Kirin: Fancl, Attenir breach affects 785,496 people

An internal investigation by Fancl on Oct. 15 found that the e-commerce sites of Fancl and Attenir had been subject to unauthorized access from Oct. 3 to Oct. 10, 2026. The investigation confirmed that some member information held by the two companies had been exposed externally. Kirin announced the incident on Oct. 16.

The figures released by the companies are below. Simply adding their reported totals gives 834,947 records affecting 785,496 people. The figures combine each company's reported user count, but the disclosure does not say whether there is overlap between their memberships or provide a count of unique individuals. It also gives no year-on-year or industry comparisons, making it difficult to assess the relative scale of the incident.

The exposed information includes email addresses, names, addresses, telephone numbers, dates of birth, gender, customer numbers, and secondary email addresses and their passwords. The companies also listed points balances, membership tiers, newsletter preferences and whether members had made purchases in stores as potentially affected registration information. Authentication question prompts were included, but answers were not.

Some members had set passwords for secondary email addresses. The companies said these passwords were hashed and could not be read in their original form. Main passwords were not affected, and payment information, including credit card details, was not part of the breach. While the range of information involved is broad, the disclosure does not specify which items apply to each individual member. No figures were provided for past breaches or industry averages, so the scope of the information cannot be quantified against previous incidents or other companies. Payment information was not affected

Fancl and Attenir set up emergency response headquarters on the day the incident came to light and identified and suspended the functions targeted in the attack to prevent further damage. A detailed investigation is ongoing. The companies have reported the incident to Japan's Personal Information Protection Commission and consulted with police, and said they would work across their organizations to prevent a recurrence.

As of the announcement, no further unauthorized access or malware infection related to the incident had been identified, and no significant impact on business operations or services had been confirmed. Kirin is assessing the effect on its consolidated results and said it would promptly disclose any material impact. No misuse or secondary harm had been confirmed at the time of the announcement, but the investigation continues and the companies will make a further announcement if new facts emerge. No estimate of the financial impact or comparison with similar past incidents was provided, so the monetary effect cannot yet be assessed. Kirin is evaluating the earnings impact and will make further disclosures if it is material.