Security Guides

#data breach #phishing #smishing #incident response #Japan

H2O ID Data Breach (About 1.26 Million Records) via the Hankyu and Hanshin Department Store Reservation Site: Addresses, Phone Numbers and Birth Dates Leaked — What Members Should Do

H2O Retailing and Hankyu Hanshin Department Stores say unauthorized access via their department store reservation site leaked part of the personal data of about 1.26 million H2O IDs, including names, addresses, phone numbers and birth dates. What leaked, what is still under investigation, and what to do today.

Published 2026-10-20 Updated 2026-10-20 Last verified 2026-10-20 17 min read

For: people with an H2O ID (including users of the Hankyu and Hanshin department store reservation site, HANKYU HANSHIN E-STORES and Remo Order), and anyone who runs a member ID shared across several services. This article is based on the official notices from H2O Retailing Corporation and Hankyu Hanshin Department Stores, Inc. and does not cover attack techniques.

Developing: this article will be updated as the organisation publishes more

As of October 20, 2026

Not yet known

The detailed cause of the unauthorized access (under analysis and investigation)
Whether data leaked from HANKYU HANSHIN E-STORES and Remo Order (order history, part of card information, part of point card information, address book)
How many people the 1.26 million records represent
When the reservation site and Remo Order will reopen
The specifics of the recurrence-prevention measures

The companies say that if their investigation finds new facts that should be made public, they will disclose them promptly on their website. They plan to reopen the services once the cause has been identified, the vulnerability fixed and safety confirmed, and will announce any reopening on their website. As of October 20, there was no follow-up on this incident in H2O Retailing's news list.

What H2O ID members should do today

Do not follow links or instructions in emails, texts or calls claiming to be Hankyu, Hanshin or H2O

The leaked items include name (kanji and katakana), address, postal code, mobile and landline phone numbers, email address, date of birth and age. Add "the services used with the H2O ID", and a scammer can send a message with your correct name and address that also mentions a service you actually use.

The companies warn that suspicious emails, texts and calls impersonating them may reach the email addresses and phone numbers registered with H2O ID, and ask customers to watch for unexpected messages and suspicious URLs. Whether the message offers, for example, "apology points", a "booking check" or an "order refund" (this site's examples), do not open the link; open the official site yourself to check (see What is phishing?).

Do not act through links even in notice emails from the companies

The companies say they are emailing H2O ID members in turn. Their notices come from noreply@h2o-retailing.co.jp, and they ask customers to be careful with messages from any other sender.

Sender names can be faked, though. Even if a message appears to come from that address, settle on one rule: do not log in or enter anything through a link in the email. To check what a notice says, use the official site you open yourself or the contacts below.

Be careful with postal mail and phone calls that ask you to confirm your identity

According to the companies, addresses and phone numbers leaked together. Fake contact may come not only by email or text, but also by phone or post.

A caller who correctly states your name, address and birth date is not proven genuine by that alone. If you are asked for a PIN, password, card number or verification code over the phone, hang up and call back on an official number you have looked up yourself.

If you use your birth date as a PIN or password, change it

Unlike an email address or phone number, a birth date cannot be changed, and this time it leaked together with names and addresses.

If your bank or card PIN, phone screen lock or any password is based on your birth date (such as "0815" or "19900815"), change it now. This is this site's general advice, not the companies'.

If you reuse the same password on other services, separate them

The notice says no leak of login passwords has been confirmed, and it does not ask members to change their passwords. The wording reflects an investigation still in progress.

In general, when a password leaks from one service, attackers try the same email and password combination on other services. If you use your H2O ID password elsewhere, separate them now. A password manager is the practical way to do it. To check whether a reused password appears in past leaks, see how to check if your password was leaked.

Use only the contact points given in the notice

The companies list toll-free numbers 0120-110-256 or 0120-369-089 (daily, 10:00 to 20:00 Japan time; toll-free numbers work only from within Japan) and a contact form (https://h2o-id.h2o-retailing.co.jp/web/contact ) for questions about this incident. Hankyu Hanshin Department Stores' notice calls the phone line its special call center. Use the contacts in the notice on the official site, not those written in a message you received.

