For: people who used Edion's online store, especially those who entered card details on a PC after 19:00 on November 4, people who hold Edion Gift Cards, and people who received an email about the login ID and password. This article is an explanation based on Edion's official notices (first and second reports); it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who used Edion's online store, especially those who entered card details on a PC after 19:00 on November 4, people who hold Edion Gift Cards, and people who received an email about the login ID and password.
- Confirmed so farSee the table ↓
- Unauthorized access
- Malicious program in payment-related processing
- Online store status
Listed as possibly affected
- Name, email address, phone number, date of birth, gender, address, customer number
- Order number, order amount, postal code, address code
- Credit card expiry date
5 more
- Card number, cardholder name, security code (order-time error logs)
- Card number, expiry date, cardholder name, security code (new entries on PCs)
- Edion Gift Card number
- Edion Gift Card number, PIN, usage history
- Login ID and password
- Not yet confirmed
- Route and method of intrusion
- Scope of impact (final counts and items)
- Count of information in the logs not linked to names
3 more
- How Edion Gift Cards will be handled
- When the online store will restart
- Whether the data has been misused
- What to do nowSee the steps ↓
- If you entered card details on a PC after 19:00 on November 4, check your statement and contact your card company
- Do not give out the Edion Gift Card number or PIN when asked
- If you get a password change email, change it through the official site and fix any reuse
2 more
- Do not respond to suspicious contact in Edion's name
- If you are worried, contact the official window
- Where to verify (source)All sources ↓
- Edion, "Apology and notice regarding the possible leak of personal information due to unauthorized access to our online store" (November 6, 2026, in Japanese)
- Last checked
- As of November 12, 2026
Follow-up plans and what we checked
In the second report the company says it is preparing additional reports to the Personal Information Protection Commission and the local police, and will report new facts such as the scope of impact as they are confirmed. When we checked the company's news release list on November 12, 2026, we found no follow-up after the second report of November 9 (corrected on November 10 for the service stop time).
What users should do today
If you entered card details on a PC after 19:00 on November 4, check your statement and contact your card company
According to the second report, the malicious program had been running since just after 19:00 on November 4. If you newly entered card details at the payment input screen on a PC (up to 556 entries), the company cannot rule out that the card number, expiry date, cardholder name and security code leaked directly to a third party. Card information recorded in order-time error logs (up to 5 cases) has the same items. The company confirmed that operations and input from smartphones were not affected by this program.
The company asks affected people to check their card statement for charges they do not recognize and, if there are any, to contact the window printed on the back of the card. Because the security code may be included, this site recommends that you ask your card company about changing the number (reissue) even if no unauthorized charge has appeared yet. Until the number is changed, this combination stays usable (see the APORITO online store card breach for the reasoning, and the PhotoGoods article for a similar case).
After the number changes, update services that bill the old number automatically, such as utilities and subscriptions. The company says it has asked the credit card companies to strengthen monitoring for unauthorized use.
Do not give out the Edion Gift Card number or PIN when asked
According to the second report, the number, PIN and usage history of 5,360 Edion Gift Cards may have leaked. The only place where entering the number and PIN is enough is the company's online store; in physical stores the original card must be shown. While the online store is stopped, the company says a third party cannot use the leaked information alone.
How cards will be handled once the online store restarts is under review, and the company says it will inform affected customers when decided. Until then, treat any email, text or call that asks for the number or PIN, for example to "check the balance" or "exchange the card", as fake. Keep the physical card with you.
If you get a password change email, change it through the official site and fix any reuse
The company says it will send individual emails, in turn, asking the up to 1,141 customers whose login ID and password are included to change their password. It says that because two-step authentication is required for new logins on its online store, this is not a situation in which immediate misuse is occurring.
Fake emails imitating this one may also circulate (this site's view). Change your password on a screen you opened yourself from a bookmark or the official app, not through a link in the email. If you use the same password as Edion on other services, change those too. For checking, see How to check if your password has leaked; to reduce reuse, a password manager and multi-factor authentication help.
Do not respond to suspicious contact in Edion's name
The information that may have leaked includes name, email address, phone number, address, date of birth, order number and order amount. That makes it possible to build realistic contact that seems to know your order, and the company asks people to be careful of suspicious emails, texts and calls pretending to be from Edion.
