2026 Joshin — third-party unauthorised access to member database, subscription service and reform-photo system; up to 6 million member records
Data compromised
Member database (up to about 6 million records): names, addresses, phone numbers and member IDs. Subscription service (up to about 230,000): phone numbers, login IDs and initial passwords, billing, device and activation codes. Reform-photo system (up to about 800): two driver's license images, one My Number card image and five bank account numbers.
Technical writeup
Joshin's own notice was not fetched. The counts are maxima stated for possible leakage. The company renamed itself from Joshin Denki on April 1, 2026, per its website.
Root cause
Joshin says a third party's system used for its member database, subscription service and reform-photo upload system was accessed without authorisation. It detected the access on October 16, reported it on October 17, and gave a fuller scope on October 26. The company describes possible leakage.