Security Guides

#data breach #unauthorized access #member data #phishing #Japan

istyle @cosme Breach (Data of About 3 Million Members Leaked): What Members Should Do About Leaked Names, Addresses, Phone Numbers and Skin Type

istyle says @cosme data on about 3 million members leaked: names, addresses, phones, skin type. Passwords, cards not included as of now. What to do.

Published 2026-11-04 Updated 2026-11-04 Last verified 2026-11-04 12 min read

On this page

For: current and former @cosme members. This article is based on istyle's official notice and does not cover attack techniques.

Bottom line

even if a message gets your name, address, phone number and skin type right, do not open its links; verify through the official app or a site you open yourself

According to istyle, part of the member information registered under the @cosme common ID leaked, affecting about 3 million people. The company says that, as of now, passwords and credit card information were not included. Because contact details and personal attributes leaked together, the most likely risk is a convincing fake message.

Do not open emails from any domain other than cosme.net. For texts and calls, however genuine they sound, do not follow links or enter anything
Individual notices arrive in order through November 6. Whether or not one reaches you, verify through a site you open yourself
The company says passwords are not included as of now, but change one you reuse on other services, to be safe
The company says its notification emails never ask you to enter a password or card number

Developing: this article will be updated as the organisation publishes more

Who is affected: current and former @cosme members.
Confirmed so farSee the table ↓: User ID, nickname
Name (kanji and kana), postal code, address, phone number, email address
Gender, date of birth, skin type, hair type
2 more
People who have since left
Report to the Personal Information Protection Commission
Not yet confirmed: When the unauthorized access took place, and the cause
Completion of individual notices (planned for November 6)
Preventive measures based on the investigation
What to do nowSee the steps ↓: Do not open links in messages that do not come from cosme.net
A correct name, address, phone number or skin type does not make a message genuine
Treat phone calls and texts the same way
2 more
Passwords are not included as of now, but change a reused one
Former members are affected too; wait for the notice even if you do not recall using it
Where to verify (source)All sources ↓: istyle Inc., apology and notice on personal information leakage due to unauthorized access (November 2, 2026)
Last checked: As of November 4, 2026

Follow-up plans and what we checked

The company says that if there is anything new to report it will announce it promptly on its own site. On November 4 we checked the November 2 notice and the company's news list. No follow-up (second report) had been posted.

What current and former members should do today

The items named in the notice are name, address, phone number, email address, date of birth, gender, skin type and hair type. These are the steps that follow from them.

Contact: name (kanji, kana), postal code, address, phone number, email address

Makes fake messages that look addressed to you easy to write

Attributes: gender, date of birth, skin type, hair type, nickname, user ID

The user ID is not used for login

Not included (at this point): login password, credit card information

The company's confirmation as of now; the investigation continues

Which items leaked and which did not (per istyle's notice)

Do not open links in messages that do not come from cosme.net

The company says it sends its notification emails from the cosme.net domain. Even if a subject or body mentions @cosme or istyle, treat a message from a different sender domain as something else. A display name can be set by anyone, so the thing to check is the domain, not the name. A matching domain alone does not prove a message is safe: do not use its links, and open the official site yourself.

The company also asks you to adjust spam settings so that email from cosme.net can be received. That is only so you do not miss a genuine notice. It does not mean links in the email are safe to open.

A correct name, address, phone number or skin type does not make a message genuine

In general, once a name, address, phone number and email address are combined, a fake message that looks written for you becomes easy to make. The confirmed leaked items include skin type and hair type as well. Wording that imitates a member notice, such as a prize matched to your skin type or a request to update your registration, is conceivable (this is this site's assumed example, not a report of messages that arrived). The company says no misuse or secondary damage has been confirmed as far as it knows.

How to tell them apart is in What is phishing?. Treat any message that asks you to enter a password or card number as fake. The company also says its notification emails never ask for them.

Treat phone calls and texts the same way

Because phone numbers were among the leaked items, the company also warns that spoofed texts and calls may arrive. Do not give personal information or verification codes on a call that says it is from @cosme. Hang up and contact the support channel listed on the official site yourself.

