Bookoff Group Holdings said on October 9, 2026 that attackers took member data from a member-management system run by one of its subsidiaries — not a hedged “may have leaked” notice. Investigators found unauthorized access on October 6. Up to about 6.43 million member numbers sit in the affected set. That count is member numbers, Bookoff stresses, not a clean headcount of unique people. Stolen fields include names, dates of birth, gender, emails, phones, postal addresses, point card numbers, member numbers, and password hashes. Payment data was not stored on the system. Primary English-language reporting: Japan Cyber Watch’s Bookoff write-up. Canonical BreachHistory record: https://breachhistory.com/bookoff/bookoff2026 (/bookoff/bookoff2026).
This is a verified Bookoff data breach — company disclosure, Personal Information Protection Commission reporting, and a clear statement that data left the environment. What this is not: a payment-card database dump. Card numbers were not held in the hit system.
What happened
Bookoff confirmed intrusion into a subsidiary’s member management system on Tuesday, October 6, 2026. Follow-up forensics showed member data had been obtained from outside the protected boundary. Three days later the group published its apology and notice.
After discovery, Bookoff says it blocked attacker communications, fixed a vulnerability, cut external access to the system, and launched an emergency review across networks and applications. Monitoring continues. Individual customer notices will follow once the investigation can say, per account, what left.
The company has not named the subsidiary, the branded service behind the member database, or the vulnerability class. October 6 is when Bookoff confirmed the intrusion — not necessarily when attackers first walked in.
Timeline
- October 6, 2026 — Unauthorized access confirmed; investigation finds member data taken externally.
- October 6 onward — Attacker paths blocked; vulnerability remediated; external access locked down; emergency all-systems review begins.
- October 9, 2026 — Public TSE/timely disclosure and apology; PPC notified.
- Ongoing — Scope refinement (people vs member numbers), individual member outreach, continued monitoring for publication or misuse.
What remains unknown publicly
- Dwell time before October 6 — first access date not published.
- Detection method — alert, anomalous load, tip, or something else.
- Vulnerability details — product CVE versus custom application flaw.
- Hash algorithm — bcrypt/Argon2 with per-user salts, or something faster and weaker.
- Unique-person count behind the 6.43 million member-number ceiling.
- Geography — whether Bookoff USA or Jalan Jalan Japan members appear in the same database.
What data was taken
Bookoff’s upper-bound inventory for the Bookoff breach 2026 covers:
- Name, date of birth, gender
- Email address, phone number, postal code and street address
- Point card number and member number
- Password hash — described as an encrypted/hashed value that “cannot be read as it is”
Bookoff is still mapping which fields apply to which of the ~6.43 million member numbers. Treat the list as the worst-case profile until individual notices arrive.
Even without plaintext passwords, a full identity bundle — name, DOB, address, phone, email, loyalty IDs — is high-value phishing fuel. A scammer who can recite your Bookoff member number and home address sounds like customer support.
What was not exposed
According to Bookoff, credit card and other payment data were not held in the compromised member system and were therefore not taken. The company also reports no unauthorized changes to member records — theft, not tampering, on the evidence published so far.
Absence of cards does not make the incident low stakes. Japanese retail loyalty breaches in autumn 2026 have repeatedly shown that contact-plus-identity dumps drive SMS and call-center fraud for weeks after disclosure.
Password hashes — why they still matter
Bookoff’s phrasing that hashes “cannot be read as they are” is true of every hash. The security question is hardness: a modern slow hash with unique salts makes offline cracking of millions of Bookoff credentials expensive. A fast unsalted hash does not. Bookoff has not published the algorithm.
Until it does, assume recovered passwords are possible for common and reused choices. Change the Bookoff password and every other account where you reused that string — email, banking, shopping first.
Attackers who already hold your email and phone can combine a cracked password with credential stuffing. The hash column turns a contact leak into an account-takeover campaign if the hashing was weak.
Who is at risk
Bookoff members in Japan are the primary population. Bookoff’s domestic used-book, game, music, and media stores rely heavily on point cards and member accounts. Anyone who ever registered — active shoppers and dormant accounts alike — should plan for exposure until Bookoff says otherwise.
Families sharing a point card may see phishing aimed at the primary registrant’s name while using a household phone number.
Employees who reused work email on a Bookoff membership create a business-email-compromise pivot: a convincing “Bookoff password reset” message to a corporate inbox is a classic lure.
Overseas members — Bookoff stores in the United States and Jalan Jalan Japan locations in Malaysia and Kazakhstan — sit in an ambiguous zone. Bookoff has not said which subsidiary system was hit. Do not assume geographic safety; wait for the individual notice or an update clarifying scope.
