Bookoff Group Holdings (TSE: 9278), the Japanese operator of the BOOKOFF second-hand goods chain, says an unidentified third party broke into a member management system run by one of its subsidiaries and took member data from it. The company filed a timely disclosure titled "Apology and Notice Regarding Personal Information Leakage Due to Unauthorized Access" on the Tokyo Stock Exchange at 08:30 JST on October 9, 2026, according to the ufocatch filing index. Every outlet that covered the filing cites the same ceiling: up to roughly 6.43 million records. Most of them also repeat the company's caveat that this figure counts member numbers, not people. Payment data was not stored on the system. As of October 9, the company says it has seen no misuse of the data, no public posting of it and no tampering with member records.
None of the sources we reviewed is the company's own statement or a regulator filing. The filing listed on ufocatch is Bookoff's own disclosure, but we could see only the index entry, not the document itself. The details below therefore come from press reports of that filing. Those reports agree closely with each other.
What Happened
- October 6, 2026 (Tuesday): Bookoff detected unauthorized access to the subsidiary's member management system. Kyodo, ITmedia (via mixi), the Rocket Boys Security Measures Lab write-up and ASCII all give this date.
- Investigation: The company says its investigation found that member information held in the system had been "acquired from outside." That means it has confirmed data was taken, not only that it might have been. The Security Measures Lab write-up stresses this point.
- Containment: Bookoff says it cut communication with the attack source, fixed a vulnerability, blocked external access to the affected system and is continuing to monitor it. It says it has closed the theft route it currently knows about.
- Disclosure timing: Dengeki Online published its report at 23:12 JST on October 8. The ufocatch index puts the exchange filing at 08:30 JST on October 9. This suggests the notice went up on Bookoff's website the night before the formal filing. ITmedia notes a notice link on the company's homepage. The sources don't explain the gap.
- Next steps: Bookoff is running an emergency review of all its systems and adding network and application security controls. It has reported the incident to Japan's Personal Information Protection Commission (PPC) and plans to contact affected members individually as its investigation continues.
What Was Taken
Volume. All sources report "up to approximately 6.43 million." Accounts differ on what that number counts:
- Kyodo calls it information on "up to 6.43 million accounts."
- ITmedia/mixi, Dengeki Online and the Security Measures Lab say it is the number of member numbers that may have leaked. They say it is explicitly not the number of affected people, which Bookoff is still working out.
- ASCII and TipRanks describe 6.43 million "member data records" or "membership records."
The member-number reading matches the company's own wording, so treat 6.43 million as an upper bound on records. The number of people affected may be lower, for example if some customers have more than one member number. Bookoff has not given a headcount.
Data fields. Most sources list the same set:
- Full name
- Date of birth and gender
- Email address and phone number
- Postal code and home address
- Password hash values
- Point card number and member number
Kyodo's English report gives a shorter list: names, birthdays, addresses, emails, membership numbers and reward program IDs. It does not mention phone numbers, gender or password hashes. Every other outlet, including the Japanese-language reports of the filing, includes password hashes, so their omission from Kyodo looks like a gap in that report, not a disagreement about what was taken. Bookoff says it is still working out which fields were exposed for each member.
Not affected. Credit card and other payment data were not stored in the affected system, according to all sources.
Sensitivity. The leaked fields combine identity details (name, date of birth, address, phone) with password hashes. That makes the data useful for both social engineering and credential attacks. Dengeki Online describes the hashes as "encrypted" passwords that cannot be read as-is. That is technically wrong: hashing is not encryption. As the Security Measures Lab notes, Bookoff has not said which hash algorithm it used, whether the hashes were salted, or whether any have been cracked. Until it does, assume weak hashes can be cracked offline.
Why It Matters
Scale and reach. BOOKOFF is a household name in Japan. A member list of this size covers a large share of the country's consumers, and the data is ideal for targeted phishing. Bookoff has already warned that criminals may pose as the group by email, SMS or phone. It says it will never ask for passwords or financial details through those channels.
