E-Store Co., Ltd., the operator of the Japanese e-commerce site-building platform ShopServe, published its final report on October 16, 2026. It confirms that an outside party exploited a vulnerability in a server-side application and sent database contents out of the network from May 21 to August 1, 2026. The final report puts the number of people affected at about 23,356,000 across 7,858 current and former client shops. About 2,096,900 of those people also had partial payment card data exposed. Coverage rounds the headline figure differently: Tech AI Wire reports 23.36 million and AliasFleet reports 23.35 million. Both come from the same E-Store figure. Some early summaries of this incident said "2.1 million shops." That is wrong. The 2.1 million figure is the number of people with partial card data, and the number of shops is 7,858. No threat actor has been named, and E-Store says it has found no sign of the data on the dark web.
What Happened
E-Store has disclosed the incident in three stages, and the scope grew at each one:
- First report (August 1, 2026): According to a timeline compiled by an in-house security blogger (S7), E-Store first described the unauthorized access as a short window on August 1, from about 09:09 to 11:06, and said passwords were not affected.
- Second report (August 2, 2026): E-Store changed the attack window to May 21 through August 1, about ten weeks. It disclosed 8,853,839 records and noted that this count could include the same person more than once. It also added passwords and shop-side credentials to the list of exposed data.
- Final report (October 16, 2026): After an external forensic investigation, E-Store gave a final count of about 23,356,000 people. The forensic team found no other way in and no backdoors. E-Store says it blocked the attacker's traffic on August 1, the day it found the access, and that no attack has succeeded since then.
The jump from 8.85 million to 23.36 million is not a straight correction, because the two numbers count different things. Security Measures Lab (S3) and AliasFleet (S6) both point out that the August figure counted records, while the October figure counts people after E-Store merged duplicate records. AliasFleet argues that the rest of the gap comes from the confirmed scope growing during the forensic investigation. E-Store itself describes 23.36 million as an approximate figure. It covers buyers, members, shop operators and affiliates, and some duplicates could not be merged because they did not meet E-Store's matching rules.
Tech AI Wire, citing ITmedia NEWS, reports that E-Store has been a wholly owned subsidiary of the Japanese e-commerce company BASE since July 2025.
What Was Taken
According to E-Store's final report:
Buyer and member data (about 23.36M people in total, a figure that also includes shop operators and affiliates): - Names, addresses, phone and fax numbers, email addresses, workplaces, and free-text fields that customers filled in - Member IDs (including newsletter members) and encrypted passwords. E-Store says the passwords are unlikely to be recovered, and the leaked data does not link accounts to a specific shop's login.
Partial card data (about 2,096,900 people, part of the total above): - Cardholder name, the first six and last four digits of the card number, and the expiry date - E-Store says it never stored full card numbers or CVV/CVC codes, so the leaked data alone cannot be used to make card payments.
Shop and affiliate data: - Login IDs and passwords for the ShopServe admin panel - Shop details printed on convenience-store payment slips: the name of the person responsible for sales, shop name, postal code, address, phone and fax - Email addresses and passwords of people registered in the affiliate program
Removed from the list in the final report: The second report had listed shop mail system credentials, FTP credentials and bank account details for payouts. The final report removes all three. Earlier analysis, such as S7 (September 23) and ITD (S4, October 3), was written before the final report and still tells readers these items leaked. Where they disagree, E-Store's latest statement should take precedence.
The exposure goes back many years. Hokkaido Gyoren, a seafood shop, used ShopServe from July 2007 to August 2017. It says data on customers from that whole period was included. ITD reports that at least one affected shop's buyers go back to 2008. What leaked differs from shop to shop: Gyoren says E-Store told it that its customers' records included no card data or login passwords. Security Measures Lab lists companies that have published notices, including King Jim, PFU, Magazine House and Hokkaido Gyoren.