Phishing to expect after the Bookoff data breach
- Fake point-balance or card-reissue SMS quoting a real-looking member or point card number.
- Calls claiming “your Bookoff account was locked” and asking for a one-time code or banking details — Bookoff says it will never solicit passwords, verification codes, card numbers, or bank details by email, SMS, or phone.
- Refund or buyback scams that cite your postal address and DOB to sound like store operations.
- Credential-stuffing follow-ups on email if the hash cracks — watch for unexpected login alerts elsewhere.
How the attack worked — what Bookoff said
Public detail stops at “vulnerability,” remediation, and containment. That is more candid than many Japanese autumn-2026 notices that never admit a specific fix, but it still leaves peer companies guessing what to patch.
JPCERT/CC warned on October 8, 2026, that attackers are scanning Japanese organizations for known flaws and abusing consumer-app APIs. Bookoff’s quick path from October 6 confirmation to an October 9 disclosure that already cites a fixed vulnerability is consistent — as inference, not company statement — with a known patchable issue or a contained application mistake such as a missing access check. It could also be a first containment step while the emergency review digs deeper.
Do not invent a CVE or threat actor. None is named in the Bookoff notice summarized by reputable trade press.
Industry context — Japan’s autumn wave
Bookoff’s disclosure landed a day after Lawson’s Lawson ID incident (~2.15 million accounts) and amid a cluster that already included Times Car, Yakiniku King’s app membership file, and other consumer-facing systems. Japanese media reported an inter-ministerial government meeting on October 8 focused on the unauthorized-access wave.
Retail and loyalty platforms share a pattern: large membership tables, mobile or web front ends, and password storage that becomes critical the moment hashes leave the building. Bookoff’s case stands out because the company said data was taken, not merely at risk, and because password hashes are explicitly in scope.
For related BreachHistory reading on large retail and loyalty exposures, see catalogs such as Wawa’s breach timeline and Saks Fifth Avenue’s timeline — different markets, same lesson that customer-identity files outlive the news cycle.
What the company and regulators said
Bookoff apologized, listed the data classes, denied payment-data storage on the hit system, reported to Japan’s Personal Information Protection Commission, and promised individual contact after investigation. It reports no sign so far that the stolen set has been published or misused.
“No misuse observed” is not the same as “data stayed private.” Private trading and delayed fraud campaigns are common. Treat quiet first weeks as a monitoring window, not a clean bill of health.
English-language synthesis of the TSE notice and Japanese press is available from Japan Cyber Watch; Japanese primary disclosure is via Bookoff’s timely disclosure / apology materials referenced in that coverage.
What you should do
- Change your Bookoff password and every reused password elsewhere, starting with email, shopping, and banking.
- Enable MFA on the email address tied to your membership — that inbox is now a high-value target.
- Expect phishing that uses your real name, address, DOB, phone, or member number; open Bookoff only via typed URLs or the official app, never SMS links.
- Ignore requests for passwords, OTPs, card numbers, or bank transfers tied to this incident — Bookoff says it will not ask that way.
- Wait for Bookoff’s individual notice for field-level confirmation, but do not delay password rotation while you wait.
- Watch statements and identity alerts if your postal address and DOB were on the account — synthetic-identity and loan-scam patterns use that combo.
- Bookmark /bookoff/bookoff2026 for count and field updates as Bookoff refines the 6.43 million ceiling.
Was I affected?
If you held a Bookoff membership or point card tied to the breached subsidiary system, plan on being inside the upper bound of ~6.43 million member numbers until Bookoff’s personal notice or a later scope update excludes you. Absence of email so far does not safely clear you — outreach is staged after investigation.
People who only shopped cash without registering are outside the membership file, but anyone who created an account years ago and stopped using it may still have a live row.
“Taken” versus “may have leaked”
Japanese breach notices often hedge. Bookoff’s language is harder: investigation found data obtained from outside. The 6.43 million figure remains an upper bound on member numbers, but the direction of travel — exfiltration confirmed — should shape how seriously you treat password reuse and phishing.
For incident responders elsewhere, that wording also matters. “Taken” triggers different containment and customer-comms urgency than speculative exposure language.
Loyalty IDs as phishing amplifiers
Point card numbers and member numbers are not secrets in the cryptographic sense, but they are rare in random spam. When they appear in a message next to your legal name and city, skepticism drops. Teach household members that Bookoff will not cold-call for “point transfers” or “card revalidation fees.”
