For: people who registered on the Beauty Garage or Eyelash Garage e-commerce site, expected to be mainly businesses such as hair salons and beauty salons. This article is based on the official notices of Beauty Garage Co., Ltd. and Eyelash Garage Co., Ltd. and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 29, 2026Not yet known
- Cause and method of intrusion
- How the two companies' record counts relate (breakdown, overlap)
- Whether the leaked information has been published or misused
- Final confirmation on address, purchase history and payment information
- Whether there is compensation
In their second notices on October 20, the companies say they are working with a security firm on prevention and detection of intrusions and is strengthening its handling of personal information. It gives no schedule for further notices. We checked both companies' notices on October 29 and found nothing newer than the October 20 second notices.
What salon owners and registered businesses should do today
Work out whether you could be in scope
If your business has ever registered on either company's e-commerce site, assume you may be in scope. The company says it is notifying affected customers individually by email. Even if no notice has reached you, go on to the next steps if you think you registered.
Do not use links or phone numbers in messages claiming to be either company or a business partner
The items confirmed as leaked include company name, salon name, customer name, business type, salon URL, phone number and email address. A fake message can get these right. The company also warns about suspicious emails, texts and calls pretending to be from it or its business partners.
Do not use links or phone numbers in the message; check through an official contact. The company says it will not ask for passwords or authentication codes in connection with this incident.
- Beauty Garage: 0120-974-554 (10:00 to 18:00 Japan time, closed Sundays and public holidays)
- Eyelash Garage: 03-5774-0811 (10:00 to 18:00 Japan time, closed Sundays and public holidays)
Verify any request to change a transfer destination or make an extra payment through a separate channel
The company asks people who are asked to change a transfer destination or make an additional payment to confirm it through its official contact. In business dealings, a message from a supposed supplier saying "our bank account has changed" is a commonly used scam.
Do not change a payment until you have confirmed it through a contact you already know or the official website, not a phone number or email address on the invoice or message. Tell whoever handles your accounts.
Change the password wherever you use the same or a similar one
Password hash values and hash values of the password-reset question and answer are reported as leaked. The company says they cannot be read as they are, but it asks that anyone who uses the same or a similar password on other services change it.
Change your password on both companies' sites as a precaution. If you used a real answer to a reset question, check that you do not use the same question and answer on other services (how to check if your password was leaked / choosing a password manager). Turn on two-step verification where available.
What it means that password hashes leaked
A hash is a password converted one way into a special string. It is not the same as encryption, where a key turns it back. In general, though, short or common passwords can sometimes be guessed by trying many candidates and comparing the results. Long passwords that you never reuse are safer (what is password hashing?). The company has not said which method it used.
1. Email / text / call claiming to be either company or a business partner
Salon name, your name and phone number are correct → do not decide here
↓
2. Do not use its links or numbers: use an official contact or one you already know
Beauty Garage 0120-974-554 / Eyelash Garage 03-5774-0811
↓
3a. A request you cannot confirm
Transfer change, extra payment, password or code → do not respond
3b. The contact gives the same guidance
Follow the official site's or contact's instructions
What happened (according to the companies)
The following is based on what Beauty Garage Co., Ltd. and Eyelash Garage Co., Ltd. published on their official websites on October 15, 2026, and on both companies' second notices of October 20. In its first notice, Beauty Garage says that while it was investigating the credit card information leak concern it announced on February 6, 2026, and taking measures toward resuming credit card payments, it caused what the company calls a new information leak. For the February matter, the company said in its sixth report on August 19 that it had not yet reached a clear identification of the facts, so that investigation is ongoing. The notices do not describe how the February matter relates to this one.
Oct 10 to 12, 2026
Unauthorized access to the e-commerce site servers; some customer information leaked (per the companies)Oct 13 (Tue)
Incident detected. The route was identified and blocked the same dayOct 15 (Thu)
Beauty Garage and Eyelash Garage announce it on their official sites (first notice). Affected customers notified individually by emailOct 20 (Tue)
Both companies publish a second notice: the e-commerce sites are operating normally, the matter has been reported to the Personal Information Protection Commission, and it is working with a security firm
- Main items confirmed as leaked
- Company name, salon name, customer name, business type, salon URL, phone number, email address, password hash values, and hash values of the password-reset question and answer
- Items not confirmed as leaked so far
- Address and shipping information, purchase history, payment information including credit cards (per the company)
- What the counts mean
- Customer records held in the Beauty Garage and Eyelash Garage e-commerce systems as of 23:55 on October 10 (Beauty Garage's notice: 775,725, with no per-brand breakdown; Eyelash Garage's notice: 49,191)
- Publication or misuse
- No publication or misuse of the information has been confirmed (per the company, at the time of the notice)
- The company on passwords
- Converted into a special string and cannot be read as they are
- Contact
- Beauty Garage 0120-974-554 (10:00 to 18:00 Japan time, closed Sundays and public holidays) / Eyelash Garage 03-5774-0811 (10:00 to 18:00 Japan time, closed Sundays and public holidays)
The second notice says that by the time of the first notice the route had been blocked and monitoring strengthened, that the e-commerce sites are operating normally, and that the matter has been reported to the Personal Information Protection Commission, whose instructions the company will follow. The second notice page does not list counts or leaked items.