Passwords are not included as of now, but change a reused one

The company says that, as of now, login passwords were not included. The notice does not ask members to change passwords. This site suggests changing the password if you use the same one for @cosme and other services, just to be safe. Your email address is among the leaked items, and a reused password can become the way into other services (to check, see How to check whether your password has leaked; to harden accounts, Getting started with multi-factor authentication).

Former members are affected too; wait for the notice even if you do not recall using it

According to the notice, people who have since left @cosme are affected if they were members at the time of the access. The company says it will contact them using information it keeps for a set period after withdrawal. Individual notices are planned to finish on Friday, November 6, so some people have not received one yet. Questions go to the unauthorized-access support desk the company announced (weekdays 10:00 to 18:00 JST, closed on weekends and public holidays). Check the company's notice page for the email address.

What happened (per istyle's notice)

This section is based on the apology and notice on personal information leakage that istyle published on November 2, 2026 (checked on November 4).

October 28, 2026
Confirmed that unauthorized access to @cosme by a third party had leaked part of the member information registered under the @cosme common ID.
November 2, 2026
The company announced it. It has already reported to the Personal Information Protection Commission.
November 6, 2026 (planned)
Individual notices to affected people are planned to be complete.
As of November 4
No follow-up has been posted.

About 3 million

People affected (including people who have since left)

11 items

Leaked items (user ID, nickname, name, postal code, address, phone number, email address, gender, date of birth, skin type, hair type)

November 6

Planned completion of individual notices

What the company has disclosed (per istyle's notice)

Service affected: @cosme. Part of the member information registered under the @cosme common ID
Said not to be included: It says that, as of now, login passwords and credit card information are not included
Response: Working to prevent further damage; investigating the cause and scope with a third-party security firm. Already reported to the Personal Information Protection Commission
Damage so far: As far as the company knows, no misuse of personal information or secondary damage resulting from this incident has been confirmed
Next: It will consider and carry out preventive measures based on the third-party investigation. It will announce new matters on its own site when they are identified

What is known and what is not

This is the state as of November 4, 2026. When a follow-up is published, we will rewrite the status column.

Item	What the notice says	Status
User ID, nickname	The user ID is a number assigned automatically at registration and is not used for login	Leak confirmed (company)
Name (kanji and kana), postal code, address, phone number, email address	Listed as items	Leak confirmed (company)
Gender, date of birth, skin type, hair type	Listed as items	Leak confirmed (company)
Number of people affected	About 3 million	Figure stated (company)
People who have since left	Anyone who was a member at the time of the access is affected; the company contacts them using information it keeps for a set period after withdrawal	Affected (company)
Login passwords, credit card information	Said not to be included as of now	Not included (company, at this point)
Report to the Personal Information Protection Commission	Already reported	Confirmed (company announcement)
Misuse, secondary damage	None confirmed as far as the company knows	Not confirmed (company)
When and how the access took place	Not stated	Not stated
Cause	Under investigation with a third-party security firm	Under investigation

A separate announcement: the November 2 notice does not link the two

On October 23 the company separately announced that an external mail delivery system it uses for some emails, Cuenote FC, had been accessed without authorization, and that there were signs of suspicious external access in its own environment of that service. That notice said credit card information is not held or sent in that system and there is no risk of leakage. The November 2 notice mentions neither that incident nor the operator of that system. Whether the two are related has not been disclosed, and this site makes no judgement. The mail delivery side of the story is in our Cuenote FC article.

How to read it: passwords are not included only as of now

The company says passwords and card information are not included as far as it has confirmed so far. The cause and scope are still under investigation, and the explanation could change with the results. Until a follow-up appears, watch a little more closely than usual for unfamiliar charges or login alerts.

What the combination of leaked items can lead to

In general, these combinations can lead to the following kinds of misuse. This does not mean any of it has happened here.

