to 593,000 online-store customers likely leaked in May. I run AliasFleet, an email-alias service that gives every site its own forwarding address, so a leak names its source. Read the March notice again with that in mind. "No leak confirmed" described the investigation, not your data.
The breach surfaced the way these things often do. Not through a company audit. Through a customer. Around September 20, one shopper received an email pretending to be from Moonstar, and it quoted past order details only the shopper and Moonstar could have known. That message was the first sign the data was gone. The leak had likely happened four months earlier.
Three notices, seven months apart
Moonstar has now published three notices. The sequence, as reported by Japan Cyber Watch and checked against Moonstar's own pages, runs like this.
On March 26, the company confirmed suspected unauthorized access to some of its servers. No customer data had been confirmed taken. The investigation continued. That was the whole notice: short, careful, and easy to read as reassurance.
On October 2, the tone changed. The investigation had found an unauthorized login to a system server and possible data acquisition. Moonstar named the data at risk: names, addresses, phone numbers, email addresses, past order history. It also confirmed that phishing emails impersonating Moonstar had already reached some customers. Card data and online-store passwords were not on the affected server, so neither was included.
On October 15 came the fullest account. The third report put the likely leak window at May 14 to 19, 2026, set the maximum at 593,000 people, listed the eight affected shops, and recorded the report to Japan's Personal Information Protection Commission. The second report had named the data types and confirmed the phishing. The March notice remains what it was: suspected access, nothing confirmed taken, investigation ongoing. A second outlet, Security Lab, independently reported the third report with matching facts and the full list of eight shops.
What Moonstar has confirmed:
- The disclosure sequence: March 26, October 2, October 15.
- The likely leak window: May 14 to 19, 2026, via a system server.
- Up to 593,000 online-store customers at risk, a maximum, not a confirmed-taken count.
- The data types: names, addresses, phone numbers, email addresses, past order history.
- No card data, no online-store passwords: neither was stored on the affected server.
- Phishing emails impersonating Moonstar already reached some customers.
- The report to Japan's Personal Information Protection Commission.
- Affected customers will be emailed individually. Those not contacted are not affected.
- The response so far: external connections of the affected server cut, forced password changes, a technical investigation with outside specialists, vulnerability fixes, tighter security, a review of internal personal-data rules, and staff training.
What Moonstar has not said:
- Whether the March intrusion and the May leak are the same intrusion, a continuing intrusion, or a new one.
- How the attackers got in. Moonstar is withholding the method, the systems involved, and the vulnerability.
- Whether the dataset has been sold, traded, or published. Moonstar says no confirmed public disclosure.
- How many customers received phishing emails. "Some customers" is all Moonstar says.
- Whether police were contacted. The notices do not mention police.
- A per-shop breakdown of the 593,000.
Two points in those lists carry the weight. The May window opened about seven weeks after the March notice. Moonstar has not said whether the attackers were never fully removed after March or got back in another way, but the March response did not stop customer data from leaving in May. And the discovery came from a customer, four months after the likely leak, in the form of a phishing email already sitting in a victim's inbox.
Why a real order makes the forgery work
A leaked email address on its own is a spam problem. A leaked email address plus a real past order is something else entirely.
Picture the message. A refund notice for shoes you actually bought, naming the right item and the right date. Or a delivery problem on a parcel you are actually waiting for, asking you to re-enter payment details to release it. Or a request to change the delivery address on an order you recognise. Generic spam gets deleted. This one gets read twice, because every checkable detail checks out.
That is the detail that exposed this breach. The impersonation email that tipped off the September customer quoted order details only the customer and Moonstar could have known. A victim reads that and believes the message, because the message knows things only the real company should know.
Order history also breaks the usual advice. "Check whether the email mentions something only the real company would know" stops working when the attacker knows it too. The test that still holds is the channel: Moonstar's own site, typed by you, or Moonstar's customer center on 0800-800-1792. Never the link in the message, even when the message gets your order right.
