Security Guides

#data breach #unauthorized access #phishing #smishing #Japan

Joshin (formerly Joshin Denki) Unauthorized Access (Up to About 6 Million Records): Members' Names, Addresses and Phone Numbers May Have Leaked, and What Users Should Do

On October 26, 2026, Joshin Corporation (formerly Joshin Denki) said up to about 6 million member records (name, address, phone number, member number) and up to about 230,000 Joshin subscription records may have leaked. These are not confirmed leak counts. What users should do today.

Published 2026-10-28 Updated 2026-10-28 Last verified 2026-10-28 14 min read

On this page

For: Joshin (formerly Joshin Denki) members, users of the Joshin subscription service, and people who uploaded photos for a Joshin home renovation. This article is based on Joshin Corporation's official notices and does not cover attack techniques.

Check any message claiming to be from Joshin without using its links or numbers, even if it gets your name, address and member number right

According to Joshin Corporation's second notice, names, addresses, phone numbers and member numbers for up to about 6 million records on its member database server may have leaked (the company says these are not confirmed leak counts). That combination is enough to make a fake message look genuine.

Do not use links or phone numbers in emails, texts or calls claiming to be Joshin
To check, open the official site yourself or call the contact listed in the notice (06-6631-1323)
If you still use the initial password for the Joshin subscription service, change it (this site's recommendation)
If you use the same password on other services, change it there too
The company is contacting people whose license, My Number card or bank account number is involved. Confirm such a contact by calling the listed number yourself

Developing: this article will be updated as the organisation publishes more

As of October 28, 2026

Not yet known

Whether a leak is confirmed, and how many records
How the record counts relate to the number of people (overlap)
Cause and route of the intrusion
Which services are suspended and when they will resume
Whether member-database and subscription users will be contacted individually
Whether there is compensation

In its second notice on October 26, the company says it will announce any new facts that should be made public promptly on its official website and other channels. It gives no schedule. We checked the company's news list on October 28 and confirmed that no third notice had been published.

What Joshin members and subscription users should do today

Work out whether you could be in scope

The second notice says information on these three systems may have leaked:

Member database server: up to about 6 million records (name, address, phone number, member number)
Joshin subscription service: up to about 230,000 records (member number, login ID and initial password, billing history and more)
Renovation photo upload system: up to about 800 records (photos of renovation work, and a small number of driver's license images, My Number card data and bank account numbers)

The notice does not say which membership service the member database server belongs to, or which members are covered. If you have ever been a Joshin member, assume you may be in scope and go on to the next steps.

Do not use links or phone numbers in emails, texts or calls claiming to be Joshin

The company warns that suspicious emails, text messages and phone calls pretending to be from it may occur. Because the items include names, addresses, phone numbers and member numbers, a fake message could get these right.

If you are told to "confirm your member details", that "your points are expiring" or that you are due an "apology refund", do not use the links or phone numbers in the message. Check on an official site you open yourself, or call the customer contact listed in the notice (06-6631-1323, 9:30 to 18:30 Japan time).

Joshin subscription users: change the initial password if you never did

For the Joshin subscription service, login IDs and initial passwords are among the items that may have leaked. The company does not ask anyone to change their password in its notice, but this site recommends that anyone still using the initial password change it. If the service is one of those suspended, do this on the official site once it resumes.

If you use the same password on other services, change it there too (how to check if your password was leaked / choosing a password manager). Turn on two-step verification where available.

Check your subscription billing for unexpected changes

Billing history and contract numbers are also among the items that may have leaked. Check that your contract and charges are correct on an official site you open yourself or in your contract documents, not through a message you received. Because the company says it does not hold card information, be especially suspicious of any message asking for your card number.

If your license, My Number card or bank account number is involved: confirm the contact through the listed number

On the renovation photo upload system, 2 driver's license images, 1 My Number card and 5 bank account numbers may have leaked, and the company says it is contacting the people concerned individually. If you are contacted, first confirm it is genuine by calling the number listed in the notice yourself.