Name + address + phone number + email address: fake emails, texts and calls that look addressed to you, imitating courier firms, shopping sites or card issuers. Because a phone number is included, texts and voice calls are easier to use
Date of birth + gender: can be used in identity-check questions, or to write tailored wording such as products suited to your age group
Skin type + hair type + nickname: lets someone write wording that looks like a member notice. Imitations of prize draws, samples or member benefits are conceivable
User ID + email address: shows you used the company's service, and could be used in messages pretending to be about an inquiry (the company explains that the user ID is not used for login)

For the same type of incident (members' names, addresses and contact details leaked), see our FANCL and Attenir article and our Beauty Garage article.

For operators: what the disclosed facts let you check

The cause and method have not been disclosed, and this section does not evaluate the company's response. It lists only points from the disclosed facts that someone running a membership service can check on their own site.

Check which items you keep after withdrawal, and for how long

According to the notice, people who have left are affected too, and the company says it contacts them using information it keeps for a set period after withdrawal. As this site's advice, list which items your service keeps for how many months after withdrawal, and review whether any that are not needed for the purpose can be deleted by a set deadline.

Assume large-scale notification takes time, and fix the sender in advance

The company says notification takes time because so many people are affected, and it announced the sender domain of its emails together with a request to check spam settings. If you are the one sending notices, publish the sender domain and design the message so people never have to confirm through a link in the email; it makes a fake notice harder to blend in. Sender authentication is covered in our SPF, DKIM and DMARC article.

Sources (public record)

The facts in this article are based on the public information below. We do not speculate about intrusion routes or techniques that have not been disclosed.

istyle Inc., apology and notice on personal information leakage due to unauthorized access (November 2, 2026) — istyle.co.jp
The company, notice on unauthorized access to the mail delivery system Cuenote FC (October 23, 2026; a separate announcement) — istyle.co.jp
The company, news list (checked for follow-ups on November 4, 2026) — istyle.co.jp

Update log

2026-11-04: First version, based on the company's November 2, 2026 notice. No follow-up (second report) had been posted as of November 4. The time and cause of the access, and any relationship to the separate October 23 announcement, have not been disclosed; we will update when they are.

Latest breaking reports

All breaking reports →

FAQ

QWhat leaked from @cosme?

According to istyle's November 2, 2026 notice, it confirmed that part of the member information registered under the @cosme common ID leaked. The items are the user ID, nickname, name (kanji and kana), postal code, address, phone number, email address, gender, date of birth, skin type and hair type. The company explains that the user ID is a number assigned automatically at registration and is not used for login. About 3 million people are affected.

QAm I affected? What if I already left @cosme?

The company says it will contact affected people individually using the contact details it holds, and plans to finish on Friday, November 6. The notification emails come from the cosme.net domain. Even if you have already left @cosme, you are affected if you were a member at the time of the access; the company says it will use information it keeps for a set period after withdrawal. Because the company expects notification to take some time, not having received an email yet does not mean you are out of scope.

QWere passwords or credit card details leaked?

The company says that, as of now, login passwords and credit card information were not included. Because of the words as of now, the picture could change as the investigation proceeds. The notice does not ask members to change their passwords. This site suggests changing the password if you use the same one for @cosme and other services, just to be safe.

QWhat caused it?

It has not been disclosed. The company says it is investigating the cause and scope with a third-party security firm. The November 2 notice does not say when the access took place or how. It says it will consider and carry out preventive measures based on the third-party investigation results.

QWhat should I do if someone contacts me claiming to be istyle?

The company warns that spoofed emails, text messages or calls related to this incident may arrive, and asks people to be careful with messages they do not recognise, suspicious URLs, and any request to enter a password or personal information. It says its notification emails never ask you to enter a password or credit card details. Check through the official app or a site you open yourself, not through links in the message.

QIs this related to the October 23 notice about the mail delivery system?

The November 2 notice does not mention the October 23 notice. On October 23 the company separately announced that an external mail delivery system it uses for some emails, Cuenote FC, had been accessed without authorization and that there were signs of suspicious external access in its own environment of that service. Whether the two are related has not been disclosed. This site makes no judgement either way.