2026 FANCL — online shop unauthorised access Oct 3–10; 393,785 member records (368,184 people) exposed
Data compromised
Member name, address, date of birth, answers to identity-verification question items, and a hashed secondary password. Payment information and the main account password are outside the scope, per the joint notice.
Technical writeup
FANCL and Attenir issued a joint notice on October 16, 2026 (PDF on fancl.jp). FANCL reported 393,785 records covering 368,184 people. The 834,947 combined figure in press coverage adds the two companies’ record counts and is not a de-duplicated count of people. Affected members are to be contacted individually by email, and both companies say they will not ask for passwords or card details by email, SMS or phone. companyConfirmed true.
Root cause
A third party gained unauthorised access to the FANCL and Attenir online shops between October 3 and 10, 2026. An internal investigation on October 15 found it, and the affected function was stopped. The entry route and technical cause have not been disclosed.