For: customers of and ST stores or the and ST web store in Japan, staff at companies that do business with the group, and anyone who handles customer data. This article is based on the company's official notice and does not cover attack or scam techniques.
Developing: this article will be updated as the organisation publishes more
As of October 24, 2026Not yet known
- Scope of employee data
- Method of access
- How and when individuals will be contacted
- Dedicated inquiry desk
- When member points will be usable again
In its October 23 notice, the company says it is starting to contact affected customers and partners in turn and will set up an inquiry desk. It says it will report promptly if further investigation finds anything new that should be reported. When we checked the company's notice list on October 24, no follow-up had been published.
What members should do today
Check any notice from the company in the official app, not through its links
The company says it is starting to contact affected customers in turn. As of October 24, the notice does not say whether this will be by email, app or post.
If you receive something that looks like it comes from the company, do not open its links. Check whether the same information appears in the official app, or on the official website opened from a bookmark or a search.
Do not trust a message just because your brand, address or birth date is correct
The data that may have leaked includes name, address, phone number and email address, plus date of birth and member ID. A fake message can show your real address and birth date.
If a message about an "apology", a "refund" or "confirming your member details" asks for card numbers, bank details or login information, stop there (how to spot these: What is phishing?).
Be careful with messages about point 'compensation' or 'expiry'
According to the company, member points currently cannot be used in stores or on the web store. Situations like this are commonly used as an excuse for fake messages such as "we will compensate your points" or "your points are about to expire".
Check your points in the official app or My Page on the official website. The company’s support page says that during maintenance My Page may not open and point balances may display incorrectly; even if something looks wrong, do not try to check through a link in an email or text message.
Passwords are said not to be included; just stop reusing them
The company says passwords set by customers are not among the data that may have leaked, and it does not ask customers to change them.
Member IDs and email addresses are included, however. If you use the same password elsewhere, give each service its own now, so a leak somewhere else cannot be reused here. A password manager is the practical way to do this.
Do not answer 'identity checks' over the phone
With a birth date, address and phone number, a caller can pose as the company "confirming your identity" and try to get the rest, such as card numbers or PINs.
Even if the caller claims to be from the company, do not answer on the spot. Hang up and contact the desk listed on the official website yourself.
If you entered details or paid, get help right away
If a fake message led you to enter card or bank details, contact your card issuer or bank immediately.
In Japan you can also call the police consultation line (#9110) or the consumer hotline (188). The sooner you report it, the better the chance of stopping a payment.
What business partners should do
About 10,000 business-partner records may have leaked, covering company name, ordering and return addresses, contact person's name, phone number and email address. Together, these make it easier to write an email that pretends to come from a trading partner.
- If an email in the name of the company or its group asks you to change bank details or pay urgently, confirm with the person through a phone number you already know
- Do not use the phone number or reply address in the email to check
- Before opening unfamiliar attachments or links about orders or returns, ask your own IT contact
What happened (from and ST HD's notice)
On October 23, 2026, and ST HD Co., Ltd. (a holding company whose group includes Adastria) posted a notice of apology on unauthorized access to its business servers and a possible leak of personal and other data on its corporate site. Everything below is as stated in the company's notice. Times are Japan time.
Oct 22, 2026, around 7:30 a.m.
Unauthorized access from outside: login attempts, intrusion and data extraction were carried out against several of the company's servers in turn.Around 10:00 a.m.
The company detected the unauthorized activity and isolated the servers involved.By 5:00 p.m.
The access route was cut off and internal business systems were stopped, among other steps. The company confirmed that the route could no longer be used after it was cut off.Oct 23
The company consulted the police, reported to the Personal Information Protection Commission, published the notice and said it would start contacting affected people in turn.
- Customers
- About 2.5 million records. Name, date of birth, gender, address, phone number, email address, member ID
- Business partners
- About 10,000 records. Company name, ordering and return addresses, contact person's name, phone number, email address
- Employees
- Scope still being confirmed
- Not included
- Payment data such as credit card details, and passwords set by customers themselves
- Sequence
- From around 7:30 a.m. on October 22, login attempts, intrusion and data extraction against several servers in turn. Detected and isolated around 10:00 a.m.; route cut off by 5:00 p.m.
