For: people who bought, between April 8 and November 8, 2026, from an online shop that outsources logistics (warehousing and shipping) to the company involved. This article is based on the official notices of the logistics provider and the shops, and does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who bought, between April 8 and November 8, 2026, from an online shop that outsources logistics (warehousing and shipping) to the company involved.
- Confirmed so farSee the table ↓
- Occurrence of unauthorized access
- Blocking the route
- Period of shipping data affected
1 more
- Reports to authorities
Listed as possibly affected
- Recipient name, address, phone number
- Email address
- Item information (names, quantities, etc.)
- Not yet confirmed
- Scope and number of people the logistics provider will publish
- Cause (how the access happened)
- Number of affected customers at each shop (mostly under investigation)
2 more
- When and how affected customers will be contacted
- Whether the data has been misused
- What to do nowSee the steps ↓
- Check the news section of the shop you bought from
- Do not respond to contact pretending to be a delivery notice
- Be suspicious of contact that knows what you bought
3 more
- Check who is calling
- Glance at your card statement, to be safe
- If you entered information or paid, consult immediately
- Where to verify (source)All sources ↓
- Logistics provider, "Apology and notice regarding personal information leak caused by unauthorized access to our systems" (November 11, 2026)
- Last checked
- As of November 15, 2026
Follow-up plans and what we checked
The logistics provider says it is investigating the cause, the route of entry and the scope with an external specialist organization, and will report promptly if new facts emerge. TV Tokyo Communications says it has asked the provider to hurry in identifying the number of people and the affected customers. In the notices we checked on November 15, 2026, the only count published was BONX's "up to 1,144".
What buyers should do today
Check the news section of the shop you bought from
Customers cannot see which online shops outsource shipping to this logistics provider. Open the official site of each shop you bought from between April 8 and November 8, 2026, from a bookmark or a search, and check its news section. The six shops in the list below are ones whose official notices we read and confirmed. Other companies have also announced.
Several companies word customer contact as "identifying the customers" or "will contact individually". Do not wait for contact; check the shop you bought from on its official site first. Even if an email arrives, confirm from the official site, not from the link in the email.
Do not respond to contact pretending to be a delivery notice
The logistics provider asks that recipients be told not to open delivery notices they do not recognize, not to visit suspicious URLs, and not to enter personal or payment information if asked. Brave group also warns of calls, emails and SMS pretending to be couriers.
If you are unsure whether a delivery message is genuine, take the tracking number from the order history on the shop's site and check on the courier's official site yourself. How to spot fakes is in What is phishing?
Be suspicious of contact that knows what you bought
The data that may have leaked includes item names and quantities. Being able to name the item you bought does not make a message genuine (this site's view). For contact about a purchase, such as "payment for item X is unpaid", "procedure to return the item you bought" or "confirming a cancellation", log in to the shop's official site and check whether the order history shows it. If not, do not respond.
Check who is calling
With a phone number, name and address, phone contact can also look genuine. If a call claiming to be from a shop or courier asks you to confirm personal information, make a payment or operate an app, hang up and call back on a number listed on the official site. TV Tokyo Communications also warns of contact pretending to be from programs and the like.
Glance at your card statement, to be safe
The logistics provider says it does not hold credit card numbers and that they are not affected. We found no announcement saying cards must be reissued because of this. Still, because fake contact may try to make you enter card details, check your statement from time to time.
If you entered information or paid, consult immediately
If you entered information on a suspicious page or paid money, contact your card company or bank at once. You can also consult the police (in Japan, the police consultation line #9110) or the Consumer Hotline (188). For suspicious activity on an account, see How to check for unauthorized access.
What happened (from the logistics provider's and the shops' notices)
A company that handles logistics (warehousing and shipping) for e-commerce shops posted a notice on its official site on November 11, 2026 about unauthorized access to its own system. Several online shops have since published the effect on their own customers, starting the same day. The shops' notices name the contractor as Openlogi, Inc., and that company's own notice also covers this incident. What follows is what each notice says.
Nov 8–9
An outside third party gained unauthorized access to the logistics provider's system, and part of its shipping data was taken (company notice).Nov 9
The logistics provider blocked the access route it had identified. No new unauthorized access has been confirmed since. It carried out emergency maintenance (notices of the company, Brave group and BONX).Nov 10
Brave group was contacted by the logistics provider. It says it carried out necessary measures such as resetting credentials.Nov 11
The logistics provider posted its notice. Shops including TV Tokyo Communications, Palette Project OFFICIAL STORE and BONX also announced the same day.Nov 12–13
VAZ and Weathernews (November 12) and Brave group (November 13) announced.