Moonstar is not the first Japanese company to learn this the hard way. Japan Cyber Watch points to the same order-history detail in other recent consumer breaches in Japan, among them the Yamato Transport pay-later service, where past order data made the impersonation just as convincing. Yamato's pay-later breach is worth reading next to this one: same playbook, order details turned into a believable forgery.
What to do if you shopped at Moonstar
The affected group covers customers of eight official Moonstar online shops: its Rakuten Ichiba shop, its Yahoo! Shopping shop, MOONSTAR ONLINE STORE, MOONSTAR LIFESTYLE EC STORE, its au PAY Market shop, Moonstar Outlet, plus the Qoo10 and Amazon shops, both of them closed now. Past customers of the closed shops count too. The shopping platforms themselves were not breached. The data came out of Moonstar's own system server.
- Assume your record sits in the file if you ever ordered from any of those shops. Moonstar's individual email is on its way, but suspicion should not wait for it. No contact from Moonstar means you are not affected, the company says.
- Treat every Moonstar order message as suspect. Refund notices, delivery problems, payment re-registration, address changes: all of them are now plausible forgeries. Go to the shop or Moonstar's own site yourself. Moonstar says it will never ask for passwords or card details by email, SMS, or phone, so any message that does is a forgery on its face.
- Click no links and open no attachments in messages about this breach. The impersonation wave will copy the wording of the real notice, and it may quote your real order. The link is the one part you can always say no to.
- Do not reuse your Moonstar password anywhere else, and change it wherever it matches another site. Passwords were not in the leaked data, and Moonstar has forced password changes, but credential stuffing pairs leaked emails with passwords from other breaches. This is the one step that costs nothing.
- Expect calls and SMS that read your own details back to you. A caller who "confirms your identity" by reciting your name, address, and order history is proving they hold the file, not that they are Moonstar. Hang up and call the customer center yourself on 0800-800-1792, weekdays 10:00 to 17:00, or email cs@moonstar.co.jp.
- Once the incident is listed, check Have I Been Pwned and follow the breach-response order of operations. The guide to checking a leaked email covers other breaches as well.
The one field you could have made expendable
The address you handed the shoe shop is the one field in the leaked record you could have made expendable. Your name is fixed. Your home address is fixed. What you ordered is fixed. But the address the order confirmation went to was your call, and that call decides what happens next.
The mechanism is plain. A unique email alias for the Moonstar shop, forwarding to your real inbox. When the breach data circulates, the alias is the only email the attackers hold, and it points at one source. A message arrives on the Moonstar alias quoting your real order and asking for card details, and you know two things at once: the data came from Moonstar, and the message is a forgery, because the real Moonstar would never need to email you for data it already holds. Kill the alias and the whole channel dies while your real inbox stays clean. That is the leak-tracing mechanism aimed at exactly this attack, and the set-up guide takes about two minutes.
The March notice could not have given you this part either. No company can warn you about a leak it has not found. An alias does not wait on the company's timeline. It was in place before March, it held through May, and it would have pointed at the source the day the first impersonation email landed, four months before the company confirmed anything. For background on how leaked addresses get used, how phishing uses your leaked email walks through the playbook.
The limit is plain: an alias does not take back your name, your address, or your order history. Those fields are out, and nothing you do now un-leaks them. What the alias does is narrower and more useful. It takes the one field the attacker needs to reach you, makes it traceable, and gives you a kill switch for that channel alone. The rest of the work is the suspicion habit in the section above.
Three gaps the next notice has to close
First, the relationship between March and May. Were the attackers never fully removed, or did they get back in through a gap the March response did not close? Moonstar has chosen not to disclose the method, so this may stay unanswered.
Second, does the dataset turn up anywhere public? Moonstar says no confirmed public disclosure so far. Should the file appear on a forum or a marketplace, this stops being a contained incident with targeted phishing and turns into a circulating one, and the impersonation wave grows.
Third, does the notification rollout itself turn into the attack? Moonstar will email up to 593,000 people one by one. Each of those emails is a template the attackers can copy, and they hold the victim list to send it to. The genuine notification and the forgery will land side by side, quoting the same apology. The channel is the only test that works, and Moonstar's own advice says the same: do not open, do not click, call the number you already have.