What is known and what is not
Status as of October 29, 2026. We will update this table as the companies publish more.
| Item | What the notice says | Status |
|---|---|---|
| Unauthorized access occurred | Oct 10 to 12, to the e-commerce site servers | Confirmed (company) |
| Company name, salon name, customer name, business type, salon URL | Leak confirmed | Leak confirmed (company; main items) |
| Phone number, email address | Leak confirmed | Leak confirmed (company) |
| Password hashes, hashes of reset question and answer | Leak confirmed; the company says they cannot be read as they are | Leak confirmed (company) |
| Address and shipping information | Not confirmed as leaked so far | Not confirmed (company) |
| Purchase history | Not confirmed as leaked so far | Not confirmed (company) |
| Payment information including credit cards | Not confirmed as leaked so far | Not confirmed (company) |
| Number of records | 775,725 (held in both e-commerce systems); Eyelash Garage's notice says 49,191 | Confirmed (company); breakdown and overlap not stated |
| Publication or misuse | Not confirmed | Not confirmed (company, at the time of the notice) |
| Detection and blocking | Detected Oct 13; route identified and blocked the same day | Confirmed (company) |
| E-commerce site operation | Operating normally (Oct 20) | Confirmed (company) |
| Report to the Personal Information Protection Commission | Reported (second notice) | Confirmed (company) |
| Cause and method of intrusion | Not stated | Not stated |
| Hashing method for the passwords | Not stated | Not stated |
| Compensation | Not stated | Not stated |
Note: the counts are records, not people
775,725 is the number of customer records held in the two e-commerce systems, not a number of people. If the same business registered on both, the number of people may be smaller, but the overlap is not stated. The notices also do not say whether Eyelash Garage's 49,191 is included in the 775,725, so this site has not added them together.
What the combination of leaked items could be used for
The following is what can generally happen with this combination of items. The companies have not announced that any of it has happened in this incident.
- Salon name + customer name + phone number + email address: fake emails, texts or calls claiming to be Beauty Garage or Eyelash Garage that get your salon name and name right
- Information showing who you do business with: messages posing as a supplier, saying "our bank account has changed" or "you have an unpaid balance", sent to a salon's accounts staff
- Business type + salon URL: solicitations or scams with convincing wording tailored to the type of salon
- Password hashes: if a password is short or common, it can be guessed, and used to log in to other services where the same password was reused
Most of this can be prevented by not using the links or numbers in a message and checking through an official contact or one you already know.
What operators should review
The cause has not been disclosed, so this section covers only what can be said from the published information, plus general advice. What follows is general; it does not mean this company did any of these things.
- Keep messages about the February matter separate: the company says it confirmed this new leak while investigating the card information concern it announced in February. In general, when several matters run at once, users can mix up the messages. Making clear on the official site which matter each message is about helps.
- Hashing does not prevent the harm from reuse: if hash values leak, strong passwords are protected, but short passwords and reused passwords need other safeguards. Offering multi-factor authentication and reviewing reset questions and answers are options.
- Check that you do not hold items you do not need: the items here include reset questions and answers. These tend to be personal to the individual, so it is worth reviewing whether they need to be kept.
Sources (public records)
The facts in this article are based on the public information below. We have not guessed at the cause, the number of people or compensation, which have not been announced.
- Beauty Garage Co., Ltd., "Notice and apology regarding leak of customer information due to unauthorized access" (Japanese, October 15, 2026, first notice) — beautygarage.jp
- Beauty Garage Co., Ltd., second notice (Japanese, October 20, 2026) — beautygarage.jp
- Eyelash Garage Co., Ltd., second notice (Japanese, October 20, 2026) — eyelashgarage.jp
- Beauty Garage Co., Ltd., sixth report on the credit card information leak concern announced in February (Japanese, August 19, 2026) — beautygarage.jp
- Eyelash Garage Co., Ltd., "Notice and apology regarding leak of customer information due to unauthorized access" (Japanese, October 15, 2026) — eyelashgarage.jp
Update history
2026-10-29: First version, based on both companies' October 15 notices and both companies' October 20 second notices (checked October 29; nothing newer). We will update when the cause, compensation or a breakdown of the counts is announced.
Read next
- A Japanese case of the same type (customer names, emails and phone numbers): MrMax unauthorized access
- A Japanese retail case from the same period: Joshin (formerly Joshin Denki) unauthorized access
- Follow-on scams: What is phishing?
- Passwords: Choosing a password manager / How to check if your password was leaked / What is password hashing?
- Other 2026 incidents: Data breaches and cyberattacks in 2026 (Japan and worldwide)