- Web store
- The and ST web store was not affected by the unauthorized access. Member points, however, currently cannot be used in stores or on the web store
- Response
- Emergency measures taken; method of access identified and dealt with. Contacting affected customers and partners in turn; an inquiry desk is to be set up
- Reported to
- Police consulted; Personal Information Protection Commission (Japan's data protection authority) notified (October 23)
- Contact
- The customer inquiry form listed in the notice: support.dot-st.com (use this or the official website, not contact details in an email or text)
The and ST support site says that "system maintenance" has been under way since around 5:00 p.m. on October 22, and lists effects including: orders using points cannot be placed, point balances may not display correctly, My Page may not open, in-store pickup and try-on services are suspended, and linking with d Account or Rakuten ID may not work (checked October 24). That page itself does not mention the unauthorized access.
The company's business servers
Unauthorized access from around 7:30 a.m. on Oct 22; detected and isolated around 10:00 a.m.
↓ Data that may have leaked
Customers: ~2.5 million records
Name, date of birth, gender, address, phone, email, member ID
Business partners: ~10,000 records
Company name, ordering/return addresses, contact name, phone, email
↓ What commonly follows
Emails, texts, calls or letters in the company's or a brand's name
Using an apology, point compensation or an identity check to ask for card or login details
↓ Do not use the links or numbers
Check in the official app or a website you open yourself
A genuine notice will appear there too
What is known and what is not
Based on the company's notice of October 23, as of October 24, 2026. We will update the status column as follow-ups appear.
| Item | What the company says | Status |
|---|---|---|
| Unauthorized access | A third party accessed the company's business servers without authorization | Confirmed (company) |
| Timing and response | From around 7:30 a.m. on Oct 22; detected and isolated around 10:00 a.m.; route cut off by 5:00 p.m. | Confirmed (company) |
| Customer data | ~2.5 million records: name, date of birth, gender, address, phone, email, member ID | Possible (company) |
| Business-partner data | ~10,000 records: company name, ordering/return addresses, contact name, phone, email | Possible (company) |
| Employee data | Scope still being confirmed | Under investigation |
| Payment data and customer-set passwords | Not among the data that may have leaked | Not included (company) |
| Which membership service | Not stated | Not stated |
| Method of access (cause) | Said to be identified and dealt with; not published | Not stated |
| and ST web store | Not affected by the unauthorized access | Confirmed (company) |
| Member points | Currently unusable in stores and on the web store; no restoration date given | Not stated |
| Contacting individuals | To start in turn; method and timing not given | Not stated |
| Misuse | No announcement that messages using the leaked data have been received | Not stated |
| Police and regulator | Police consulted; Commission notified | Confirmed (company) |
What this combination of data can be used for
The following is what generally happens when this combination of data leaks. It is not a statement that it has happened in this incident.
What a fake message can include
- Name, address and phone number: letters or texts with a brand name
- Date of birth: a phone "identity check"
- Member ID: a "confirm your membership" link to a fake login page
What a fake message cannot do
- Change the notices inside the official app
- Change what My Page shows on an official website you opened yourself
- Get the desk listed on the official website to tell you the same story
For an earlier case where member data leaked without passwords, see the MrMax app and online store breach. To see how the advice changes when password data is involved, compare the Bookoff member data leak.
What is different here: business partners' contact details are included
While many retail breaches affect only members, here company names, ordering and return addresses, contact persons' names and contact details for about 10,000 business-partner records may also have leaked.
That means preparing not only for fake messages aimed at members, but also for emails that pose as a trading partner and ask for payment or a change of bank details.
For those who handle customer data
The method of access has not been published. This section sticks to what can be drawn from the sequence the company described.
Alert on repeated login attempts across several servers
According to the notice, login attempts were made against several servers in turn. Rather than only counting failures per server, add one source trying to log in to several servers in a row to your alert conditions.
Admin logins should always require a check beyond the password (multi-factor authentication).
Sources (public record)
The facts in this article come from the public sources below. The undisclosed method of access and the membership service involved are not speculated on.
- and ST HD Co., Ltd., notice of apology on unauthorized access to its business servers and possible leak of personal and other data (October 23, 2026, Japanese) — andst-hd.co.jp
- and ST support, notice on effects of site maintenance (checked October 24, 2026, Japanese) — support.dot-st.com
Update history
2026-10-24: First version, based on and ST HD's notice of October 23. Will be updated when the scope of employee data, how individuals will be contacted, or the restoration of member points is announced.
Read next
- Similar cases: Abahouse data breach (fake refund emails) / The MrMax breach
- Follow-on scams: What is phishing? / Email spoofing and SPF, DKIM, DMARC
- Passwords: How to check if your password leaked / Choosing a password manager
- Other 2026 incidents: list of breaches and cyberattacks (Japan and worldwide)