For: people who have bought products on the akyrise online store (including people who have since left). This article is an explanation based on the official notice from Euglena Co., Ltd.; it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who have bought products on the akyrise online store (including people who have since left).
- Confirmed so farSee the table ↓
- Unauthorized access
- Leak of member information
- Report to the regulator
1 more
- Individual notices
Listed as possibly affected
- Customer ID, email address
- Login password
- Name, address, phone number
2 more
- Date of birth, gender
- Purchase and delivery information, etc.
- Not yet confirmed
- Which customers are affected
- Final counts (up to about 490,000 and up to about 900,000 are still being verified)
- Cause (how the access happened)
2 more
- When the online store will reopen
- Result of the delivery company's investigation (who and what is covered)
- What to do nowSee the steps ↓
- Check whether you reused your akyrise password
- Do not open links in contacts using akyrise, the company or a delivery company's name
- Do not respond to requests for passwords, card numbers, payments or verification codes
2 more
- If an individual email arrives, check it before acting
- If you are worried or got a suspicious contact, use the dedicated help line
- Where to verify (source)All sources ↓
- Euglena Co., Ltd., "Apology and notice regarding the leak of member information of the cosmetics brand akyrise following unauthorized access by a third party" (November 5, 2026, press release on the Euglena official website; in Japanese)
- Last checked
- As of November 9, 2026
Follow-up plans and what we checked
The company says it is investigating who is affected, the counts, the range of leaked information and the cause, and that it will announce new facts promptly through its website and other channels. When we checked the official Euglena website on November 9, 2026, we found no follow-up notice.
What akyrise buyers should do today
Check whether you reused your akyrise password
The company asks anyone who uses the same or a similar password to the akyrise online store's at other services to change those passwords right away. The login password was stored in hashed form, but it is among the information that may have leaked.
Start with important services such as email, shopping and finance. See How to check whether your password has leaked and Choosing a password manager.
Do not open links in contacts using akyrise, the company or a delivery company's name
The company says the leaked information may be misused to send suspicious emails, text messages, calls and postal mail pretending to be akyrise, the company, delivery companies or other related parties. Do not open URLs or attachments in messages you do not recognise, and do not enter personal information, passwords or card details on suspicious websites.
For how to spot them, see What is phishing?.
Do not respond to requests for passwords, card numbers, payments or verification codes
The company asks you not to respond to any contact, even one using the company's or a related party's name, that asks for a password, credit card number, payment, transfer or the sharing of a verification code. It says it never makes such requests.
If an individual email arrives, check it before acting
The company says it will email affected customers individually, in sequence, and that how to change your password, how existing subscription orders are handled, and other procedures will be explained in that email.
Fake emails riding on this incident may also arrive (this site's view). Before opening a link, check that the content matches the notice on the company's official site and that the sender and wording are not odd. If in doubt, contact the help line listed on the official site.
If you are worried or got a suspicious contact, use the dedicated help line
The contact point in the notice is the dedicated akyrise help line (0120-405-142, 10:00 to 17:00 Japan time, Monday to Saturday, closed on Sundays and public holidays). Lines may be busy. You are asked to use it when you confirm actual harm or a suspicious contact.
If you paid money or entered information, you can also consult your card issuer, the police advice line (#9110) or the Consumer Hotline (188).
What happened (from the Euglena notice)
On November 5, 2026, Euglena announced three incidents in one press release on its official website. Everything below is from the company's notice.
- Incident 1: unauthorized access to the akyrise online store. This is the focus of this article.
- Incident 2-1: unauthorized access to an email delivery service used by the company's outside contractor.
- Incident 2-2: unauthorized access to a delivery inquiry service of a delivery company, used by the company's outside contractor.
The company describes Incident 1 and Incidents 2-1 and 2-2 as independent events. Counts and items differ by incident, so do not add them together.
October 1
The outside contractor reported that unauthorized access to the delivery company's parcel inquiry service may have leaked some recipients' personal information (Incident 2-2).November 2
The outside contractor reported that unauthorized access to the email delivery service had leaked some akyrise customer information linked to it (Incident 2-1).November 4
The company confirmed unauthorized access by a third party to the akyrise online store and closed the site immediately. Its later investigation found that member information registered on the site had leaked (the date of this finding is not stated; Incident 1).November 5
The company filed a preliminary report with the Personal Information Protection Commission and announced the three incidents. It said it would email affected customers individually, in sequence.
- Date confirmed
- November 4, 2026 (unauthorized access confirmed; site closed the same day)
- Customers affected
- Customers who have bought products on the akyrise online store in the past, including people who have left
- Information that may have leaked (1)
- Login account information: customer ID, email address, login password (stored in hashed form). Up to about 490,000 (still being verified)
- Information that may have leaked (2)
- Registration and purchase information: name, address, phone number, date of birth, gender, email address, purchase and delivery information, etc. Up to about 900,000 (still being verified)
- Not included
- Credit card numbers (not held on the servers the company uses, and not included in either group)
- Report to the regulator
- A preliminary report was filed with the Personal Information Protection Commission, dated November 5, 2026
- Site status
- Temporarily closed for maintenance. To reopen after system changes and safety checks. Accepted orders and ongoing subscription orders are being shipped in sequence after the necessary checks
- Notice to customers
- Individual emails to affected customers, in sequence
The two counts cannot be added together
In the company's table, login account information is up to about 490,000 and registration and purchase information is up to about 900,000. The company does not say how the two overlap or how they relate to the number of people. They do not add up to a single total. Both are "up to" figures and still being verified.