What happened (according to H2O Retailing and Hankyu Hanshin Department Stores)

H2O Retailing Corporation and its subsidiary Hankyu Hanshin Department Stores, Inc. published a joint apology and notice on October 19, 2026. On the same day, Hankyu Hanshin Department Stores published a customer notice with the same content. Everything below is based on these notices.

October 16 (Fri), 2026
Unauthorized access by a third party to the customer management system via the Hankyu and Hanshin department store reservation site was confirmed. The same day, the companies took emergency measures such as blocking unauthorized external communication, and stopped the whole system of that site.
October 17 (Sat)
Unauthorized access was confirmed at HANKYU HANSHIN E-STORES and Remo Order as well, and the whole systems of both sites were stopped the same day.
October 19 (Mon)
The investigation established that part of the personal data of about 1.26 million H2O IDs managed in the customer management system had leaked. Apology and notice published. At 14:00 the same day, E-STORES reopened (after recurrence-prevention measures and safety checks were completed, Hankyu Hanshin Department Stores said).
As of October 20
No follow-up in H2O Retailing's news list. No notice of the reservation site or Remo Order reopening in the Hankyu Umeda main store's notice list.

The companies say that after confirming the incident, they immediately reported it to Japan's Personal Information Protection Commission and filed a damage report with the local police station.

~1.26M records

H2O IDs whose personal data partly leaked

Almost all

Share of H2O ID members affected

Under investigation

Possible leak from E-STORES and Remo Order

Not confirmed

Leak of login passwords; secondary damage (so far)

Data that leaked and data under investigation (according to the companies)

Services: The Hankyu and Hanshin department store reservation site, HANKYU HANSHIN E-STORES and Remo Order, all run by Hankyu Hanshin Department Stores
Via the reservation site: scope: About 1.26 million H2O IDs (records, not necessarily people). "Although the investigation is ongoing, part of the personal data of almost all H2O ID members leaked"
Via the reservation site: items: H2O ID, name (kanji and katakana), gender, email address, postal code, address, mobile phone number, phone number, age, date of birth, services used with the H2O ID
Via E-STORES and Remo Order: Whether data leaked is under investigation. The data these services hold: order history, part of credit card information (card type, last four digits, cardholder name, expiry date), part of point card information (point card type, last four digits), address book information
Not held: Full credit card numbers and security codes (payment data is not retained). The companies say there is no risk of misuse. For point cards, only the last four digits are held, so the companies say there is no risk of points being misused
Not confirmed: Leak of login passwords
Cause (companies' account): Unauthorized access by a third party to the customer management system via the reservation site. The detailed cause and the security vulnerability are under analysis and investigation
Damage: No misuse or secondary damage thought to result from the incident confirmed so far
Done: Emergency measures such as blocking unauthorized communication, stopping the three sites' systems, measures to prevent new damage by the same method, reporting to the Personal Information Protection Commission, a damage report to the local police station, emailing H2O ID members in turn
Sender of notice emails: noreply@h2o-retailing.co.jp
Contact: Toll-free 0120-110-256 or 0120-369-089 (daily, 10:00 to 20:00 Japan time), contact form https://h2o-id.h2o-retailing.co.jp/web/contact

What is known and what is not

Status as of October 20, 2026. When a follow-up is published, the status column will be updated.

