FANCL and Attenir online store breach (368,184 and 417,312 members): names, addresses, phone numbers and birth dates exposed, and what members should do

The affected data is part of each company's member data. FANCL's FAQ says affected customers were contacted at their registered email address during Saturday, October 17 (checked October 25).

If you are not sure whether you received a notice, or whether an email is genuine, contact the shared FANCL/Attenir help line on 0120-333-600 (9:00 to 17:00 including weekends and holidays). Use the number from the official notice, not one written in an email.

The companies warn that the leaked data may be misused for spoofed emails, phishing scams and similar fraud. Messages about expiring points, membership tier changes, apologies or compensation would not look unusual to members, which makes fakes harder to spot.

To check anything, use the official site or app that you open yourself (see What is phishing?).

Because addresses and phone numbers also leaked, fake contact may not come only by email. The companies say they will not ask for passwords or credit card details.

If someone asks on the phone, hang up and call back on the number in the official notice. Do not use phone numbers or QR codes printed in letters you receive.

The leaked items include a sub email address and its password. According to the companies, this is a hashed secondary password that some members set, and it cannot be read as is. The main password was not included.

Even when hashed, short or common passwords can sometimes be worked out with enough time (see What is password hashing?). If you remember setting a secondary password and use the same string on other services, change it there. The companies also ask customers to change their passwords regularly.

For security questions, only the question items leaked; the answers were not included. In general, someone who knows which question you chose may try to get the answer out of you by phone or email. Do not answer such requests, and if you use the same question and answer on other services, review them.

The companies say they identified and stopped the feature that caused the leak, and that the incident has not affected their business activities or services. If a site is built so that a problem feature can be cut off without shutting down the whole store, you can limit the spread while investigating. For your own store, decide for each feature that returns member data how it would be stopped and who would do it.

The leaked items included a sub email address and secondary password that only some members set, and security question items. Data for features few people use is still exposed if it is stored with member records. Check regularly whether data for unused features can be deleted, and whether it really needs to sit alongside the main member data.

The companies say the secondary password was stored hashed. The baseline is never to store member passwords in plain text or in a reversible form, and to use a slow, salted hash such as bcrypt or Argon2. See storing passwords with hashing and salt.

The companies opened the shared help line the day after the announcement, and according to FANCL's FAQ emailed affected customers the same day. When genuine notices arrive before fake ones spread, members can tell them apart more easily. Avoid notices that ask people to enter personal data through a link, and tell recipients to check on the official site, so the difference from fakes is clear.