ANDST HD Breach: 2.5 Million Customer Records May Have Leaked

Wed Oct 28

October 22–23, 2026: Japanese apparel group ANDST HD, formerly Adastria, said unauthorised parties accessed its business servers on October 22 and that about 2.5 million customer records and about 10,000 business-partner records may have leaked. The company described these as possible leaks, not confirmed ones, and said the scope is still under review. Canonical: andst-hd-customer-data2026. Primary reporting: FASHIONSNAP.

ANDST HD is a Japanese apparel retail group that operates the and ST brand, its stores and an online store. Customers hold membership accounts with member IDs and points. That is why the fields most likely to be exposed are contact details and membership information rather than payment data, which the company says was not included.

What happened

About 07:30 JST, October 22: unauthorised operations began on business servers.
About 10:00: the company detected the activity.
By 17:00: it had isolated the affected servers, blocked the access route and halted internal business systems.
October 23: the company consulted police, reported to Japan’s Personal Information Protection Commission and announced the incident with an apology.

Verified and unverified

Company statement: unauthorised access to business servers; about 2.5 million customer records and about 10,000 business-partner records may have leaked; employee records are under review.
Not listed as affected (company): payment information and passwords.
Press reports (not company figures): member points cannot currently be used in stores or on the web store. The stores and online store were reportedly not affected.
Not disclosed: the attack method, the attacker, and whether any data has been published or sold.

What data may be involved

Customers: name, date of birth, gender, address, phone number, email address and member ID. Business partners: company name, shipping and return addresses, the contact person’s name, phone number and email address. A date of birth and address alongside a member ID is enough material for a phishing message that poses as the retailer, particularly one about points or membership.

Why it matters

A leak of this size from a retail membership base tends to surface later as targeted scams rather than as a sudden fraud spike. The company’s statement that payment data and passwords were not included narrows the risk, but a convincing message from “the store” does not need a card number to ask for one.

What to do

Customers: never give card details, passwords or one-time codes to anyone who contacts you about your membership or points. Use the official app or website, typed in yourself.
Change your ANDST membership password if you used it anywhere else, and turn on two-factor authentication if the account offers it.
Be cautious with points, refund or delivery messages that quote your member ID or address.
Business partners: confirm any change to shipping, return or bank details by phone, using a number you already have.
Watch the company’s notices for the outcome of the review of employee records and any final count.

Reference links

Sourcing note: the figures come from the company’s October 23 announcement as reported by Japanese media. The full release was not retrieved, and the company describes the figures as possible leaks.