Item	What the notice says	Status
Leak of part of H2O ID personal data (via the reservation site)	Established that part of the personal data of about 1.26 million H2O IDs leaked; almost all members	Leak confirmed (per the companies)
Number of records	About 1.26 million (a count of H2O IDs; number of people not stated), introduced with "although the investigation is ongoing"	Under investigation
Name, gender, age, date of birth	Listed among the items via the reservation site	Leak confirmed (per the companies)
Address, postal code, phone and mobile numbers, email address	Listed among the items via the reservation site	Leak confirmed (per the companies)
H2O ID; services used with the H2O ID	Listed among the items via the reservation site	Leak confirmed (per the companies)
E-STORES and Remo Order order history	Listed as data the services hold	Under investigation
E-STORES and Remo Order partial card information (type, last four digits, name, expiry)	Listed as data the services hold	Under investigation
E-STORES and Remo Order partial point card information; address book information	Listed as data the services hold	Under investigation
Full credit card numbers and security codes	Not held at all	Not included (per the companies)
Login passwords	No leak confirmed	Not confirmed (per the companies)
Cause and how it happened	Unauthorized access via the reservation site; detailed cause and vulnerability under investigation	Under investigation
Secondary damage	No misuse or secondary damage confirmed	Not confirmed (per the companies)
Contacting members	By email, in turn, from noreply@h2o-retailing.co.jp	Confirmed (per the companies)
Reopening of services	E-STORES reopened at 14:00 on October 19. The reservation site and Remo Order once safety is confirmed	Confirmed (per the companies) (E-STORES only)
Recurrence prevention	The companies say they will investigate and strengthen security. No specifics	Not stated

How to read this: the heading says "may have leaked", the text says "leaked"

The heading of section 2 of the notice reads "customer information that may have leaked". The text for the reservation site, however, says that "although the investigation is ongoing, part of the personal data of almost all H2O ID members leaked", and section 1 also says the leak "was established". This site follows the wording of the text and marks the items via the reservation site as "Leak confirmed (per the companies)".

For E-STORES and Remo Order, the notice says only that "the possibility of a leak is under investigation" and lists the data the services hold. It does not say that order history or partial card information leaked. And "not confirmed" means nothing has been found so far, not that it will never happen.

What the leaked combination makes possible

Each item is ordinary on its own, but together they help make scam messages look genuine. The following is what can generally happen, not a statement that it has happened in this case.

Name + address + phone number + birth date

↓→

Fake calls or letters that know your address and birth date, posing as an identity check

→ Do not treat what they know as proof / do not use your birth date as a PIN

Name + email address + services you use

↓→

Fake emails addressed to you by name that mention a service you actually use

→ Do not open links / check on the official site you open yourself

Mobile number + name

↓→

Fake texts about "points expiring" or a "booking check"

→ Do not enter passwords or card numbers / use a spam text filter

Combinations of leaked items and the matching action for members (a general mapping)

For E-STORES and Remo Order, whether data leaked is still under investigation. If a follow-up confirms that address book information leaked, not only members but also people registered as gift recipients could receive messages using parcels or deliveries as a pretext (the notice does not say what the address book contains, so this assumes a typical online store address book). For now, the most you can do is tell people you often send gifts to not to open links in unexpected delivery messages.

Not held or not confirmed, according to the notice

Full card numbers and security codes (not held)
Login passwords (no leak confirmed)
Misuse and secondary damage (none confirmed so far)

Leaked (via the reservation site, according to the companies)

Name (kanji and katakana), gender, age, birth date (a birth date cannot be changed)
Address and postal code
Phone and mobile numbers (hard to change)
Email address and H2O ID
Services used with the H2O ID

For people who run a member ID shared across services

The companies have not disclosed the detailed cause, so this section does not say how to prevent it, and it is not an assessment of the companies' response. How to watch the number of member records read is covered in the Yakiniku King app case. Here we focus on one point the notice itself supports: one entry point can reach every member of a shared ID.

List what each service can see in the shared customer management system

According to the notice, there was unauthorized access to the customer management system via the reservation site, and part of the data of almost all H2O ID members managed in that system leaked. In general, with a shared member ID, one service's entry point can reach the data of members who never used that service.

For your own setup, make a table of which customer management fields each service can read and write, and how many records at a time. If a reservation site only needs the data of the person making the booking, that is a starting point for not letting it read other members' addresses or birth dates.

Not holding card numbers, and publishing your sender in advance

According to the companies, payment data is not retained, and full card numbers and security codes are not held. It is an example of a general principle: what is not in the system cannot leak (for how card data can still be stolen through a tampered payment page, see the PhotoGoods case).