Why It Matters
Platform breaches hit customers who never chose the platform. ShopServe runs storefronts under each merchant's own brand, so most victims have never heard of it. E-Store has not published the full list of 7,858 shops (S3, S4). The email notices recipients have shared do not name the shop (S4). This makes it very hard for people to judge their own risk.
Former customers were exposed too. Shops that left ShopServe years ago were still affected. That means E-Store kept historical order data well after those shops ended their contracts. If you have ever left an e-commerce or SaaS vendor, assume it may still hold your data.
Notification gaps. E-Store says it has finished contacting affected individuals, shops and affiliates directly. Hokkaido Gyoren tells a different story: it learned it was affected only after it contacted E-Store itself on September 30, and it says E-Store had not reached out before then. Gyoren's notice does not make clear whether E-Store's statement includes former shops, so the two accounts cannot be fully reconciled.
Data built for convincing phishing. Real names, addresses, order history and the last four digits of a card together let a scammer write a very believable fake message, such as an "order problem" or "card verification" email. E-Store reports no confirmed follow-on harm so far. Even so, the data supports targeted scams for years.
The early figures were far too low. The first report covered a two-hour window. The confirmed figure ended up close to three times the August record count. Defenders should treat a vendor's first disclosure as a minimum, not an upper limit.
The Attack Technique
E-Store says an outside party exploited a vulnerability in an application running on its servers, executed a malicious program, and sent data stored in the database to outside systems. This went on for about ten weeks before it was detected on August 1. E-Store has not named the vulnerable application, assigned a CVE, or said how the data was sent out. The forensic investigation found no other intrusion path and no backdoor. E-Store says it has fixed the vulnerability, checked the affected systems and reset credentials. No group has claimed the attack, and no source attributes it to anyone.
The long dwell time is the main lesson here. Data was being exfiltrated from the database for about ten weeks without being noticed. This suggests weak monitoring of outbound traffic and of unusual processes being launched on application servers.
What Organizations Should Do
- Rotate every platform credential. Merchants on any hosted commerce platform should reset admin panel passwords and enforce multi-factor authentication. This applies to ShopServe in particular, even though E-Store has removed mail and FTP credentials from the leaked list. If any of these passwords were reused on other systems, change them there too.
- Ask former vendors what they still hold. Find out whether past SaaS and e-commerce providers still keep your customers' data after the contract ended. Put deletion and retention terms in contracts and check that they are followed.
- Contact your vendor yourself. Do not wait for the vendor to reach you. Gyoren found out it was affected only by asking. Assign someone to watch vendor incident notices and to request your shop-level impact data directly.
- Warn customers about specific lures. Tell customers that you will never ask for a full card number or security code. Tell them that a message quoting their real order details or the last four card digits is not proof it is genuine. Give them E-Store's official contact ([email protected]) for checking whether they are affected.
- Watch outbound traffic from application servers. Flag large or unusual database reads and outbound transfers, and flag unexpected child processes on web and app servers. Ten weeks of undetected exfiltration is the specific gap to close.
- Hold vendors to their first disclosure, then wait for the final one. Build incident response plans on the assumption that the first figures will be too low. Keep incident tickets open until the vendor publishes its final forensic findings.
Sources: ShopServe and skyticket breaches: 23.36M people, card data | Shopserve (E-Store): Data Breach Impact, Affected Stores, Credit Ca... | Eストアー ショップサーブへのサイバー攻撃による個人情報漏洩 まとめ PFU・キングジムなど影響企業一覧、885万3,839件が対象セ... | ShopServe Data Breach (August 2026): How to Tell If Your Shop Was A... | 不正アクセスによる個人情報漏えいに関するお知らせ（最終報） ＥＣサイト構築・ネット通販総合支援の【Ｅストアー】 | E-store Final Report Puts ShopServe Breach at 23.35 Million | ショップサーブ不正アクセス、店舗側の認証情報流出が本当の脅威——情シス担当が今すべきこと - 城咲子｜情報システム部セキュリティ担当の... | 過去に当店が利用していたECサイト構築サービス「ショップサーブ」への不正アクセスに関するお知らせ