October 16, 2026: cosmetics makers FANCL and Attenir issued a joint notice confirming unauthorised access to their online shops between October 3 and 10. The companies report 393,785 and 441,162 member records. Canonical: fancl-ec2026 and attenir-ec2026. Primary source: the joint notice (PDF, Japanese).
FANCL is a Japanese cosmetics and supplements company that sells mainly through direct mail and its online shop. Attenir is a cosmetics brand that sells through its own online shop. The two issued one notice because the same window of unauthorised access covered both online shops.
What happened
- October 3 to 10: a third party gained unauthorised access to the two online shops.
- October 15: an internal investigation found the activity.
- October 16: the joint notice was published. The companies say the affected function has been stopped.
The companies say they will contact affected members one by one by email at the address they registered. Secondary coverage reports that the companies also informed the Personal Information Protection Commission and consulted police. We have not seen that in the notice itself, so treat it as press-reported.
Technical analysis
The companies have not disclosed the entry route or the technical cause. The notice describes the affected function, but not how it was reached. Both shops are described as affected in the same window, but the notice does not say whether one attacker was responsible for both.
The notice also does not say whether the attacker copied the data in bulk or viewed it in parts. Until the companies publish more, the honest reading is that the scope is known from the record counts and the field list, and the method is not known.
Impact
The notice gives these figures:
- FANCL: 393,785 records covering 368,184 people.
- Attenir: 441,162 records covering 417,312 people.
The combined 834,947 figure in press coverage is a sum of records. The people total is 785,496 before any de-duplication across the two brands, so the figure is not a count of unique individuals.
The exposed fields are the member's name, address, date of birth, answers to identity-verification question items, and a hashed secondary password. Payment information and the main account password are outside the scope of the breach, according to the notice.
Verified vs unverified
- Verified (joint notice): the October 3 to 10 window, the October 15 discovery, the record and person counts, the field list, and the exclusion of payment data and main passwords.
- Press-reported: the notification to the Personal Information Protection Commission and the consultation with police.
- Not confirmed: the entry route, whether the data has been published, and whether any member has been defrauded.
The notice says the affected function was stopped, but it does not name the function. Members should not assume the risk ended when the function was switched off, because the unauthorised access had already happened in the window the notice describes.
What to do
- Look for the companies' individual email. Confirm it is genuine by visiting the online shop directly, not by clicking a link in the message.
- Change your FANCL and Attenir passwords, and change the password anywhere else you used the same one.
- Ignore emails and SMS that ask for passwords or card details. Both companies say they will never ask for those things by email, SMS or phone.
- Be careful with messages that quote your birth date or address. Those are the fields exposed here, and they are useful for a convincing scam.
- Turn on two-factor authentication for your email account, which is often the route to reset everything else.
Why the fields matter
Name, address and date of birth are the fields most often used to make a message look genuine. Answers to identity-verification question items are more sensitive: the notice names them as exposed, and they are the kind of information other services can ask for when an account is recovered. The hashed secondary password is harder to use than plain text, but it is still a credential, and it should be changed if it was reused elsewhere.
The companies say payment information and the main account password were outside the scope of the breach. That matters, but it does not take the rest of the record off the table. A message that quotes a birth date and a home address can be enough to start a fraud.
Notes for members of both shops
Because the same window covered both online shops, a member of either company could be affected. A person who used only one of the shops should still check. The companies say they will contact affected members by email, so the absence of a message is only partial reassurance until the individual notices have been sent.
Sources
Joint notice, October 16, 2026 (Japanese PDF) • Security news summary (Japanese)
Related reading
For another October incident where a leaked email list was followed by targeted phishing, see our Capcom post. The Yamato breach in the same month is covered in our Kuroneko post.