This notice also states the sender address of the notice emails, which helps members spot the genuine one. Before anything happens, decide the sender you will use for important member notices, publish it, and set up sender authentication (stopping spoofed email with SPF, DKIM and DMARC).

Sources (public record)

The facts in this article are based on the following public information. We do not speculate on undisclosed intrusion routes or methods.

H2O Retailing Corporation and Hankyu Hanshin Department Stores, Inc., "Apology and notice regarding unauthorized access by a third party and a leak of personal information" (October 19, 2026, in Japanese) — h2o-retailing.co.jp (PDF)
Hankyu Hanshin Department Stores, Inc., "Apology and notice regarding unauthorized access by a third party and a leak of personal information" (October 19, 2026, customer notice, in Japanese) — hankyu-dept.co.jp (PDF)
Hankyu Hanshin Department Stores, Inc., "Notice of the reopening of the official online store HANKYU HANSHIN E-STORES" (October 19, 2026, in Japanese) — hankyu-dept.co.jp (PDF)
H2O Retailing "News releases" list (checked October 20, 2026; no follow-up on this incident) — h2o-retailing.co.jp
Hankyu Umeda main store "Notices" list (checked October 20, 2026; no notice of the reservation site or Remo Order reopening) — hankyu-dept.co.jp

Update history

2026-10-20: First version, based on the October 19 notice from H2O Retailing and Hankyu Hanshin Department Stores, Hankyu Hanshin Department Stores' notice of the E-STORES reopening (October 19), and both companies' notice lists (checked October 20). The companies say their investigation into the detailed cause is continuing; this article will be updated when a follow-up is published.

FAQ

QWhat was leaked in the H2O ID breach?

According to the October 19, 2026 notice from H2O Retailing and Hankyu Hanshin Department Stores, unauthorized access via the Hankyu and Hanshin department store reservation site leaked part of the personal data of about 1.26 million H2O IDs. The items are H2O ID, name (kanji and katakana), gender, email address, postal code, address, mobile phone number, phone number, age, date of birth, and the services used with the H2O ID. The heading of the section that lists these items reads 'customer information that may have leaked', but the text itself says the data leaked.

QAm I affected?

The notice says that, although the investigation is ongoing, part of the personal data of 'almost all' H2O ID members leaked. It gives no condition, such as having used the reservation site, that would limit this. If you have an H2O ID, it is safest to act as affected. The companies say they are emailing H2O ID members in turn. Note that 1.26 million is a count of H2O IDs, not necessarily of people.

QAre my password and credit card safe?

The notice says no leak of login passwords has been confirmed. For credit cards, it says HANKYU HANSHIN E-STORES and Remo Order hold part of the card information (card type, last four digits, cardholder name, expiry date), and that whether data leaked from those services is under investigation. Full card numbers and security codes are not held, so the companies say there is no risk of the cards being misused. The companies have not said that card information leaked.

QWhat caused the breach?

The notice says that on October 16 the companies confirmed unauthorized access by a third party to the customer management system via the reservation site, and that on October 17 they confirmed unauthorized access at E-STORES and Remo Order as well. The detailed cause and the security weakness are being analysed and investigated, and had not been disclosed as of October 20.

QWhat if I get an email, text or call claiming to be Hankyu, Hanshin or H2O?

The companies warn that suspicious emails, text messages and calls impersonating them may reach the email addresses and phone numbers registered with H2O ID. They say their notices come from noreply@h2o-retailing.co.jp. Sender names can be faked, though, so even with that sender, do not log in or enter anything through a link in the email. Check on the official site you open yourself, or through the contacts in the notice (0120-110-256 or 0120-369-089, 10:00 to 20:00 Japan time, toll-free within Japan).

QCould people I sent gifts to through E-STORES be affected?

This is not known yet. For E-STORES and Remo Order, the companies say they hold 'address book information' and that whether it leaked is under investigation. The notice does not say what the address book contains. In general, an online store's address book holds recipients' names and addresses, so if a follow-up confirms a leak, recipients could receive suspicious messages. If you are concerned, you can tell the people you often send gifts to not to open links in unexpected delivery messages.