Store staff are not the forensic channel. Corporate notices and the forthcoming individual emails carry the authoritative field list.
Emergency review — what peers should check
Bookoff’s all-systems review is the right posture after a confirmed exfiltration. Peer retail operators in Japan facing the same wave should verify: password hashing strength, external exposure of member APIs, logging for bulk export patterns, and whether subsidiary member platforms share authentication or VPN trust with less-hardened environments.
JPCERT/CC’s October 8 advisory is the public checklist worth mapping against your own apps — API abuse and known-vulnerability scanning are the themes of this cluster, even when Bookoff does not publish a matching root-cause essay.
International members and travel shoppers
Tourists who opened Bookoff accounts while visiting Japan may have Japanese phone numbers that later rolled to new owners, or foreign emails still receiving phishing in English or Japanese. If you registered during a trip, rotate credentials and watch both SMS and email channels.
Bookoff’s U.S. and Southeast/Central Asian store strategies mean brand recognition outside Japan — scammers can brand emails “Bookoff Group” even when the victim never shopped abroad. The authenticity test is the official domain and in-app messaging, not the logo in the header.
What Bookoff has not promised yet
Public materials summarized at draft time do not describe credit-monitoring products, hash-algorithm disclosure, or a named threat actor. Do not wait for those before rotating passwords. Do watch for follow-up IR if the unique-person count or field matrix changes.
If hashes later appear in cracking forums or monitoring services, enroll the email you used for Bookoff. Company “no misuse yet” statements age poorly once corpora circulate.
Comparing scale without inflating stakes
Six-point-four-three million member numbers is large for a single retail group membership file, but it is not automatically six million distinct humans. Duplicate cards, re-registrations, and inactive IDs can inflate the numerator. Bookoff’s caution on that point is useful — still, operational advice for any confirmed member should assume inclusion until proven otherwise.
Relative to payment breaches, this incident’s acute risk is account takeover and social engineering, not card-network fraud from this database. Relative to contact-only leaks, the hash column raises the ceiling.
Member numbers versus people
Bookoff’s ceiling of about 6.43 million is a count of member numbers. Re-registrations, replaced cards, and inactive IDs can mean fewer unique humans — or, less often, one person holding multiple IDs. Until Bookoff publishes a unique-person figure, security advice should not wait on that reconciliation. If any of your IDs is live in the breached subsidiary system, rotate credentials and expect phishing that quotes loyalty identifiers.
Shoppers who transferred points between cards over the years may receive multiple confusing scam messages that each cite a different member number. That inconsistency does not prove the messages are fake by itself; it can reflect a real multi-ID history. The authenticity test remains the official channel, not whether the number “looks familiar.”
Used-goods retail and identity richness
Bookoff’s model — buying and selling books, games, discs, and related goods — encourages long-lived memberships with addresses used for buyback paperwork and emails used for campaign notices. That longevity is why a 2026 intrusion can still touch people who last sold a stack of manga in 2019.
Identity fields collected for ordinary retail (DOB, gender, postal address) become high-grade material for loan and parcel-redirection scams when combined. A fraudster who knows your Bookoff-registered address can claim a “failed delivery of store credit paperwork” and ask you to confirm a one-time code that actually resets your email.
How individual notices will probably arrive
Bookoff says affected customers will be contacted individually after investigation. Expect staggered email or postal outreach, call-center spikes, and phishing that spoofs those exact formats within hours of the first legitimate wave. If a message demands immediate payment to “keep your points,” it is not Bookoff’s investigation follow-up.
Keep a written note of which email and phone you used on the membership so you can recognize legitimate destinations. Bookoff will not need you to wire money to unlock an apology letter.
Canonical record and sources
BreachHistory indexes the Bookoff Group Holdings incident as company-confirmed unauthorized access with data taken, upper bound ~6.43 million member numbers, password hashes included, payment data not stored on the system, vulnerability fixed, PPC reported. Updates live at https://breachhistory.com/bookoff/bookoff2026.
- Japan Cyber Watch — Bookoff member system unauthorized access (Oct 9, 2026)
- Bookoff Group Holdings timely disclosure / apology materials referenced in that reporting (TSE / company PDF)
- JPCERT/CC advisory on recent unauthorized-access cases (Oct 8, 2026)
If you are a Bookoff member, the practical takeaway is simple: data left the building, hashes are in play, cards were not on that system, and the next messages you receive about “Bookoff security” will mix legitimate company mail with polished fraud. Change reused passwords now, verify outreach only through official channels, and treat any cold request for money or codes as hostile until you prove otherwise.