For: people who entered a Fujicco campaign (Fujicco is a Japanese food maker) through the non-member entry form. This article is based on Fujicco's official notice and does not cover attack or scam techniques.
Developing: this article will be updated as the organisation publishes more
As of October 26, 2026Not yet known
- Cause (how the access happened)
- Number of people (only the total number of entries is published)
- When the emails to affected people will be sent
- When entries will reopen
- Filing of the police report
In its October 22 notice, the company says it will announce when entries reopen on its website once that is decided. When we checked the company's news release list on October 26, no follow-up had been published.
What people who entered should do today
Check whether you are affected: how did you enter?
The affected people are those who entered the Caspian Sea Yogurt series "Motto! Toro-mocchi Campaign Part 2" or the "Fujicco Thanksgiving Festival Campaign" (both run from May 2026 onward) through the non-member entry form.
Entries made as a registered Fujicoin member, by postcard or on X are not affected. The company says it will email affected people at their registered address in turn, once ready. If you are unsure, call the Fujicco campaign office on 0120-954-659 (toll-free in Japan, weekdays 10:00 to 17:00 except the New Year holidays, until April 15, 2027).
Do not pay fees, resubmit receipts or re-enter details
The company says neither it nor the campaign office will ask for receipt resubmission, re-entry of personal details, or shipping or handling fees.
Messages such as "You have won; please pay shipping" or "Your entry was incomplete; please send your receipt again" can feel natural to someone who entered, which makes them harder to spot. If you get such a request, do not respond, and check with the campaign office.
Do not open links or attachments in emails or texts
The company says its apology email contains no URLs or attachments. An "apology" or "prize notice" with a link or attachment is not the email the company described. For how to spot fakes, see What is phishing?
Be wary of calls or letters that know about your family
Besides address and phone number, marital status, family composition and occupation are included. The company asks people to watch out not only for suspicious emails but also for text messages, phone calls and post.
A caller who knows about your family is not necessarily genuine. Hang up and call back on the number in the official notice. Do not use phone numbers or QR codes printed in letters you receive.
Why family composition and marital status matter
Family composition and marital status, entered in the entry form, are details that ordinary shopping accounts rarely collect. Together with address and phone number, they make it possible to build calls or letters that gain trust by mentioning "your family" or "your children". Telling your family about this incident helps them notice suspicious contact addressed to them as well.
What happened (from Fujicco's announcement)
On October 22, 2026, Fujicco Co., Ltd. posted a notice titled "Apology regarding possible leakage of personal information due to unauthorized access" on its website. Everything below comes from that notice.
Since May 2026
The two affected campaigns ran. Handling of the non-member entry form was contracted to an outside company.October 21 (Wed)
It was found that the contractor's server had been accessed without authorization by an outside party and that personal data entered through the form may have leaked. The server was promptly shut down.October 22 (Thu)
Published on the company's website. The affected entries are suspended.Next
Report to the Personal Information Protection Commission (Japan's data protection authority); a damage report to the police is planned after consultation. Affected people will be emailed in turn, once ready.
- Scope
- Personal data entered in the non-member entry forms of the "Motto! Toro-mocchi Campaign Part 2" (もっと！とろぉ～もっちキャンペーン 第2弾) and the "Fujicco Thanksgiving Festival Campaign" (フジッコ大感謝祭キャンペーン)
- Not affected
- Entries as a registered Fujicoin member, postcard entries and entries on X
- Count
- About 15,500 entries in total (including repeated entries by the same person)
- Items
- Name, age, gender, occupation, marital status, family composition, phone number, email address, address, survey answers
- Not included
- Driver's licences, credit cards, bank account numbers and similar data
- Harm so far
- No publication or misuse confirmed. The company is treating the data as obtained by a third party
- Other environments
- The entry form for Fujicoin members and other environments are managed separately; no impact found
- Cause
- Unauthorized access to the contractor's server. How it happened has not been disclosed
- Contact
- Fujicco campaign office 0120-954-659 (10:00 to 17:00, excluding weekends, public holidays and December 26, 2026 to January 3, 2027; 13:00 to 17:00 on January 4, 2027; open until April 15, 2027)
Affected: non-member entry form (web)
"Motto! Toro-mocchi Campaign Part 2" and "Fujicco Thanksgiving Festival Campaign", about 15,500 entries
Not affected
Entries as a Fujicoin member
Not affected
Postcard entries
Not affected
Entries on X
What is known and what is not
Based on the company's notice of October 22, as of October 26, 2026. We will update the status column when follow-ups are published.