Driver's license image: see if your Japanese driver's license data was leaked
My Number: it normally does not change, but under Article 7(2) of the My Number Act, the mayor of the municipality can assign a new number when it is recognised that the number has leaked and may be misused. If needed, consult the municipality where you are registered as a resident
Bank account number: do not respond to anyone asking for your PIN or password, and contact your bank or the police if anything looks wrong (general advice from the Japanese Bankers Association and the National Police Agency, not advice about this incident)

1. Email / text / call claiming to be Joshin

Name, address and member number are correct → do not decide here

↓

2. Do not use its links or numbers: open the official site yourself, or call the listed contact yourself

Customer contact 06-6631-1323 (9:30 to 18:30 Japan time)

↓

3a. A request you cannot confirm

Card number, PIN, password or a photo of your ID → do not respond

3b. The contact gives the same guidance

Follow the official site's or contact's instructions

Judge a message not by whether its details are correct, but by whether you can confirm it on an official site you open yourself or through the contact listed in the notice.

What happened (according to Joshin)

The following is based on what Joshin Corporation published on its official website on October 17, 2026 (filed with the Tokyo Stock Exchange on October 19), and on its second notice filed on October 26. The company changed its name from Joshin Denki Co., Ltd. to Joshin Corporation on April 1, 2026 (securities code 8173). The counts are given per system, so this site has not added them together.

Oct 16, 2026 (Fri)
An anomaly was detected on the company's network. Investigation found signs that part of the network had been accessed without authorization. The company took steps such as disconnecting servers showing those signs from the network and asked outside specialists to investigate. As a result, some services became unavailable.
From Oct 16
The company consulted and reported to the Personal Information Protection Commission and the police (the second notice says it did so immediately after confirming the incident).
Oct 17 (Sat)
First notice published on the official website. Whether information had leaked was still being checked.
Oct 19 (Mon)
The same notice filed with the Tokyo Stock Exchange.
Oct 26
Second notice filed, listing the information and record counts that may have leaked.

Up to ~6M records

Member database server (may have leaked, per company)

Up to ~230K records

Joshin subscription service (may have leaked, per company)

Up to ~800 records

Renovation photo upload system (may have leaked, per company)

Information that may have leaked (from Joshin's second notice)

Member database server: Up to about 6 million records. Name, address, phone number, member number
Joshin subscription service: Up to about 230,000 records. Member number, phone number + handwritten signature (binary data), login ID and initial password, billing history, contract number and device ID, activation code
Renovation photo upload system: Up to about 800 records. 2 driver's license images, 1 My Number card and 5 bank account numbers (the people concerned are being contacted individually), plus photos of renovation work in progress
What the counts mean: Total counts of records that may have leaked, not confirmed counts of leaked personal data (per the company)
Credit card information: The company does not hold payment data and does not hold credit card information (per the company)
Contact: Joshin Corporation customer contact: phone 06-6631-1323 (9:30 to 18:30 Japan time), and an email contact listed in the notice

In its first notice (October 17), the company said it was still checking whether information had leaked, and that it had made an initial report to the Personal Information Protection Commission because a personal data leak could not be ruled out. The second notice gave the items and record counts per system for the first time. The company says the full extent of the damage is still under investigation.

What is known and what is not

Status as of October 28, 2026. We will update this table as the company publishes more.

Item	What the notice says	Status
Unauthorized access occurred	Signs of unauthorized access to part of the network confirmed	Confirmed (company)
Name, address, phone number, member number (member database server)	Up to about 6 million records	Possible (company)
Joshin subscription: member number, phone number + handwritten signature, login ID, initial password, billing history, contract number, device ID, activation code	Up to about 230,000 records	Possible (company)
Driver's license images, My Number card, bank account numbers	2, 1 and 5 respectively (within the renovation photo upload system's up to about 800 records)	Possible (company)
Photos of renovation work in progress	Renovation photo upload system	Possible (company)
Credit card information	Not held	Not included (company)
Whether a leak is confirmed	The counts are stated not to be confirmed leak counts; investigation continues	Under investigation
How the counts relate to the number of people	Given in records; overlap within or across systems not stated	Not stated
Which members are covered (service, registration date)	Not stated	Not stated
Cause and route of the intrusion	Not stated	Not stated
Suspended services and when they resume	Some services are unavailable; which ones and when they resume are not stated	Not stated
Individual contact (people with license, My Number card or bank account number involved)	Being contacted individually	Confirmed (company)
Individual contact (member database and subscription users)	Not stated	Not stated
Misuse or secondary harm	Not stated; the company warns that suspicious contacts may occur	Not stated
Compensation	Not stated	Not stated

Note: these are counts of records that may have leaked, not people

The company says the counts are total counts of records that may have leaked and not confirmed counts of leaked personal data. All figures are in records; if the same person is registered on more than one system, the number of people may be smaller, but the overlap is not stated. This site does not say the information "leaked", only that it "may have leaked".

