Kirin Holdings disclosed on October 16, 2026 that attackers got into the e-commerce sites of FANCL Corporation, its wholly owned cosmetics and health foods subsidiary, and FANCL's own cosmetics subsidiary Attenir (written "ATENEA" and "ATENIA" in different English renderings of the filing). Member data was taken from both. The disclosure, as reproduced by Japan IR and by the filing aggregator Yuho Catcher, lists 393,785 FANCL member records (368,184 people) and 441,162 Attenir records (417,312 people). That is 834,947 records covering 785,496 people. ITmedia NEWS rounds it to "about 830,000." Kirin says no credit card or payment data was involved. No threat actor has been named and no group has claimed the attack.
What Happened
ITmedia NEWS reports that both sites were accessed without authorization between October 3 and October 10, 2026, and that an internal investigation on October 15 found the problem. Disclosure came the next day, which is fast by Japanese corporate standards. The Kirin filing itself does not give the intrusion window, so treat those dates as ITmedia's reporting of the company's release.
What Kirin confirmed in its filing:
- Member information from both e-commerce platforms was "leaked externally." The company says it was exfiltrated, not just possibly viewed.
- Kirin has set up an Emergency Response Headquarters and says it will take recurrence-prevention measures across the company.
- It has reported the incident to the Personal Information Protection Commission (PPC) and has begun consulting the police.
- It sees no significant operational impact so far. The effect on consolidated results is "under examination," and Kirin says it will disclose separately if the impact is material.
ITmedia adds that the company found the specific site function that caused the breach and switched it off. It also reports that, as of the announcement, there was no sign the data had been published, no confirmed misuse, and no reports from customers. Affected members will be notified one by one at their registered email addresses.
The disclosure timestamps differ between aggregators. Japan IR shows the page updated at 10:37 on October 16. Yuho Catcher lists the TDnet timely-disclosure time as 18:00 the same day, and ITmedia published at 17:18. This doesn't change the substance, but anyone building a timeline should know about it.
What Was Taken
The sources agree on the core fields:
- Full names, postal addresses, email addresses
- Telephone numbers, dates of birth, gender
- Hashed passwords
They differ on the details. Kirin's filing, as aggregated, adds "support IDs" and simply says "passwords are hashed." ITmedia's account of the release is more specific:
- Customer numbers, sub-email addresses, and the hashed passwords attached to them
- Security-question items. ITmedia says the answers were not included.
- Points balances and membership tier ("member stage") information
ITmedia also says the hashed passwords are the secondary passwords some members set up, and that primary account passwords were not affected. The Kirin filing excerpts don't say this either way. Until FANCL publishes something more detailed, the safe reading is that some password hashes are now in an attacker's hands. Which credential they belong to, and which hashing scheme was used, is not yet confirmed.
Records vs. people: each company's figures count more records than people, which suggests some members have more than one record. It is not stated whether anyone appears in both the FANCL and Attenir sets. Summing 785,496 people across the two brands could therefore overstate how many unique individuals are affected.
This is not a sensitive-category breach. It is still a dense identity profile: name, address, phone, date of birth and gender, all tied to a verified shopper of a well-known beauty and supplement brand. That is good raw material for targeted fraud.
Why It Matters
Phishing and smishing are the immediate risk. Attackers now know these people's names and addresses, which brand they buy from, and how much loyalty status they have. Messages along the lines of "Your FANCL points are expiring," "Verify your Attenir account" or a fake delivery notice will be convincing. FANCL is itself emailing affected customers, so attackers have a ready-made pretext to imitate.
Hashed passwords are not a closed door. If the hashing is weak or unsalted, people who reuse passwords are exposed elsewhere. The same month shows why that matters. NEXSIGHT CYBER WIRE reported that the mystery-shopper service Fancrew (ファンくる) took a credential-stuffing attack between August 20 and 24, 2026: 5,060,270 login attempts, 59,389 accounts compromised, and points fraudulently exchanged on two of them. Fancrew is a separate company and is not connected to FANCL. Anyone triaging alerts should watch for the name confusion. The case is relevant because leaked Japanese consumer identity data gets fed straight into this kind of attack.
