Incident response and recovery report
We will keep publishing the facts we have confirmed and the measures we have actually completed. Items under investigation are clearly distinguished from items confirmed safe.
Last updated: Oct 19, 2026 21:45 JST
- Current status
- The unauthorized access identified on October 14 and 16, 2026 has been traced and blocked. We are now investigating the scope and impact of the leaked information together with an external cybersecurity firm.
- Next update
- The findings of the external investigation are expected on Monday, October 19. We will post them on this page as soon as they are available.
Scope of impact
The scope of affected stores is being investigated with an external cybersecurity firm. We will publish the number of stores and details once confirmed.
Known secondary-fraud methods
Emails quoting leaked order information (order date, item, amount, delivery details, etc.) and asking recipients to contact a LINE account for an "out-of-stock refund" have been confirmed. They are sent from free email addresses unrelated to the stores.
Investigation status
The entry routes of both incidents (October 14 and 16) have been identified. The scope and impact of the leak are being investigated with an external firm.
Security improvements
Marketplace and service integrations
| Marketplace / service | Status | Details | Action needed from stores |
|---|---|---|---|
| futureshop | Suspended | Since 17:40 on October 16, 2026, inventory, product and order synchronization has been suspended. We are discussing resumption with futureshop. |
|
| SpeedPAK | Suspended | Suspended since around 1:00 a.m. on Saturday, October 17, 2026. Expected to resume around Monday, October 19. |
|
| Luxclusif | Suspended | All integrations have been suspended since around 11:43 p.m. on Friday, October 16, 2026. A resumption date has not yet been determined. |
|
Other integrations
There is currently no suspension notice for the integrations below. If the situation changes, we will add them to the table above. Note that all WASABI SWITCH accounts have been temporarily deactivated since 18:00 on October 16 (see "For stores" for how to reactivate).
Rakuma, Yahoo! Shopping, Yahoo! Auctions, Mercari Shops, Amazon, au PAY Market, Jmty, Musbi, eBay, Shopee, Lazada, Chrono24, eLADY, Qoo10, Luxuness, Yahoo! Taiwan, WeChat, Walmart, THE LUXURY CLOSET, Vestiaire Collective, Catawiki, PopChill, 95, Into Archive, Shopify, SHOPLINE, Shopserve, EC-CUBE, SNKRDUNK, Sumasell, Bramo, FROM JAPAN, JOOM, DOKODEMO, BUYMA, MOLTS, Rakuichiban, m department, TikTok Shop, Coupang, Etsy
Support for customers and stores
Timeline of events and response
- Published
Published the fifth report on the forced password change, two-step verification and the content template change
Because unauthorized login attempts were found, we announced that the passwords of all accounts would be forcibly changed and two-step verification by email would be set up (carried out on October 18, 20:30–23:30).
- Action
Changed content templates so that PHP can no longer be used
The investigation found that the PHP functionality in the template engine had been abused in this unauthorized access.
- Published
Published the fourth report on the temporary deletion of transaction data and stronger security measures
We announced that, as a measure until safety is confirmed, order, purchase and customer transaction information will be deleted during October 18 (all saved beforehand and to be returned to stores), that encryption of registered information is planned to be completed during October 18, and that multi-factor authentication will be introduced for STOCK SWITCH and POS Register SWITCH.
- Published
Reported to the Personal Information Protection Commission (preliminary report)
Under the Act on the Protection of Personal Information, we submitted a preliminary report to the Personal Information Protection Commission. We will submit a final report once the scope of the leak has been confirmed by the external investigation.
- Published
Published the third report requesting email account password changes
We urgently asked stores to change the SMTP authentication password under "Mail > Account management". Encryption of registered information is being brought forward (planned for Sunday, October 18).
Information not yet disclosed
Information that could be exploited by attackers, such as technical details of the entry routes, or that could affect the investigation, is being withheld for now. We will publish it as soon as it becomes possible.
Schedules and estimates in this report do not guarantee when the investigation or recovery will be completed.