For: members (full members) of Aena Co., Ltd.'s EC app. This article is based on Aena's official notices and does not cover attack techniques. Aena describes itself on its site as one of Japan's largest off-price store chains.
Developing: this article will be updated as the organisation publishes more
As of October 30, 2026Not yet known
- Details of the cause and route
- Whether the data was actually taken
- Final list of people affected
- Whether any secondary harm occurs
- Whether there is compensation
In its October 20 notice the company says it is strengthening its information security and reviewing its monitoring systems. It gives no schedule for further announcements. We checked its news list on October 30 and found no announcement on this incident newer than the October 20 "service resumption" notice.
What members should do today
Work out whether you could be in scope
The people who may have had data viewed are full members of the EC app, up to 817,215. LINE members and customers who used Amazon, Rakuten and similar sites are not affected. The company says it is notifying members who may be affected by individual email, in stages.
If you had an EC app membership, assume you may be in scope, whether or not you received an email, and go on to the next steps.
Reset your app password
According to the company's October 20 notice, a password reset screen appears at the first launch after the service resumed; follow it and set a new password. You can also change it at any time: "Membership card", then "Check/change member information", then "Change member information".
The company says no password was viewed or leaked. Even so, if you used the same password on another service, change it there too (how to check if your password was leaked / choosing a password manager). Turn on two-step verification where available (this site's recommendation).
Do not use links or numbers in delivery or order messages
The company says it never asks for passwords or card information by email, text or phone.
This time, name, address, phone number and email may be combined with delivery details and the last 4 digits of a card. That is enough to build a convincing message such as "your parcel could not be delivered", "please confirm your order" or "re-register your card". If you get one, do not use the links or phone numbers in it; check on the official site you open yourself or in the app (what is phishing?).
Check your card statements
For cards, the last 4 digits, expiry date and cardholder name may have been viewed. The company says it does not hold full numbers or security codes, and that it confirmed no purchase was completed. As a general precaution, check your card statements for charges you do not recognise and contact your card company if anything looks wrong. Ask the card company whether a replacement is needed.
Know that third parties you registered may be included
The information that may have been viewed includes delivery addresses, names and phone numbers, and the notice says this includes third-party recipients. If you registered a relative or friend, for example for a gift, their details may be included. If needed, tell them to be careful with unexpected messages.
Contact line and withdrawal
The company lists a customer line (toll-free 0120-532-565, 10:00 to 17:00 Japan time, excluding weekends and holidays; October 14 notice). On October 16 its news list also shows a dedicated page for withdrawing from EC app membership. Follow the company's official site if you want to withdraw.
1. Delivery, order or card message claiming to be Aena
Name, address and delivery details are correct → do not decide here
↓
2. Do not use its links or numbers: open the official site or the app yourself
Customer line 0120-532-565 (weekdays 10:00 to 17:00)
↓
3a. A request you cannot confirm
Entering a password or card number, or opening an attachment → do not respond
3b. The official site or app gives the same guidance
Follow the official guidance
What happened (according to Aena)
The following is based on three notices from the company: October 14 ("Possible leak of customer information due to unauthorized external access"), October 16 ("Notice about the planned resumption of the EC app service") and October 20 ("Notice of EC app service resumption").
Oct 13, 2026 (Tue), 5:58
Log analysis found that member My Page had been viewed without authorizationOct 14 (Wed)
Announced. Up to 817,215 members may have had data viewed. At the time of the notice, access to the EC site was blocked and measures to prevent recurrence were being built. Members who may be affected were being notified by individual email, in stagesOct 16 (Fri)
Announced a planned resumption of "Monday, October 19, 2026, in the afternoon", with the time possibly changing depending on the progress of the workOct 19 (Mon), noon
The EC app service resumed (per the October 20 notice). A password reset screen appears at the first launch after the restart
- Member information
- Name, address, phone number, email address, date of birth, gender, occupation
- Delivery information
- Registered delivery address, name and phone number (including third-party recipients)
- Settings
- Favourite store, mail delivery settings
- Credit card (partial)
- Last 4 digits, expiry date and cardholder name of registered credit cards
- Not included (company)
- Full card numbers and security codes (not held); passwords were not viewed or leaked. It confirmed no change to member information, no withdrawal and no completed purchase
- Not affected (company)
- LINE members; customers who used Amazon, Rakuten and similar sites
- Contact
- Customer line 0120-532-565 (10:00 to 17:00 Japan time, excluding weekends and holidays)
What is known and what is not
Status as of October 30, 2026. We will update this table as the company publishes more.