Credential reuse. Password hashes for millions of retail accounts, linked to verified email addresses and phone numbers, are valuable for credential stuffing. Once hashes are cracked, the email-and-password pairs can be tried against banks, e-commerce sites and webmail. Customers who reuse passwords are exposed far beyond Bookoff.
Part of a wider wave. Kyodo places the Bookoff breach among dozens of Japanese companies reporting unauthorized access in recent days. Others include:
- The Times Car car-sharing service: about 6.6 million accounts, plus images of 1.6 million driver's licenses
- Lawson
- Daiichikosho
- H.I.S.: passport data from a breach late last year
- SoftBank subsidiary IDC Frontier: ransomware that disrupted part of its cloud service
No source links these incidents to a common actor or method, and nothing here should be read as doing so. Still, so many simultaneous disclosures suggest Japanese consumer-facing systems are under sustained pressure. Japanese defenders should treat this as an elevated threat period.
Subsidiary-run systems. The breached system belongs to a subsidiary, not the listed parent. Customer data held by group companies is often patched and monitored less closely than the parent's own core systems.
The Attack Technique
Bookoff has released very little technical detail. What is known:
- Access was gained by an unidentified third party.
- The company says it "corrected a vulnerability," which points to exploitation of a weakness in the member management system or its supporting infrastructure, not insider misuse. It has not said whether the flaw was in the application, a third-party component or the network edge.
- Data was exfiltrated over an external channel, which Bookoff cut off by blocking traffic from the attack source.
Not disclosed: the type of vulnerability, any CVE number, the initial access vector, how long the attacker was inside, or who the attacker is. No group has claimed the attack in the sources reviewed, and there is no sign of ransomware or extortion. Any attribution would be speculation at this point.
What Organizations Should Do
- Audit how passwords are stored. Confirm customer passwords are hashed with a modern, salted, memory-hard algorithm such as Argon2id, scrypt or bcrypt at a suitable cost. Plan a forced migration away from legacy or unsalted schemes. Assume any leaked hash table will be attacked offline.
- Bring subsidiary systems up to the parent's standard. List every customer data store across group companies. Apply the same patching schedule, attack-surface monitoring and penetration testing to them as to core systems.
- Watch for credential stuffing now. If you run consumer logins in Japan, expect replay attempts using Bookoff-linked email addresses. Turn on rate limiting, bot detection and breached-password screening at login, and push customers toward multi-factor authentication or passkeys.
- Prepare for phishing that impersonates Bookoff. Tune email and SMS filters for BOOKOFF-branded lures. Remind staff and customers that legitimate companies don't ask for passwords or payment details by email, SMS or phone.
- Detect bulk exfiltration from member databases. Alert on unusually large queries or exports from CRM and loyalty systems, and on outbound traffic to new destinations. Detection within days, as here, is only good if the exfiltration window was short.
- Practise the disclosure. Bookoff contained the breach, filed with the exchange and reported to the PPC within about three days of detection. Run tabletop exercises on your own regulatory, exchange and customer notification steps so you can move as fast.
Sources: Japanese second-hand retailer reports up to 6.43 mil. customer ... | ブックオフ、会員管理システムへ不正アクセスによるサイバー攻撃、最大約643万件の個人情報漏洩の恐れセキュリティニュースのセキュリティ対... | BOOKOFF Probes Massive Member Data Breach After ... | Bookoff Potentially Leaks Up to 6.43 Million Records Due to ... | BOOKOFF、最大約643万件情報流出 mixiニュース | ブックオフで不正アクセスにより会員情報が外部流出。現時点で被害はないものの、悪用の可能性に注意喚起 - 電撃オンライン | Bookoff Group Reports Data Leak, May Have Affected Up to 6.43 Milli... | ブックオフグループホールディングス(9278) 不正アクセスによる個人情報漏えいに関するお詫びとお知らせ 2026年10月9日 - 有...