2026 ANDST HD (formerly Adastria) — unauthorised access to business servers; about 2.5M customer records and 10K partner records may have leaked
Data compromised
Customers: name, date of birth, gender, address, phone number, email address and member ID (about 2.5 million records, described as possibly leaked). Business partners: company name, shipping and return addresses, contact person’s name, phone number and email (about 10,000 records). The company says payment information and passwords are not included. Employee records are under review.
Technical writeup
Company announcement on October 23, 2026, with an apology, reported by FASHIONSNAP. The company consulted police and reported to Japan’s Personal Information Protection Commission. The company describes the figures as possible leaks, not confirmed ones. Japanese press reports say member points cannot currently be used in stores or on the web store; stores and the online store were reportedly not affected. Method not disclosed.
Root cause
Unauthorised operations on business servers began about 07:30 JST on October 22. The company detected them around 10:00, isolated the affected servers and blocked the access route by 17:00 the same day. The method has not been disclosed.