- When
- Between November 8 and 9, 2026, an outside third party gained unauthorized access, and part of the shipping data was taken
- Period covered
- Shipping data requested between April 8 and November 8, 2026
- Information that may have leaked
- Recipient name, address, phone number, email address (if registered), and information on the items shipped (item names, quantities and so on)
- Not included
- Credit card numbers (the company does not hold them)
- Number
- Under investigation (not published)
- Cause
- Unauthorized access by an outside third party (route and method under investigation, not published)
- Response
- Route blocked on November 9. Emergency maintenance carried out. Warehouse receiving and shipping work is largely as usual, apart from some system operations affected by the emergency maintenance. It plans to report to the Personal Information Protection Commission and consult the police
- Misuse
- As of November 11, 2026, no misuse or secondary damage has been confirmed
The shops that have announced (six whose official notices we read)
The table lists only companies whose notices on their own official sites we opened and confirmed. Counts, scope and status are as each company words them and cannot be added together. The same person may have shopped at several of these shops. Other companies have also announced, so this table is not a complete list.
| Shop / service | Announced | Number | Status (each company's notice) |
|---|---|---|---|
| Brave group (11 services: Vspo! Official Online Store, Unirade! OFFICIAL STORE, YUMENOS OFFICIAL STORE, RIOT MUSIC OFFICIAL STORE, RIONECTION OFFICIAL STORE, AMICIS, Xross Stars Official Online Store, HIMEHINA MART, Neo-Porte official Shop, GΔ59 OFFICIAL ONLINE STORE, Brave group US Official Store) | Nov 13 | Not stated | Leak confirmed (Brave group. It says it has become clear that part of the group's customer information was taken, and lists the 11 above as services that may be affected). Reported to the Personal Information Protection Commission |
| TV Tokyo Communications (Enshabe Store, Tokyo PC Club Official Online Store, Otagaisamassu Official Online Shop) | Nov 11 | Not stated. It has asked the logistics provider to hurry in identifying the number of people and the affected customers | Possible (the company; part of the delivery information may have been taken). No harm confirmed |
| Palette Project OFFICIAL STORE (jig.jp) | Nov 11 | Not stated | Possible (the company). Identifying the target data; will contact affected customers individually. Credit card information and login passwords are not held by the contractor and have not leaked (the company) |
| Mel:See from classroom (VAZ) | Nov 12 | Not stated | Leak confirmed (the company; it writes that the leaked information "includes the following items"). No misuse or secondary damage confirmed |
| SORASHOP (Weathernews) | Nov 12 | Under investigation | Possible (the company; part of the shipping data was taken). It stopped using the logistics provider and switched to an alternative delivery setup. Will notify affected customers individually |
| BONX | Nov 11 | Up to 1,144 (an upper limit of those who may be affected, not a confirmed number) | Possible (the company). Covers people who bought or processed an exchange; purchases completed on sites such as Amazon and Rakuten are not affected. Shipping has resumed. Procedures for reporting to the Personal Information Protection Commission are under way |
What is known and what is not
Organized as of November 15, 2026 from the logistics provider's notice (November 11) and the companies' notices. We will update the status column when follow-ups appear.
| Item | What the notices say | Status |
|---|---|---|
| Occurrence of unauthorized access | Occurred between November 8 and 9, and part of the shipping data was taken | Confirmed (logistics provider) |
| Blocking the route | The route it had identified was blocked on November 9. No new unauthorized access has been confirmed since | Confirmed (logistics provider) |
| Period of shipping data affected | Shipping data requested between April 8 and November 8, 2026 | Confirmed (logistics provider) |
| Recipient name, address, phone number | Included in the information that may have leaked | Possible (logistics provider) |
| Email address | Included if registered (BONX says only for customers who asked for shipping notifications) | Possible (logistics provider) |
| Item information (names, quantities, etc.) | Included in the information that may have leaked | Possible (logistics provider) |
| Credit card numbers | The logistics provider does not hold them | Not included (logistics provider) |
| Shop login passwords | Not mentioned in the logistics provider's notice. Palette Project OFFICIAL STORE says the contractor does not hold them and they have not leaked | Not stated |
| Number of people affected | The logistics provider is investigating the scope and number. Most shops' counts have not been published | Under investigation |
| Cause and route of entry | Under investigation with an external specialist organization | Under investigation |
| Misuse / secondary damage | None confirmed as of November 11 (logistics provider). Brave group, TV Tokyo Communications, Palette Project OFFICIAL STORE, VAZ and Weathernews also say none has been confirmed | Not stated |
| Individual contact to affected customers | Palette Project OFFICIAL STORE and Weathernews plan to contact or notify individually. BONX says it will respond once customers are identified | Under investigation |
| Reports to authorities | Brave group has reported to the Personal Information Protection Commission. The logistics provider says it plans to report and consult the police | Confirmed (Brave group) |
What delivery names, addresses, phone numbers and item details can be used for
The table below describes what generally can happen with combinations of these items. It does not mean it happened in this incident.