| Item | What the notice says | Status |
|---|---|---|
| Name, age, gender, phone number, email address, address | Data entered in the non-member entry forms | Possible (company) |
| Occupation, marital status, family composition, survey answers | Same as above | Possible (company) |
| Obtained by a third party | Treated as obtained | Possible (company) |
| Driver's licences, credit cards, bank account numbers | Not included | Not included (company) |
| Member, postcard and X entries | Not affected | Not included (company) |
| Count | About 15,500 entries in total (including repeat entries) | Published (company) |
| Number of people | Not stated | Not stated |
| Publication or misuse | Not confirmed | Not confirmed (company) |
| Cause | Unauthorized access to the contractor's server; method not stated | Not stated |
| Individual notice to affected people | Emails in turn once ready (no URLs or attachments) | Planned (company) |
| Reopening of entries | Suspended; timing to be announced on the website | Not yet decided (company) |
'About 15,500 entries' is not the number of people
The company published a total that counts every entry, including repeat entries by the same person. The actual number of people may be lower, but it has not been stated. This article does not convert the figure into a number of people.
What can happen when family details and occupation leak together
In general, when contact details leak together with family and lifestyle information, it becomes easier to build messages that recipients believe are genuine (there is no announcement that this has happened in this incident).
What can generally happen
- Emails, texts or letters posing as a prize notice that ask for shipping fees, handling fees or a transfer
- Requests to resend receipts or personal details because of an "incomplete entry"
- Calls that mention your family to gain trust, then ask for family names or talk about money
What you can do
- If you are told a prize costs money to receive, do not pay
- Hang up and call back on the number in the official notice
- Tell your family about this incident and share any suspicious contact
For how to prepare for fake calls and letters after a leak of names, addresses and phone numbers, see also the Murauchi.com personal data breach.
For people who run campaigns
The cause has not been disclosed, so this section only covers what can be said from the published facts. We do not guess at the type of attack or claim that closing a particular gap would have prevented it.
Review the items your entry form collects in terms of leak impact
Besides names and addresses, the affected data included marital status, family composition, occupation and survey answers. In general, survey answers become part of a leak if they are stored together with entrants' personal data. Before collecting, decide what each item is for and when it will be deleted, and consider storing items that can be analysed without identifying entrants separately.
Know what data sits in each contractor's environment
The company says the entry form for members and other environments are managed separately and no impact has been found there. It says it will consolidate its systems into an environment confirmed to be secure. Contracting each campaign out adds more places that hold entrants' data. Keeping a list of which contractor's server holds whose data for which period lets you narrow down the affected people quickly when something happens.
Keep links and attachments out of apology emails
The company announced in advance that its email to affected people contains no URLs or attachments. Showing what the genuine notice looks like before it arrives makes fakes easier to tell apart. Stating clearly which requests you will never make, such as "we will not ask for shipping or handling fees", also helps.
Sources (public records)
The facts in this article are based on the public information below. We have not speculated about undisclosed attack details or causes.
- Fujicco Co., Ltd., "Apology regarding possible leakage of personal information due to unauthorized access" (October 22, 2026, in Japanese) — fujicco.co.jp (PDF)
- Fujicco Co., Ltd. news release list (checked October 26, in Japanese) — fujicco.co.jp
Update history
2026-10-26: First version, based on Fujicco's notice of October 22. We will update it when follow-ups on the cause, the number of people or the reopening of entries are published.
Read next
- A food brand member data leak from the same week: the Lindt Japan online shop and app member data breach
- Leaks of addresses and phone numbers: the Murauchi.com personal data breach
- Preparing for fake emails: What is phishing?
- Other incidents in Japan from the same period: the FANCL and Attenir online store breach
- Other 2026 incidents: list of breaches and cyberattacks (Japan and worldwide)