Japanese consumer platforms are being hit through the application layer. In September 2026, 2rinkan Yellow Hat published its final report on abuse of its app's API. The figure was revised down from "up to 3,455,754" to 3,179,454 members, and the leaked data included app passwords and vehicle details. Combined with FANCL's statement that a single "function" was responsible, the pattern points to exposed site features and APIs, not network perimeters, as the weak point. To be clear, none of the sources link these incidents to each other or to the same actor.
No ransomware link has been established. One of the sources gathered for this brief is a Cisco Secure Firewall Management Center hunting guide (CVE-2026-20079 and CVE-2026-20316, activity Talos describes as consistent with Qilin affiliates). Nothing in Kirin's or FANCL's statements connects that activity to this incident, and readers should not infer one. The incident as disclosed is data theft from an e-commerce application. Nothing so far indicates encryption or extortion.
The Attack Technique
The intrusion method has not been disclosed. Kirin's filing says "unauthorized access" and nothing more. According to ITmedia, the company found and disabled "the function that was the cause." That wording suggests a specific feature of the e-commerce application was abused, rather than stolen staff credentials or a compromised server. A vulnerable endpoint, an access-control flaw such as an IDOR, or an exposed API are all consistent with it. It is still our inference, not the company's.
Some points support that reading. The attack stayed within the member databases of two related storefronts. Payment data, which FANCL apparently handles through a separate system, was not reached. The company reports no operational disruption. The data taken (profile fields, sub-email credentials, security-question items, points) is the kind of thing a member-account or profile-retrieval function would return. Until FANCL or a forensic report says more, treat the root cause as unknown.
What Organizations Should Do
- Inventory and test every function that returns member data. Profile lookups, account recovery, sub-account management, points queries and order history all need checking. Test each one for broken object-level authorization and over-broad responses, and confirm that one session cannot enumerate other members' records.
- Rate-limit data-returning endpoints and alert on unusual volume. A week-long harvest of hundreds of thousands of records should stand out. Alert when a single session, IP range or token pulls an unusual number of distinct member IDs, not only on failed logins.
- Store every credential the same way. Secondary passwords, PINs and app passwords should get the same modern salted, slow hash (Argon2id, scrypt or bcrypt) as primary passwords. Secondary credentials are often left on older schemes.
- Get ahead of the phishing wave. If you are a breached brand, publish the exact sender addresses and channels you will use, as 2rinkan did with its SMS numbers. Tell customers you will never ask for passwords or card details by email. If you are a retailer in the same sector, expect lookalike campaigns using your brand too.
- Harden login against credential stuffing now. Leaked identity data leads to reuse attacks, as Fancrew's 5M-attempt incident shows. Deploy bot detection, breached-password screening and step-up authentication before points or account details can be changed.
- Rehearse fast disclosure. FANCL went from detection on October 15 to disclosure on October 16, with reports to the PPC and police. Under Japan's APPI, a preliminary report to the PPC is generally due within about 3 to 5 days, so the reporting workflow should be scripted before an incident, not written during one.
Sources: Kirin Holdings Company, Limited - Notice of FANCL Personal Informat... | Privacy Policy | 【重要】「２りんかんアプリ」をご利用のお客様へ：個人情報漏えいの可能性に関するお詫びとご報告｜更新情報｜2りんかん | 覆面調査サービス「ファンくる」にリスト型攻撃 — 59,389人で不正ログインが成立、会員情報が閲覧された可能性 NEXSIGHT... | Hunt Cisco FMC: home.jsp, license.tmp, socks5 | 【キリンホールディングス】ファンケル情報漏えいのお知らせ｜2026年10月16日 Japan IR | ファンケルとアテニア、計約83万件の会員情報漏えい ECサイトに不正アクセス（ITmedia NEWS）｜ｄメニューニュース（NTTドコモ） | キリンホールディングス(2503) 当社子会社(株式会社ファンケル)における不正アクセスによる個人情報漏えいに関する… 2026年10...