| Information that may have leaked | What can generally happen | What buyers should do |
|---|---|---|
| Name + phone number | SMS or calls claiming to be a courier or a shop | Do not call back; check on the official site |
| Name + address + item information | Demands or confirmations that pretend to be about "your order", assuming knowledge of your purchase | Log in and check that the order history shows the same item |
| Email address + item information | Emails imitating order confirmations or shipping notices | Do not open links in the email; check from the official site |
| Address | Mail addressed to you, or contact pretending to be a missed-delivery slip | Do not enter information from the URL or QR code on a missed-delivery notice |
What information that may have leaked can be used for
- Genuine-looking emails, SMS and calls claiming to be a courier or a shop
- Payment, return or cancellation contact that names the item you bought
- Impersonation calls that use your phone number and address
What the notices say is outside the scope
- Credit card numbers (the logistics provider does not hold them)
- TV Tokyo Communications: no payment-related information leaked
- Palette Project OFFICIAL STORE: login passwords are not held by the contractor and have not leaked (the company)
What operators should review: how much delivery data you hand to a logistics contractor
The cause has not been published, so this section covers only what the published facts show.
- One contractor's breach can reach many of your services: many online shops that use the same logistics provider published notices around the same time. Shops that outsource shipping can shorten the time to announcement by preparing, in advance, the customer notice and contact point to use when a contractor reports the scope and number of people (this site's view).
- Review which items you hand over and for how long: the data affected here is shipping data from April 8 to November 8, 2026. In general, handing over only the items needed for delivery, giving the email address only for customers who need it (in BONX's notice, only customers who asked for shipping notifications), and not leaving finished shipping data with the contractor for long can reduce what leaks from a single breach.
- Review the credentials used to log in to the contractor's systems: Brave group says that after being contacted by the logistics provider it carried out necessary measures such as resetting credentials. Know where you use the contractor's admin console and integration credentials, so you can reset them quickly when contacted.
Sources (public record)
The facts in this article are based on the official notices below. We have not speculated about causes that have not been published. The shops' notice titles are paraphrased by role.
- Logistics provider, "Apology and notice regarding personal information leak caused by unauthorized access to our systems" (November 11, 2026) — corp.openlogi.com
- TV Tokyo Communications, "[Important] Personal information leak following unauthorized access at an e-commerce contractor" (November 11, 2026) — tv-tokyo.co.jp
- Brave group, "Notice and apology regarding the customer information leak following unauthorized access at a contractor" (November 13, 2026) — bravegroup.co.jp
- Palette Project OFFICIAL STORE, "[Important] Possible leak of personal information following unauthorized access at a contractor" (November 11, 2026) — paletteproject.jp
- VAZ, "[Important] Apology and notice regarding personal information leak following unauthorized access at an outsourcing contractor" (November 12, 2026) — vaz.co.jp
- Weathernews, "Possible leak of customer information following unauthorized access at a delivery contractor" (November 12, 2026) — jp.weathernews.com
- BONX, "First report" (November 11, 2026) — bonx.co
Update history
2026-11-15: First version. Based on the logistics provider's notice of November 11 and the notices of six companies whose official sites we could read (Brave group, TV Tokyo Communications, Palette Project OFFICIAL STORE, VAZ, Weathernews and BONX). We checked the notices the same day and found no follow-up from the logistics provider.
Read next
- A vendor-side incident from the same period: Unauthorized access to an email delivery service (a different vendor-side incident)
- How to spot fake contact: What is phishing? / Smartphone security basics
- Suspicious activity on an account: How to check for unauthorized access
- Other incidents in 2026: Data breaches and cyberattacks (Japan and overseas)