| Item | What the notice says | Status |
|---|---|---|
| Unauthorized access occurred | Found by log analysis at 5:58 on Oct 13 | Confirmed (company) |
| Members whose data may have been viewed | Up to 817,215 (full members) | Possible (company) |
| Name, address, phone, email, date of birth, gender, occupation | May have been viewed | Possible (company) |
| Delivery address, name and phone number | Including third-party recipients; may have been viewed | Possible (company) |
| Favourite store and mail settings | May have been viewed | Possible (company) |
| Card last 4 digits, expiry date, cardholder name | May have been viewed | Possible (company) |
| Full card number and security code | Not held; not viewed or leaked | Not included (company) |
| Passwords | Not viewed or leaked | Not included (company) |
| Changes to member information, withdrawal, purchase completion | Confirmed not to have occurred | Not confirmed (company) |
| LINE members; Amazon and Rakuten buyers | Not affected | Not included (company) |
| Whether data was actually taken | Only "may have been viewed" | Not stated |
| Misuse | The company says no misuse of member information or secondary harm resulting from this incident had been confirmed (as of October 14); it warns of phishing and impersonation | Not confirmed (company) |
| Cause | "Mechanical continuous access made through unauthorized access"; details under investigation | Under investigation |
| Compensation | Not stated | Not stated |
Note: the figure is a maximum number of people, and it is a possibility of viewing, not confirmed theft
817,215 is the maximum number of members whose data may have been viewed. The notice does not say how many were actually viewed or whether any data was taken. The October 16 notice planned the restart for "Monday, October 19, in the afternoon", while the October 20 notice gives it as "Monday, October 19, at noon". (The notice also says the service resumed "today", so its wording of the date and time is not fully consistent.) This site follows the October 20 notice for the restart time.
What the combination of items could be used for
The following is what can generally happen with this combination of items. The company has not announced that any of it has happened in this incident.
- Name + address + phone number + email address: fake emails and texts with a real-looking name and contact details. A parcel failure notice or an order confirmation is a typical form
- Delivery details (including third parties): messages can reach not only the member but also the people they sent gifts to. Those people have no relationship with Aena, so they have less reason to doubt a message, and an urgent tone can catch them off guard
- Card last 4 digits, expiry date, cardholder name: material that makes a "please confirm your card number" message look real. A payment cannot be made from these alone, but a message may try to get the rest from you
- Date of birth: handy for an identity-check message that looks as if only you would know the answer
Most of this can be prevented by not using the links or numbers in a message and checking on an official site or in the app that you open yourself. Check the company's news for updates.
What operators should review
The details of the cause have not been disclosed, so this section covers only what can be said from the published course of events.
- How it was found: the company says log analysis revealed the viewing. That worked because records were kept. Check how long logs are kept and what is in place to review them.
- Room for "mechanical continuous access": the cause given is mechanical continuous access. In general, a pattern that views many members' screens in quick succession can sometimes be stopped by rate limits or detection of unusual access. The route here has not been disclosed, so this is not stated as the cause of this incident.
- Holding third parties' details: a design that keeps third parties' names, addresses and phone numbers in My Page spreads the impact of a viewing beyond members. You can consider showing fewer fields or masking part of them.
- Speed of response: the company announced the next day after finding it, and access to the EC site was blocked at the time of the announcement. It also invites members to set a new password at the first launch after the restart. That is what the published course of events shows.
Sources (public records)
The facts in this article are based on the public information below. We have not guessed at the details of the cause, whether data was taken, or compensation, which have not been announced.
- Aena Co., Ltd., "Possible leak of customer information due to unauthorized external access" (Japanese, October 14, 2026) — aena.co.jp
- Aena Co., Ltd., "Notice about the planned resumption of the EC app service" (Japanese, October 16) — aena.co.jp
- Aena Co., Ltd., "Notice of EC app service resumption" (Japanese, October 20) — aena.co.jp
- Aena Co., Ltd., news list (Japanese, checked October 30) — aena.co.jp/news
Update history
2026-10-30: First version, based on Aena's notices of October 14, 16 and 20 and its news list (checked October 30; nothing newer on this incident than October 20 found). We will update when the details of the cause, whether data was taken, or compensation are announced.
Read next
- A Japanese retail case from the same period: MrMax (members' names, emails and phone numbers) / The Toypo app breach
- A similar case (an internet provider's member data): So-net member database unauthorized access
- Follow-on scams: What is phishing? / Smartphone security basics
- Protect your accounts: How to check if your password was leaked / Choosing a password manager / Choosing multi-factor authentication
- Other 2026 incidents: Data breaches and cyberattacks in 2026 (Japan and worldwide)