BEAUTY GARAGE Inc. (TSE Prime: 3180) is a Japanese B2B e-commerce company that sells professional beauty products and equipment to hair and beauty salons. In a timely disclosure on October 15, 2026, it said an unauthorized third party broke into its e-commerce site and leaked registered customer information. The company puts the number of affected records at 775,725. The leaked data includes salon names, customer names, email addresses and phone numbers. BEAUTY GARAGE says addresses, purchase history and payment card data were not leaked. The company hasn't said how the attacker got in. Nobody has claimed the attack, and no threat actor has been named.
What Happened
According to the company's disclosure, as summarised by Japan IR and Japanese IT outlet 情シスのミカタ, BEAUTY GARAGE detected the incident on October 13, 2026, when it found that part of its e-commerce customer data had been sent outside the company. 情シスのミカタ cites the company's TDnet filing as saying the investigation then found intruders had been inside the company's own servers from October 10 to October 12. That means the attackers had about three days of access before anyone noticed. The company disclosed the breach publicly two days after detecting it.
The company says it has taken emergency containment steps. According to 情シスのミカタ, it has also identified and blocked the route the attacker used. The e-commerce site and the company's other services remain online and are working normally. BEAUTY GARAGE says it is reporting to and consulting with the relevant authorities. TipRanks and 情シスのミカタ both name Japan's Personal Information Protection Commission (PPC) as one of them. The root cause, including how the attacker was able to get in, is still under investigation. The company is also still assessing the financial impact and has promised further disclosures as facts become clear.
A note on sources: one of the documents in the source set is a SEBI offer filing for Beauty Garage Limited. That is a separate company based in Mumbai, India, and it has nothing to do with this incident. Readers searching for the victim by name should not confuse the two.
What Was Taken
- Volume: 775,725 records. All sources that give a figure agree on this number. 情シスのミカタ rounds it to "about 770,000." TipRanks describes the figure as member accounts rather than records.
- Data types: salon name, customer name, email address and phone number.
- Not leaked (per the company): addresses, purchase history, and credit card or other payment information.
These figures should be treated as provisional. The company's own disclosure gives 775,725 as a confirmed count, but the Japan IR summary of that disclosure also lists the "extent of exfiltrated data" as "Unknown." Both TipRanks and 情シスのミカタ say payment and address data are not leaked at this time, which suggests the scope may still change as the forensic work continues.
The data is not as sensitive as financial data, but it is valuable to attackers. Because BEAUTY GARAGE sells only to businesses, each record links a named person to a specific salon and to a working email address and phone number. That is exactly the material needed for targeted business phishing, fake supplier invoices, and phone or SMS scams that pose as BEAUTY GARAGE or other beauty-industry suppliers.
Why It Matters
This incident fits a pattern seen across autumn 2026: attackers going after e-commerce platforms and the third-party integrations around them, with customer contact databases as the goal.
- Magento/Adobe Commerce zero-day (StyleSmuggler, CVE-2026-75650): Tenable reports that this unauthenticated remote code execution bug, rated CVSS 10.0, was exploited from September 4, three days before Adobe released Hotfix VULN-39341 on September 7. BleepingComputer, citing Sansec, reports that it affected all Magento and Adobe Commerce versions and was used to install a stealthy Rust-based Linux backdoor. InfoSec Today reports that Australia's ASD/ACSC warned of "a substantial number of potentially vulnerable instances."
- BigCommerce/Ribon supply-chain compromise: BleepingComputer reports that attackers used stolen credentials for the third-party Ribon apps to reach shopper data and inject scripts into merchant storefronts between September 13 and 17. They took names, emails, phone numbers and shipping addresses.
Important caveat: none of the sources links the BEAUTY GARAGE breach to StyleSmuggler, to Ribon, or to any particular platform or attacker. The company has not said which e-commerce software it runs. The only technical detail it has disclosed is that the intrusion hit its own servers ("自社サーバー"), which points to self-hosted infrastructure rather than a SaaS platform. The campaigns above are background on the current threat environment, not attribution.
For defenders, the lesson is about time. The attackers had about three days of access before detection. The data they reached sat in the same place as, or close to, payment and order systems. The company's report that payment data was not exposed suggests that keeping data stores separate limited the damage.
The Attack Technique
Not yet disclosed. BEAUTY GARAGE describes the cause only as unauthorized access by a third party, with the details still under investigation. What is known:
- Target: the company's own servers behind its e-commerce site.
- Dwell time: October 10 to 12, 2026. Detection came on October 13, when data was found leaving the environment.
- Containment: the company says the access route has been identified and blocked. It has not described what that route was, for example a vulnerability, stolen credentials or a third-party integration.
For comparison only: the StyleSmuggler attacks described by Sansec, Tenable and the ACSC abuse the Magento /graphql endpoint. They slip PHP code into template "styles" properties, which then runs through a fake "failed payment" email. Persistence comes from a cron job that runs every 30 minutes, and command-and-control traffic is disguised as NTP on UDP 123. The BigCommerce incident instead used stolen credentials for a third-party app. Either type of attack could produce a breach that looks like BEAUTY GARAGE's, but until the company publishes its findings, the actual entry point is unknown.
What Organizations Should Do
- Patch and hunt on Magento/Adobe Commerce now. Apply Hotfix VULN-39341 for CVE-2026-75650. If
/graphqldoes not need to be exposed, restrict it. Look for signs of compromise, including an unusual surge in "Payment Transaction Failed Reminder" emails, unfamiliar processes named[kworker/u:8:0]orfc-cache(including~/.cache/fontconfig/fc-cache), new cron jobs that run every 30 minutes, and outbound UDP/123 traffic to hosts that are not real time servers. - Audit third-party app credentials and integrations. Rotate API keys held by e-commerce plugins and marketing or personalisation apps. Remove integrations you no longer use, and limit each app's access to the minimum customer-data scope it needs.
- Keep customer contact data separate from payment and order data. BEAUTY GARAGE's report that payment, address and purchase data were not exposed shows the value of separation. List which systems hold which fields, and keep them in separate stores with separate credentials.
- Shorten detection time with egress and database monitoring. A three-day dwell time ended only when data was seen leaving. Alert on bulk reads from customer tables, unusual outbound transfers from web or app servers, and new persistence mechanisms on public-facing hosts. Keep enough logs to reconstruct the attacker's path.
- Prepare for follow-on fraud. If you are a BEAUTY GARAGE customer or partner salon, expect phishing, fake invoices and phone or SMS scams that use leaked names, salon names and contact details. Verify payment-change requests through a separate channel. If you run an e-commerce business, have customer warning messages and contact-centre scripts ready before you need them.
- Rehearse breach disclosure. Japan's APPI requires prompt reporting to the PPC, and similar laws apply elsewhere. Decide in advance who investigates, who notifies regulators and customers, and on what timeline.
Sources: BEAUTY GARAGE Inc. - Notice of E-commerce Site Information Leakage... | CVE-2026-75650: StyleSmuggler Adobe Commerce FAQ Tenable® | BigCommerce alerts merchants of data breach linked to Ribon apps | Magento StyleSmuggler zero-day exploited to deploy Linux backdoor | Beauty Garage Reports Major Data Leak from Salon E-Commerce Platform | ビューティガレージ、ECで約77万件漏えいか 不正アクセス カード情報は流出なし｜情シスのミカタ | BEAUTY GARAGE LIMITED | ASD warns Aussie Adobe Commerce and Magento stores under attack - I...