2026 Beauty Garage — EC site intrusion; 775,725 customer records
Data compromised
775,725 customer records as of 10 Oct 23:55 JST: company/salon name, customer name, business type, salon URL, phone, email, password hashes, password-reset Q&A hashes. Address, shipping, purchase history, and payment/card data not confirmed leaked. No public dump or abuse reported at notice.
Technical writeup
Verified Beauty Garage customer notice and TDnet 15 Oct 2026. 775,725 rows; hashes not plaintext passwords; addresses/cards not in the confirmed take. companyConfirmed true; recordsAffected 775725.
Root cause
Unauthorized intrusion into Beauty Garage / Eyelash Garage e-commerce servers 10–12 Oct 2026; detected 13 Oct and the path blocked the same day. How the intrusion became possible still under investigation.
References
- https://www.beautygarage.jp/topics/news_unauthorizedaccess2026
- https://www.beautygarage.co.jp/wp/wp-content/uploads/20261015_%E4%B8%8D%E6%AD%A3%E3%82%A2%E3%82%AF%E3%82%BB%E3%82%B9%E3%81%AB%E3%82%88%E3%82%8B%E3%81%8A%E5%AE%A2%E6%A7%98%E6%83%85%E5%A0%B1%E6%BC%8F%E6%B4%A9%E3%81%AB%E9%96%A2%E3%81%99%E3%82%8B%E3%81%8A%E8%A9%AB%E3%81%B3%E3%81%A8%E3%81%8A%E7%9F%A5%E3%82%89%E3%81%9B.pdf