November 6, 2026: Shiseido said unauthorised access to its online skin-measurement system Facial Condition Analyzer (FCA) leaked 2,515 records — names, emails, age, sex, member IDs, questionnaire data and skin results. Face images and payment cards were not in the take. Beauty Alive Circulation Check is stopped. The catalog entry records the confirmed census.
What is known
- Access was found on 27 October 2026. Some data on the system had been altered and taken off it. Shiseido stopped the affected tools the same day, told Japan's Personal Information Protection Commission and the police, and brought in the developer and outside specialists.
- The leaked product is Beauty Alive Circulation Check on the Shiseido online store and at SHISEIDO. Other FCA tools (肌パシャ, Men's Skin Checker, Elixir AI Skin Analyser, IPSA AI Recipist mico and CO-HADA Scan) show no leak so far but are paused because they share the platform. Restart date unpublished.
- Identifiable customers will be contacted; some users cannot be matched and are covered only by the public notice. Shiseido says it will not ask for card numbers, PINs or passwords by mail or phone.
What is not known
- Whether the 2,515 figure will rise. Shiseido says the investigation is continuing.
- The intrusion path, and whether the altered records were used for anything besides theft.
- When paused skin tools will return.
2,515 is a confirmed leaked-record count, not a "maximum possible" marketing figure. It is still small next to Shiseido's customer base; do not inflate it.
Who is at risk
People who used Beauty Alive Circulation Check — online or in store — whose records are in the 2,515. Questionnaire and skin-result data is sensitive in a cosmetics-marketing sense, not a medical-record sense, but it is enough for targeted "your skin analysis is ready, log in here" phishing.
What to do
- Watch for a letter from Shiseido. If you used the tool and get nothing, the public notice is your record; you may be in the unmatched set.
- Do not open a "resume Beauty Alive" link from unexpected mail. The official tools are stopped.
- Shiseido will not ask for card details or passwords about this incident. Anyone who does is not Shiseido.
- If you reused the member-site password elsewhere, change it on those other sites.
- IPSA and Elixir users: those tools are paused preventively. Wait for the brand site, not a third-party "security update."
Sources
Sourcing note: 2,515, the field list and the no-face-image / no-card findings are from Shiseido's 6 November notice. We will update this post if the census changes.