Incident 2: email delivery service and delivery company (separate events)
The same notice reports unauthorized access at external services used by the company's outside contractor. The company describes these as events independent of Incident 1.
| Incident 2-1: email delivery service | Incident 2-2: delivery inquiry service | |
|---|---|---|
| Who | akyrise customers who received newsletters and similar messages through the email delivery service provider's service | Customers who ordered on the akyrise online store (including subscriptions) and whose parcels were shipped by the delivery company between June 21 and September 30, 2026 |
| Count | 177,063 | About 5,000 records (about 3,000 people) |
| Information | Email address only | Name, address, phone number (information that may have leaked) |
| Status | Who is affected and the count are confirmed, based on the provider's report and the company's own check | Who is affected and the count are under investigation by the delivery company |
| Contact | The Incident 1 help line (0120-405-142) | The delivery company's dedicated call center (0120-28-3449, 9:00 to 17:00 Japan time, including weekends and holidays) |
Customers affected by Incidents 2-1 and 2-2 are also to be contacted individually by email, in sequence. Unauthorized access at the email delivery service provider, including other companies' data, is covered in a separate article (Unauthorized access to an email delivery service).
What is known and what is not
This table is based on the company's notice of November 5, as of November 9, 2026. When follow-up notices appear, we will update the status column.
| Item | What the notice says | Status |
|---|---|---|
| Unauthorized access | Unauthorized access to the online store by a third party was confirmed on November 4, 2026, and the site was closed | Confirmed (company) |
| Leak of member information | The investigation found that member information registered on the site leaked. The notice also says who is affected, which items, the counts and whether information leaked are still under investigation | Leak confirmed (company); scope under investigation |
| Customer ID, email address | Listed under "information that may have leaked" | Possible (company) |
| Login password | Stored in hashed form. Listed under "information that may have leaked" | Possible (company) |
| Name, address, phone number | Same | Possible (company) |
| Date of birth, gender | Same | Possible (company) |
| Purchase and delivery information, etc. | The notice says "etc." and does not give the exact range | Possible (company); range under investigation |
| Credit card numbers | Not held on the servers the company uses; not included | Not included (company) |
| Counts | (1) up to about 490,000; (2) up to about 900,000 (both still being verified) | Under investigation |
| Cause (how the access happened) | Not stated | Under investigation |
| Secondary harm | No secondary harm from this incident has been confirmed (as of Nov 5) | Not confirmed (company) |
| Report to the regulator | A preliminary report was filed, dated Nov 5 | Confirmed (company) |
| Individual notices | Affected customers will be emailed in sequence | Confirmed (company's plan) |
| Store reopening | To reopen after changes and safety checks; no date given | Under investigation |
| ID documents, bank details | Not stated | Not stated |
What a name, address, phone number and date of birth can be used for
The points below are what can happen in general with this combination of items; they do not mean it has happened in this incident.
Name + address + purchase history
↓→
Convincing order confirmations or missed-delivery notices
→ Do not open links; check via the official site or help line
Name + phone number + date of birth
↓→
Calls using a company's name to draw out more information
→ Hang up and call back the official line
Email address + hashed password
↓→
Login attempts at other services with the same password
→ Change the reused password elsewhere first
- Name + address + purchase history: makes it easier to craft convincing "order confirmation" or "missed delivery" messages that mention what you really bought and when.
- Name + phone number + date of birth: makes it easier to run a call using a company's name, stating your birth date to win trust and then drawing out the rest of your information. Knowing your date of birth proves nothing.
- Email address + hashed password: if the password is short or common, the original may be guessed. If you use the same password at other services, it can be tried there.
What operators should review: how you hold personal data, including at contractors
The cause has not been disclosed, so this covers only what the disclosed course of events shows.
- Your own site and your contractors can be hit together: here, unauthorized access at the company's own store, an email delivery contractor and a delivery contractor were announced in one notice. An e-commerce operator who lists the items it hands to email delivery and shipping (names, addresses, phone numbers, email addresses) and where they are stored can narrow down affected customers faster when a report arrives.
- Handling data after customers leave: the affected group includes customers who have left. If you keep data after a customer leaves, setting which items you keep and for how long, and deleting them when no longer needed, limits what leaks.
- Hashing is not a cure-all: even with hashed passwords, the company asks customers to change reused passwords elsewhere, because weak passwords can still be guessed. For the thinking behind storage, see Password hashing and salting.
Sources (public record)
The facts in this article come from the public information below. The tables of counts and items were read from the images in the company's notice page. We have not guessed at details of the cause that have not been disclosed.
- Euglena Co., Ltd., "Apology and notice regarding the leak of member information of the cosmetics brand akyrise following unauthorized access by a third party" (November 5, 2026, press release on the Euglena official website; in Japanese) — euglena.jp
Update history
2026-11-09: First version, based on Euglena Co., Ltd.'s notice of November 5. We checked the official website the same day and found no follow-up.
Read next
- A related incident at an email delivery service: Unauthorized access to an email delivery service
- Passwords: How to check whether your password has leaked / Choosing a password manager
- Spotting fake contacts: What is phishing?
- Other 2026 incidents: Data breaches and cyberattacks of 2026 (Japan and overseas)