On 19 October, H2O Retailing said attackers reached the Hankyu Hanshin reservation system on 16 October, exposing about 1.26 million H2O ID member records. I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source. The leaked set is a targeted-impersonation kit, and early coverage has already fused this confirmed leak with a second incident that is still under investigation.
If you hold an H2O ID, your address-book entry just became someone else's script. That is the part worth sitting with before the details, because everything below follows from it: a leak of identity fields does not need your password to hurt you. It only needs you to believe the voice on the phone.
The two tracks, kept apart
Three services were hit on two days, and they do not share a status. The disclosure landed on 19 October, reported the same afternoon by FNN, Sankei and ITmedia. Their accounts agree on the split, so keep it split:
| Confirmed | Still unconfirmed |
|---|---|
| On 16 October, unauthorised access reached the customer-management system through the Hankyu Hanshin reservation site. The company cut external communication and shut the reservation system the same day. | How the attacker got into the reservation site in the first place. The disclosure names no attack vector. |
| About 1.26 million records or cases, nearly all of them H2O ID members. A case count, which is not the same as 1.26 million distinct people. | Whether the 1.26 million records have surfaced anywhere public yet. |
| The leaked fields: H2O ID, name in kanji and kana, gender, email, postal code, address, mobile and landline numbers, age, date of birth, and the H2O ID services each person used. | Whether anything left the E-STORES or Remo Order systems at all. Unauthorised access was confirmed there on 17 October, both were shut the same day, and the leak question is still being investigated. |
| Reported to Japan's Personal Information Protection Commission and the police, with members being contacted by email, one by one. | Any misuse or secondary damage. The company says none is confirmed as of the disclosure (MBS News). |
Did any credit card data leak?
No confirmed card leak. The card fields, type plus last four digits plus name plus expiry, are what E-STORES and Remo Order hold, and whether anything left those systems is the question the investigation has not answered yet. The company says full card numbers and security codes are not held at all, which is why nothing below will tell you to replace a card. ITmedia also reports no confirmed login-password leak.
This is where early coverage has already gone wrong. One roundup (europesays) lists the last four digits of credit card numbers among the leaked data. On current evidence that sentence is false: the card fields belong to the under-investigation track, not the confirmed leak. The merge reads naturally, which is exactly why it spreads. Two incidents, two statuses, one story is the error. Do not carry it forward.
It is worth saying why the mix-up feels plausible. The last four digits of a card are exactly the detail a scammer reads back to sound legitimate, and they sit alongside order history in the held data. If that track ever confirms a leak, the advice changes. Until it does, the risk that is confirmed is the identity file, and the advice matches the risk.
The call that knows your date of birth
The likely first move is not a password reset. It is a phone. A week from now the caller says they are calling from Hankyu Hanshin about the 19 October announcement. They open with your name, your postal code, your date of birth. Then they ask you to confirm an order, or to open a link and verify your H2O ID. Nothing they recited came from you. All of it came from the file. The request at the end is the attack; the recital at the start is what buys it. Leaked identity fields buy trust, and trust buys the click. That is the entire mechanism, and it is why this leak's field list matters more than its headcount.
Email and SMS will carry the same script. The company itself warned that messages impersonating it may arrive on members' registered addresses and numbers, and that warning will look prophetic within days. A "breach notice" that quotes the real apology, on an address only H2O ever had, asking for something the company already holds, has failed the only test that matters.
The one field you could have retired
Of everything in that file, the email address is the only field you chose twice: once when you picked it, once every time you typed it into a signup form. Names and birth dates are fixed. The address was optional in exactly one sense. You could have given H2O a unique email alias that forwards to your real inbox, and that single choice changes the impersonation math.
Every message arriving on that alias is either from H2O or from whoever holds the leaked file. There is no third sender. A forged breach notice on the alias, asking for details the company already has, identifies itself by asking. The leak-tracing mechanism is this recognition in formal shape: the address tells you which company lost it. Kill the alias and the channel dies while your real inbox stays clean. The set-up guide takes about two minutes.
This is the pitch I built AliasFleet around, stated plainly: aliases are managed, persistent identities, one per service, so the next leak names its source and you can retire the channel without touching your real inbox.
One boundary, because I will not oversell it. An alias does not stop the phone call. Your numbers are in the file either way, and nothing I sell you changes that. What the alias does is make the email channel legible: one address, two possible senders, and a forgery that exposes itself the moment it asks for what the company already holds.
What to do if you hold an H2O ID
- Expect the impersonation contact, and expect it to know you. A caller who reads your name, address and date of birth back to you is proving they hold the file, not that they work for Hankyu Hanshin.
- Act on nothing unsolicited. No links, no attachments, no callbacks to numbers inside the message. If you need to check anything, type the company's own address yourself.
- Read the risk as it stands: targeted phishing, not card fraud and not account takeover. No card leak is confirmed, full card numbers and security codes are not held at all, and no login-password leak is confirmed. There is no evidence basis for replacing cards or changing passwords on this disclosure.
- Get familiar with how phishing uses your leaked email and walk the breach-response order of operations. Check Have I Been Pwned once the incident is listed.
The rest of the story is the investigation
Two questions are still open. The first is the Track B investigation: whether anything left E-STORES and Remo Order, and if so, what. The second is whether the 1.26 million records surface anywhere public, which would turn a contained intrusion into a circulating dataset.
And here is what I cannot tell you today. I do not know how the attackers got in; the disclosure names no vector, and I will not fill that gap with a guess. I do not know whether the card and order-history fields held on the second track stayed put. Until the investigation reports back, the disciplined reading is the split one: one confirmed leak of identity fields, one open question about payment-adjacent systems, and no confirmed misuse of either. That reading is less satisfying than a verdict. It is also the only one the evidence supports.
