For: Hotto Motto members, especially people who receive (or used to receive) its email newsletter. This article is an explanation based on the official notice from Plenus Co., Ltd.; it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
Hotto Motto members, especially people who receive (or used to receive) its email newsletter.
- Confirmed so farSee the table ↓
- Date of occurrence
- Report from the contractor
- Email address
5 more
- Name
- Date of birth
- Phone number
- Count
- Cause
- Not yet confirmed
- Cause (how the access happened)
- Full list of leaked member data items
- Whether and how affected members will be contacted
1 more
- When newsletter delivery will restart
- What to do nowSee the steps ↓
- Do not open links in emails that use the Hotto Motto name
- Be suspicious of anything that looks like the newsletter
- Be careful with phone calls and text messages too
2 more
- If you are worried, use the official contact point
- If you entered details or paid money, get help right away
- Where to verify (source)All sources ↓
- Plenus Co., Ltd., notice on unauthorized access to the Hotto Motto newsletter delivery service provided by an outside contractor and the company's response (November 4, 2026, Hotto Motto website; Japanese)
- Last checked
- As of November 7, 2026
Follow-up plans and what we checked
The company says that if new facts that should be disclosed come to light, it will announce them promptly through its website and other channels. The restart date for the newsletter delivery service is "undecided". When we checked the official Hotto Motto and Plenus websites on November 7, 2026, we found no follow-up notice.
What Hotto Motto members should do today
Do not open links in emails that use the Hotto Motto name
The company asks customers to watch out for suspicious emails pretending to be the company or its services. If you receive a suspicious message, do not open the URL in it, do not open attachments, and do not enter member information, passwords or credit card details.
The company says it never asks customers by email to enter passwords or credit card details. Delete suspicious emails. For how to spot them, see What is phishing?.
Be suspicious of anything that looks like the newsletter
The company has stopped the newsletter delivery service entirely and says the restart date is undecided. If an email styled as the Hotto Motto newsletter arrives while it is stopped, even one offering coupons or a campaign, do not open its links; check whether the same offer appears on the official site or app (this site's view).
Online ordering is still available, so emails other than the newsletter, such as a confirmation for an order you placed yourself, can still arrive. When in doubt, open the official site or app yourself and check your order history there.
Be careful with phone calls and text messages too
The leaked information includes phone numbers. In general, a name plus a phone number is enough to call or text someone while using a company's name. A caller who knows your name or date of birth has not proved anything.
Hang up and call back using the number listed on the official website. Do not give out card numbers, PINs or verification codes by phone or text message.
If you are worried, use the official contact point
The contact point in the notice is the Hotto Motto customer center (toll-free 0120-2074-86, 10:00 to 17:30 Japan time). The company asks callers to take care not to dial the wrong number.
Use the number shown on the official website, not one written in an email or text message.
If you entered details or paid money, get help right away
If you entered card details on a page linked from a suspicious email, contact your card issuer immediately. If you entered a password, change it right away, and change it on any other service where you used the same password (Choosing a password manager).
In Japan you can also call the police consultation line (#9110) or the consumer hotline (188).
What happened (from the Plenus notice)
On November 4, 2026, Plenus Co., Ltd. posted the same notice on the Hotto Motto website and on its own corporate website. Everything below comes from that notice. The company has not named the contractor.
October 28 to 31
Unauthorized access occurred on the Hotto Motto newsletter delivery service provided by an outside contractor (the period given as the date of occurrence).November 2
The outside contractor for the newsletter delivery service reported that a third party had gained unauthorized access and that member information including email addresses had leaked.November 4
Plenus made the incident public. The newsletter delivery service has been fully stopped, with no restart date. No impact on the online ordering service has been confirmed.
- Date of occurrence
- October 28 to October 31, 2026
- Records affected
- Up to about 7 million
- Leaked information
- Member information including email addresses, names, dates of birth and phone numbers
- Not included
- Credit card information (the company does not hold it)
- Cause
- Unauthorized access by a third party to the email delivery service provided by the outside contractor
- Current status
- Newsletter delivery service fully stopped (restart date undecided). No impact on online ordering confirmed; it remains available
- Contact
- Hotto Motto customer center, toll-free 0120-2074-86 (10:00 to 17:30 Japan time)
Other incidents at email delivery contractors in the same period
In the same period, several Japanese companies have disclosed unauthorized access at contractors that deliver their emails (for example, unauthorized access to Arara Message). Plenus has not named its contractor, and its notice does not say whether this incident is the same as any other. This article does not apply counts or causes from other incidents to this one.
