&ST HD Co., Ltd. (TSE: 2685) is the Japanese apparel retailer behind the and ST store and points platform. On October 23, 2026, it disclosed that a third party had gained unauthorized access to its operational servers and that customer, business partner and employee data may have been leaked. The company's disclosure was republished by the aggregator Japan IR. It puts the possible exposure at about 2,500,000 customer records and about 10,000 business partner records. The scope of employee data is still under investigation. The company says the total amount of leaked information is "unknown" and that payment card data was not affected. No threat actor has claimed the attack, and the company has not named one.
What Happened
The company says an unauthorized third party reached its operational servers and that some data "may have been leaked externally." Its emergency response included:
- Isolating the affected servers
- Blocking the access route the attacker used
- Consulting the police
- Reporting to Japan's Personal Information Protection Commission
The company says its web store was not affected. However, it has temporarily suspended the use of member points, which suggests that loyalty or membership systems are involved in the investigation. The disclosure does not say when the intrusion started, when it was detected, or how long the attacker had access.
What Was Taken
The figures below are maximum possible exposure, not confirmed theft. The company's own wording is "potential leakage":
- Customers: about 2,500,000 records
- Business partners: about 10,000 records
- Employees: number and data types under investigation
- Payment data: the company says credit card information is "currently not affected"
The disclosure does not list which data fields were involved, such as names, contact details or membership numbers. All figures come from one source, the company's disclosure as republished by Japan IR. No outlet has reported different or independent numbers, and none of the other source material supplied for this brief covers this incident. Readers should treat the 2.5M figure as the company's early estimate, and it may change.
Why It Matters
This disclosure adds to a run of breaches at Japanese consumer brands. On October 5, Kyodo News (via The Express Tribune) reported two others:
- Monogatari Corp., operator of the Yakiniku King restaurant chain, said data on more than 10 million customers leaked through its reservation and rewards app.
- Daiwa Securities said about 110,000 brokerage customers may have been exposed through a server run by its contractor, Scala Communications.
In all three cases the data at risk sits in loyalty, membership or customer-service systems rather than payment systems. These datasets are still valuable to attackers. Names, emails, phone numbers and membership IDs can be used in targeted phishing and loyalty-point fraud. &ST HD's decision to suspend points fits that risk.
The company says it sees no clear direct financial impact so far. It is still assessing the effect on its results and will disclose it if it turns out to be material.
The Attack Technique
The company has not disclosed how the attacker got in. It has not said whether ransomware, stolen credentials, a vulnerability or a third-party supplier was involved, and no extortion group has publicly claimed the attack. Some of the source material supplied with this brief covers unrelated incidents:
- Manchester Airports Group's exposure of Iterable API keys (The Register and others)
- The DIVD breach via Zammad zero-days (Sysdig)
- Mercer Advisors (Frontiers)
- A Hack The Box lab writeup
None of these is connected to &ST HD, and they should not be read as evidence of how this attack happened. Until the company or investigators publish more detail, the entry point is unknown.
What Organizations Should Do
- Treat loyalty and points platforms as high-value targets. Monitor for unusual point redemptions or transfers, and be ready to freeze redemptions quickly, as &ST HD did.
- Segment operational servers from customer-facing services. &ST HD reports that its web store was unaffected, which shows the value of keeping these environments apart.
- Audit contractor and third-party access to systems that hold customer data. The Daiwa incident in the same month began on a contractor-run server.
- Prepare for phishing that follows a breach. Warn customers that attackers may impersonate the brand using leaked contact and membership details.
- Keep an up-to-date map of where personal data lives. That makes it possible to scope exposure quickly instead of reporting the total as "unknown."
- Rehearse notification steps for regulators and police. That includes Japan's Personal Information Protection Commission, so reports can go out within hours of containment.
Sources: and ST HD Co.,Ltd. Notice of Unauthorized Server Access and Potenti... | Security boffin claims airport group left API keys in client-side J... | Manchester Airports data breach: Reported online release | Manchester Airports Breach Needed No Exploit at All - threatlabsnew... | HTB Stream Writeup R0h1tAnand | AI agent exploits Zammad zero-days in DIVD breach: What we know and... | The Mercer Advisors data breach through the essential eight | Data of over 10M customers exposed in cyberattacks on Japanese firm...