Treat contact that sends you to a link to enter card details or a password, for example about an "order cancellation", "refund" or "card re-registration", as fake. Check on an official site or app you opened yourself. For how to spot fakes, see What is phishing?.
If you are worried, contact the official window
The contact listed in the notices is the Customer Consultation Center (phone 0120-77-0095, 9:00 to 18:00 Japan time). Use the contact on the official notice, not a number in an email or text. If you see a charge you do not recognize, you can also consult the window on the back of your card, the police consultation line (#9110) or the Consumer Hotline (188), all in Japan.
What happened (from Edion's notices)
Edion posted a first report on November 6, 2026 and a second report on November 9 as news releases on its website. On November 10 it corrected the date and time of the emergency service stop in the second report (wrong: Sunday, November 8; correct: Saturday, November 7 at 22:00). Everything below comes from the company's notices.
November 4, just after 19:00
The malicious program, found later, began running in payment-related processing (second report).November 5, around 18:30
The company confirmed unauthorized access from outside to the server hosting the online store, and that some personal information may have leaked (first report).November 6
First report published. By the time of the first report, the company had already reported to the Personal Information Protection Commission. At that point it said the online store could still be used as usual.November 7, 22:00
The online store, the official Edion app and the Edion Smart app were stopped on an emergency basis (time corrected on November 10).November 8, 21:10
The official app and the Smart app were restarted with functions limited to the digital membership card, coupon display and similar.November 9
Second report published. It corrects the first report and reports newly found facts. The online store is stopped, with no restart date.
- Cause
- First report: unauthorized access from outside, exploiting a system vulnerability, to part of the server area holding log files. Second report: a malicious program inserted into payment-related processing by an outside third party (route and method not disclosed)
- Log information (first report)
- Name (kanji and kana), email address, phone number, date of birth, gender, address, customer number (up to 4,131 customers). Recorded items differ somewhat by customer
- Order information (first report)
- Recorded: name, customer number, order number, order amount. The maximum when checked against several logs also adds email address, phone number, postal code, address code (down to prefecture and city), credit card expiry date and Edion Gift Card number (up to 9,554 customers)
- Added in the second report
- Card information in order-time error logs (number, expiry date, cardholder name, security code; up to 5 cases) / Edion Gift Card, 5,360 cards (number, PIN, usage history) / login ID and password (up to 1,141 customers) / card details newly entered on PCs (same four items; up to 556 entries)
- Not included
- First report: unauthorized access to, and leak from, the customer database itself was not confirmed. Second report: operations and payment input from smartphones were not affected by the malicious program
- Publisher and contact
- Edion Corporation / Customer Consultation Center 0120-77-0095 (9:00 to 18:00 Japan time)
What is known and what is not
This table is based on the company's first and second reports, as of November 12, 2026. The company gives many of the counts as maximums (the Edion Gift Card figure is 5,360 cards). When follow-up notices appear, we will update the status column.
| Item | What the notice says | Status |
|---|---|---|
| Unauthorized access | Unauthorized access from outside to the server hosting the online store. Confirmed around 18:30 on Nov 5 | Confirmed (company) |
| Malicious program in payment-related processing | Inserted by a third party (tampering). Running since just after 19:00 on Nov 4 | Confirmed (company) |
| Name, email address, phone number, date of birth, gender, address, customer number | Information recorded in log files. Up to 4,131 customers (recorded items differ by customer) | Possible (company) |
| Order number, order amount, postal code, address code | Maximum when checked against several logs. Up to 9,554 customers. Not combinable for every customer | Possible (company) |
| Credit card expiry date | Among the items when checked against order information. Also recorded in a form not linked to names | Possible (company) |
| Card number, cardholder name, security code (order-time error logs) | Up to 5 cases in which input was exceptionally recorded temporarily in the system log when an error occurred at the order screen. Corrects the first report's statement that card numbers were not included | Possible (company) |
| Card number, expiry date, cardholder name, security code (new entries on PCs) | From 19:00 on Nov 4. Company cannot rule out direct leak to a third party. Up to 556 entries | Possible (company) |
| Operations and input from smartphones | Confirmed not affected by the malicious program | Not included (company) |
| Edion Gift Card number | Among the items when checked against order information | Possible (company) |
| Edion Gift Card number, PIN, usage history | 5,360 cards. Added in the second report. Not usable on the leaked information alone while the online store is stopped | Possible (company) |
| Login ID and password | Up to 1,141 customers. Corrects the first report's statement that login passwords were not included. Two-step authentication is required for new logins | Possible (company) |
| Count of emails, phone numbers etc. not linked to names | First report: "currently being examined". Not mentioned in the second report | Under investigation |
| Unauthorized access to the customer database itself | First report: not confirmed. Not mentioned in the second report | Not confirmed (company, first report) |
| Route and method of intrusion | The first report says a "system vulnerability" was exploited; no detail | Not stated |
| Misuse | No confirmed misuse found in the notices. The company warns about suspicious contact | Not stated |
| Individual notices | The 1,141 password customers are told by email. Not stated for other items | Partly stated (company) |
| Online store status | Stopped since 22:00 on Nov 7. No restart date | Confirmed (company) |
What changed between the first and second reports
The company's explanation changed as follows between the first report (November 6) and the second report (November 9).
