Hana Cupid, the Tokyo-based flower delivery network, has confirmed that an unknown third party broke into its management systems and took member data from its two online shops. The company's notice of October 28 puts the number of possibly affected customers at 4,238,242. The leaked fields are login user IDs, hashed passwords, and PC and mobile email addresses. The company says names, addresses, phone numbers and payment card data were not exposed. It has reported the breach to Japan's Personal Information Protection Commission and to the police. It has not said how the attackers got in, and no group has claimed the attack.
What Happened
The company's notice gives this timeline:
- October 14 to 15, 2026: An unknown third party accessed Hana Cupid's management system without authorization.
- October 19, 2026: During its investigation, the company confirmed that member data had leaked.
- October 28, 2026: Hana Cupid published its notice and began emailing affected members in batches. It warned that so many people are affected that notification will take some time.
Japanese breach tracker Moreta notes that the gap between discovery and public disclosure was nine days. Its 2026 dataset puts the median at six days overall and five days for unauthorized access incidents.
Two services are affected: the consumer e-commerce site Internet Hana Cupid (i879.com) and the corporate ordering platform Business Hana Cupid (i879.com/biz/). Hana Cupid says it blocked every attack route used in the intrusion and tightened network access controls and monitoring. It says it has seen no new suspicious activity since. An outside specialist firm is investigating the cause. IT Defense, which tracks the incident, said that as of October 30 the company had published no update on the cause, on when notification would be finished, or on the results of the investigation.
What Was Taken
Every account of the incident cites the same figure: 4,238,242 records. That number comes from the company itself, and Hana Cupid describes it as customers who may be affected. The Japanese vulnerability portal Bankenjp points out that the notice does not say how many records were confirmed as actually taken, so the real count could be lower. Moreta's headline rounds the figure down to "4.23 million". The underlying number is the same.
According to the company, the exposed data is:
- Login user IDs for the e-commerce sites
- Passwords, stored in what the company calls an irreversible, non-decryptable form (described as hashed in its FAQ)
- PC email addresses
- Mobile email addresses
The company says the following were not exposed: names, gender, dates of birth, postal addresses, phone numbers, company and department names, delivery recipient details, and credit card numbers. Its FAQ says card data was not stored on the affected database server.
Former members who have closed their accounts are included. Customers who ordered through third-party shopping malls, ordered by phone without giving an email address, or bought at Hana Cupid's member florists are not.
Why It Matters
The data taken is small in scope, but it is exactly what account takeover needs: a working login ID, a password hash and a verified email address, for more than four million people. Hana Cupid's statement that passwords cannot be restored only holds if the hashing is strong. The company has not named the algorithm or said whether the hashes were salted. Weak or unsalted hashes of common passwords can be cracked offline, and those passwords can then be tried on other services where people reuse them.
That risk is not hypothetical in the region. In early October, The Kyunghyang Shinmun reported on a South Korean breach at Shinhan Bank that affected about 25,000 customers and was linked to credential stuffing. It noted that Korea's Financial Security Institute had warned the year before that ID-and-password logins were open to exactly this attack. Nothing connects that incident to Hana Cupid. It does show how a credential dump from a retailer can become a problem for banks.
The email addresses also enable targeted phishing. A flower delivery service sends order confirmations and gift notifications, so fake "delivery problem" or "breach apology" emails are an obvious lure. Hana Cupid itself warns that attackers may pose as the company or as financial institutions.
The Attack Technique
How the attackers got in is not known. Hana Cupid has not said how the intruders reached its management system, what vulnerability or credentials they used, or how long they were inside beyond the October 14 to 15 window. Bankenjp lists the entry point as undisclosed and declines to judge whether the attack could have been prevented. No threat actor has claimed responsibility, the data has not been reported for sale, and the company says it has found no misuse of the data so far. The fact that the attackers reached a management system and left with only login fields suggests either a narrow query against the member authentication tables or limited access. That is an inference until the outside investigation reports.
What Organizations Should Do
- Check for credential stuffing now. Any service with Japanese consumer users should watch for spikes in failed logins, logins from new IP ranges, and successful logins from email addresses that appear in this dump. Rate-limit and challenge suspicious authentication traffic.
- Check your own password storage. Make sure customer passwords are hashed with a slow, salted algorithm such as Argon2id, bcrypt or scrypt, and not a fast or unsalted hash. A breach notice that says "encrypted" without naming the algorithm leaves customers unable to judge their risk.
- Lock down management and admin systems. Put administrative consoles behind VPN or zero-trust access, require phishing-resistant MFA, and log every bulk query or export against customer tables.
- Delete data from closed accounts. Hana Cupid's exposure includes former members. Set retention limits and purge or anonymize closed accounts so they are not part of the next breach.
- Prepare staff and customers for phishing. Brief help desks and fraud teams on fake Hana Cupid and bank emails. Remind customers that you never ask for passwords by email or phone.
- Offer stronger logins than a password. Make MFA or passkeys available, especially on corporate ordering portals like Business Hana Cupid, where a hijacked account can place orders billed to a company.
Sources: Hana Cupid data breach: up to 4.24M members hit · Osegi | 当社運営サイト（インターネット花キューピット等）への不正アクセスによる会員情報漏えいに関するお詫びとお知らせ - 花キューピット株式会... | Hana-cupid Data Breach (October 2026): Change Your Password, Check... | Hana-Cupid Data Breach: Am I Affected? What Internet Hana-Cupid and... | Hana Cupid Datenleck: 4,24 Mio. Konten betroffen · Osegi | “The ID-password method is vulnerable to credential stuffing”…there... | 花キューピット：インターネット花キューピットの会員情報が不正アクセスで漏えい 日本脆弱性総合ポータル | 花キューピット、不正アクセスで会員情報423万件が漏えい モレタ