What is known and what is not
This table is based on the company's notice of November 4, as of November 7, 2026. When follow-up notices appear, we will update the status column.
| Item | What the notice says | Status |
|---|---|---|
| Date of occurrence | October 28 to October 31, 2026 | Confirmed (company) |
| Report from the contractor | Received on November 2 from the outside contractor | Confirmed (company) |
| Email address | Included in the leaked member information | Leak confirmed (company) |
| Name | Included in the leaked member information | Leak confirmed (company) |
| Date of birth | Included in the leaked member information | Leak confirmed (company) |
| Phone number | Included in the leaked member information | Leak confirmed (company) |
| Other member data items | The notice says member information "including" the items above; it does not say whether others were included | Not stated |
| Credit card information | Not included. The company does not hold it | Not included (company) |
| Password | Not in the list of leaked information | Not stated |
| Postal address | Not in the list of leaked information | Not stated |
| Count | Up to about 7 million (the unit is records; the relation to the number of people is not stated) | Confirmed (company; upper figure) |
| Impact on online ordering | Not confirmed. Online ordering remains available | Not confirmed (company) |
| Cause | Unauthorized access by a third party to the outside contractor's email delivery service | Confirmed (company) |
| How the access happened | Not stated | Not stated |
| Misuse | Not stated. The company warns about suspicious emails | Not stated |
| Individual notices to affected members | Not stated | Not stated |
| Restart of newsletter delivery | Fully stopped. Restart date undecided | Under investigation |
What an email address, name, date of birth and phone number can be used for
With an email address, name, date of birth and phone number together, it becomes easier to make a message look genuine. The points below are what can happen in general; they do not mean it has happened in this incident.
Email address + name
↓→
Convincing coupon or campaign emails addressed to you by name
→ Do not open links; check in the official app or site
Name + phone number
↓→
Calls or text messages using the company's name
→ Hang up and call the number on the official site
Name + date of birth
↓→
Messages that ask for more details "to verify your identity"
→ Do not answer, even if they know your birthday
What the leaked data can be used for
- Emails addressed to you by name that look genuine, including "birthday offers"
- Calls or text messages that use your name and the company's name
- Messages that lead to fake pages asking for a password or card details
What the leaked data alone cannot do
- Card fraud (the company does not hold card data, and it was not included)
- Replace a page you opened yourself from the official app or a bookmark
- Log in to the account of someone who has not typed their password anywhere (passwords are not in the notice's list)
What operators should review: what you hand to your email delivery contractor
The details of the cause have not been disclosed, so this section only covers what follows from the published facts.
- Limit the fields used for delivery. The member information that leaked from the newsletter contractor included dates of birth and phone numbers. Which fields were given to the contractor, and why, has not been disclosed. In general, if you give an email delivery contractor only what delivery needs (the email address, and a name if you address people), less leaks when the contractor has an incident. If you use dates of birth for birthday offers, you can pass the month only.
- Decide in advance what happens when a contractor reports an incident. The notice gives the dates of occurrence (October 28 to 31), the contractor's report (November 2) and the public notice (November 4). If your newsletter goes through a contractor, deciding beforehand who stops delivery, what the notice to members says and which contact point handles questions shortens the time to disclosure.
Sources (public record)
The facts in this article are based on the public information below. We have not speculated about details of the cause or the name of the contractor.
- Plenus Co., Ltd., notice on unauthorized access to the Hotto Motto newsletter delivery service provided by an outside contractor and the company's response (November 4, 2026, Hotto Motto website; Japanese) — hottomotto.com
- Plenus Co., Ltd., the same notice (November 4, 2026, Plenus corporate news release; Japanese) — plenus.co.jp
Update history
2026-11-07: First version, based on Plenus Co., Ltd.'s notice of November 4. We checked the Hotto Motto and Plenus websites the same day and found no follow-up notice.
Read next
- Other incidents at email delivery contractors in the same period: Unauthorized access to Arara Message / Asoview! member data breach
- Spotting fake emails: What is phishing? / Smartphone security basics
- Passwords: Choosing a password manager
- Other 2026 incidents: list of breaches and cyberattacks (Japan and worldwide)