First report (November 6)
- The information that may have leaked is part of the data in log files
- Credit card numbers and login passwords are not included
- The online store can still be used as usual (the company says an outside security specialist assessed that it was safe to continue operating)
Second report (November 9)
- New traces of unauthorized access were found, and a malicious program was found inserted in payment-related processing
- Corrected: some card information, gift card PINs and login passwords were included
- Online store and other services stopped on an emergency basis at 22:00 on November 7. No restart date for the online store
Items and counts may change again in follow-up notices. The company still describes the scope as under investigation, so check the latest notice for the numbers in this article.
What card, gift card and login details can be used for
The table below describes what can generally happen with combinations like these. It does not mean these things happened in this incident.
| Information that may have leaked | What can generally happen | What users should do |
|---|---|---|
| Card number + expiry date + cardholder name + security code | Unauthorized use on online shops, until the number is changed | Check your statement and ask about changing the number |
| Gift card number + PIN | Misuse where the number and PIN alone suffice. Fake "balance check" contact | Do not give out the number and PIN. Wait for the company's notice |
| Login ID + password | Login attempts on other sites with the same combination | Fix reuse and use two-step authentication |
| Name + phone + email + address code + order number and amount | Realistic fake contact that seems to know your order | Do not open links; check on the official site or app |
What operators should review: not holding card data does not stop a tampered input screen
The cause has not been disclosed in detail, so this covers only what the published facts imply.
- "No card data on our server" and "a safe input screen" are different things: the company writes that its card payment supports tokenization and leaves no information on the server, but that in this incident a malicious program was inserted into the payment information input process for PCs. In general, you need controls that inventory the scripts running on payment pages, allow only authorized ones and detect tampering (PCI DSS 4.0 requirements 6.4.3 and 11.6.1 cover this).
- Do not leave typed input in error logs: the company writes that when an error occurred on the order screen, the input was exceptionally recorded temporarily in the system log (up to 5 cases including card numbers and security codes). In general, design logging so card numbers and security codes are never written, and search the logs regularly to confirm none remain.
- In an interim bulletin during an investigation, separate what is confirmed from what is not yet examined: here, items that the first report described as not included were corrected after detailed analysis. In general, estimates of scope can change during an investigation, and separating the two lessens the impact of a correction.
Sources (public record)
The facts in this article are based on the official notices below. We have not speculated about details of the cause that have not been disclosed.
- Edion, "Apology and notice regarding the possible leak of personal information due to unauthorized access to our online store" (November 6, 2026, in Japanese) — edion.co.jp (PDF)
- Edion, "Apology and notice regarding newly found events, the possible leak of personal information and the service stop at our online store (second report)" (November 9, 2026, corrected November 10, in Japanese) — edion.co.jp (PDF)
- Edion news release list — edion.co.jp
Update history
2026-11-12: First version. Based on Edion's first report (November 6) and second report (November 9, with the stop time corrected on November 10). We checked the company's news release list the same day and found no follow-up after the second report.
Read next
- Another electronics retailer incident: Unauthorized access to Yamada Denki's renovation management system
- When card details are stolen at the payment screen: The PhotoGoods card theft / The APORITO online store card breach
- When a password leaks: How to check if your password has leaked / Choosing a password manager
- How to spot fake contact: What is phishing?
- Other incidents in 2026: Data breaches and cyberattacks (Japan and overseas)