Fancl and Attenir confirmed on 16 October a breach exposing 785,496 members. A cosmetics loyalty signup is a full identity file, and the email address is the one field you can make expendable. I run AliasFleet, an email-alias service: one address per shop, so a leak names its source and you can kill the exposed address while your real inbox stays clean.
Fancl sells cosmetics and health foods. Attenir, its consolidated subsidiary, sells cosmetics. Both sit inside the Kirin Holdings group. Nobody pictures a cosmetics shop as a holder of sensitive data. That is what makes this breach land. The loyalty form asked for your name, your address, your birthdate, your phone number, and your email address. Together, that is a complete identity record. The attackers did not take a mailing list. They took the file a scammer needs to sound like someone who already knows you.
Two shops, one breach, 785,496 people
Both companies announced the breach themselves on 16 October, as reported by Pulse Newswire and Kyodo News. Attackers had reached the two e-commerce sites between 3 and 10 October. It was found in an internal investigation on 15 October.
| Confirmed | Not yet confirmed |
|---|---|
| The disclosure: both companies announced the breach themselves on 16 October | The attack vector beyond "a function" on the EC sites, with details withheld by the companies |
| The window: unauthorised access ran 3-10 October 2026, found 15 October in an internal investigation | Whether the stolen data has circulated, been sold, or been put to use |
| 785,496 people affected, 368,184 at Fancl and 417,312 at Attenir, added as a simple sum, not deduplicated | The true deduplicated total of unique people, since some members may belong to both services |
| 834,947 member records, 393,785 at Fancl and 441,162 at Attenir | Whether every listed field leaked for every affected person, which reporting says it did not |
| Leaked data: email addresses, names, addresses, phone numbers, birthdates, genders, customer numbers, sub-email addresses, identity-verification question items (answers not included), points info, membership stage, newsletter preferences, in-store purchase history, plus other membership data | Whether the hashed secondary passwords can be cracked in practice, with the hashing method undisclosed |
| Also leaked: a hashed secondary password for sub-email addresses, for some members who had set one | |
| NOT leaked: main passwords, credit card and payment information, or identity-verification question answers | |
| Response: emergency task forces set up, the function behind the access identified and stopped, a report to Japan's Personal Information Protection Commission, police consulted | |
| No confirmed public exposure, misuse, secondary harm, or customer reports at disclosure | |
| Affected customers to be contacted one by one at their registered email addresses; dedicated phone line from 9am on 17 October (per Nikkei) |
785,496 people, 834,947 records: both numbers are real
A second outlet quoting 834,947 is not contradicting the 785,496 figure. The two numbers count different things. Fancl reported 393,785 records covering 368,184 people. Attenir reported 441,162 records covering 417,312 people. Add the people and you get 785,496. Add the records and you get 834,947. Records outnumber people because one person can hold more than one member record.
Nobody knows yet how many distinct people sit behind these figures. The 785,496 people total adds the two companies' counts together without removing anyone who belongs to both services. Where the same person holds memberships at Fancl and Attenir, they get counted twice, so the real number of unique individuals could come in below 785,496, and below the 834,947 records figure too. Whether a headline quotes the people total or the records total, it describes the same breach. Either way the victim count is large, and the gap between the two figures is bookkeeping, not disagreement about what happened.
This file is a phishing kit, not a mailing list
Start with the field list and picture it in an attacker's hands. Name, birthdate, phone number, email address. Put together, those four fields give a cold approach everything it needs to feel warm. A call that opens with your full name and your birthdate does not sound like a stranger. It sounds like a company that already holds your file, because a copy of it just changed hands.
Phishing does not need a phone call. It needs a message landing in a real customer's inbox, referencing real in-store purchase history, a real membership stage, a real points balance. The leaked record carries enough of that context to write a lure that passes a quick glance. Expect mail that knows which shop you buy from and what your membership looks like. The coming wave will not be generic spam. It will be mail that knows you shop at Fancl or Attenir.
Take the secondary password next, because it is the detail most people will misread. It is not your main password. Main passwords were not affected. Hashed still leaves an opening if the password was weak or the hashing was weak, and the companies have not said how they hashed it. So if you set a secondary password on a sub-email address, change it now, and change it anywhere else you reused it. One minute of work, and that opening closes.
The missing fields matter as much as the leaked ones. Without payment data, nobody can charge your card from this file. Without main passwords, nobody can walk into your account with this file alone. What is left is impersonation, and impersonation only works when the target trusts the message. That is a narrower risk than theft, and a harder one to judge, because the messages will be good.
Fancl and Attenir will email victims individually, and attackers now hold the victim list plus the real context. A forged notice will quote the real one. Verify through the shop's own site or app, typed by you. No link in any message about this breach is worth clicking, including the real one.
One address per shop is the field you can take back
Your email address is the one part of this file you could have made expendable before the breach. An email alias dedicated to the Fancl shop, forwarding to your real inbox, changes what the leaked file is worth.
Only two senders can ever reach that alias: Fancl itself, or whoever stole the file. So a "breach notification" arriving there, asking you to confirm payment details or reset your password through its link, gives itself away as the forgery. The real Fancl already holds your data and has no reason to ask for it by email. Shut the alias down and that whole channel goes dark, while your real inbox stays clean. That is the leak-tracing mechanism built for exactly this attack, and the set-up guide takes about two minutes.
Your name and birthdate cannot change after a leak. Changing the phone number everyone has is a project. The address you hand a shop at signup was always a choice, and a dedicated alias keeps it a choice you can reverse after the breach instead of regretting before it.
What Fancl and Attenir members should do now
Take the messages first, because they will arrive first.
- Treat any breach notification as suspect until you verify it yourself. Fancl and Attenir will email victims individually, but attackers hold the victim list plus the real context, so a forged notice will quote the real one. Open the shop's own site or app by typing the address yourself, and click no link in any message about this breach, including the real one.
- Expect texts and calls that "confirm your identity" using your own details. The file that leaked holds your name, birthdate and phone number, so anyone reading those back to you is proving they have the file, not that they are Fancl or Attenir.
- If you set a secondary password on a sub-email address, change it, and change it anywhere else you reused it too. Main passwords were not affected, but a cracked secondary password must not become a way in.
- Switch on two-factor authentication on your email account. Names, numbers and birthdates from this leak feed straight into account-recovery flows, and 2FA is the part an attacker cannot talk their way past.
- Stay alert for mail that knows too much. A message quoting your membership stage or points balance does not prove it comes from Fancl. It proves the sender has the leaked record.
- Once the incident is listed, check Have I Been Pwned and follow the breach-response order of operations. If the result page says "Oh no, pwned", read what that message means before panicking. It means the address appears in a breach, not that your inbox is compromised.
- Next time you sign up somewhere, use a dedicated alias. Hiding your real email address is what makes the next breach boring instead of personal.
What to watch as the investigation continues
Two questions will shape what happens next. The first is whether the data surfaces somewhere public, turning "no confirmed misuse" into something else. The second is whether the companies publish the deduplicated victim count or any detail on the function that was exploited. While those stay open, the impersonation window stays open too, and the forged-notification wave is the thing to watch in your own inbox.