What the combination of possibly leaked items could be used for

The following is what can generally happen with this combination of items. The company has not announced that any of it has happened in this incident.

Name + address + phone number + member number: texts, calls or letters claiming to be Joshin that quote your member number to look like an identity check
Subscription contract number and billing history: fake "payment confirmation" or "contract renewal" messages that cite real contract details
Login ID + initial password: could be used to log in to accounts still on the initial password, or to other services where the same password is reused
Driver's license images, My Number card data and bank account numbers: could be used to apply for services in someone's name or for messages posing as a bank (a small number of people, whom the company is contacting individually)

Most of this can be prevented by not using the links or numbers in a message and checking on an official site you open yourself or through the contact listed in the notice.

What operators should review

The cause has not been disclosed, so this section covers only what can be said from the published information.

Data you do not hold cannot leak: the company has adopted a setup in which it does not hold payment data, and its notice states that it does not hold credit card information. Not holding card numbers in-house narrows what is exposed when an intrusion happens.
Take stock of what reaches each single-purpose system: on the system for uploading renovation photos, a small number of driver's license images, My Number card data and bank account numbers are also listed among the information that may have leaked. In general, any system that accepts file uploads can receive documents nobody expected. Check that uploaded files are kept only as long as needed and only visible to the people who need them.

Sources (public records)

The facts in this article are based on the public information below. We have not guessed at the cause, the number of people or the scope, which have not been announced.

Joshin Corporation, "Notice and apology regarding system disruption caused by unauthorized access (second report)" (Japanese, October 26, 2026) — joshin.co.jp (PDF)
Joshin Corporation, "Notice and apology regarding system disruption caused by unauthorized access" (Japanese, posted on the official website October 17, 2026) — joshin.co.jp (PDF)
The same notice (Japanese, filed with the Tokyo Stock Exchange October 19, 2026) — joshin.co.jp (PDF)
Joshin Corporation, "Top message" (on the name change, Japanese) — joshin.co.jp
Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures (My Number Act), Article 7 — e-Gov law search
Japanese Bankers Association (general advice) — zenginkyo.or.jp / National Police Agency (general advice) — npa.go.jp

Update history

2026-10-28: First version, based on Joshin Corporation's October 17 notice (filed October 19) and its October 26 second notice (news list checked October 28; no third notice). We will update when the cause, confirmed counts or compensation are announced.

Latest breaking reports

All breaking reports →

FAQ

QWhat information was involved in the Joshin incident?

According to Joshin Corporation's second notice on October 26, information on three systems may have leaked. The member database server: up to about 6 million records of name, address, phone number and member number. The Joshin subscription service: up to about 230,000 records of member number, phone number + handwritten signature (binary data), login ID and initial password, billing history, contract number and device ID, and activation code. The renovation photo upload system: up to about 800 records, including 2 driver's license images, 1 My Number card and 5 bank account numbers, plus photos of renovation work in progress. The company says these are total counts of records that may have leaked, not confirmed leak counts.

QAm I affected?

The notice does not say which membership service the member database server belongs to, or which members (for example, by registration date) are covered. The counts are given in records, so the number of people is not known. The company says it is contacting individually the people whose driver's license image, My Number card or bank account number is involved. It does not say whether others will be contacted individually. If you are a Joshin member or use the Joshin subscription service, assume you may be in scope and be careful with messages claiming to be from Joshin.

QWere passwords or credit card details leaked?

The company says it does not hold payment data and does not hold credit card information. For the Joshin subscription service, login IDs and initial passwords are among the items that may have leaked. The company does not ask anyone to change their password in its notice, but this site recommends changing it if you still use the initial password, and changing it on any other service where you use the same password.

QWhat caused it?

It has not been disclosed. The company says it detected an anomaly on its network on October 16 and confirmed signs that part of the network had been accessed without authorization, but it has not described the cause or the route of the intrusion. It says it is investigating with outside specialists (as of October 28, 2026).

QWhat should I do if I get an email, text or call claiming to be from Joshin?

The company warns that suspicious emails, text messages and phone calls pretending to be from it may occur, and asks people to be careful with unexpected contacts and suspicious URLs. Do not use links or phone numbers in the message. Check on an official site you open yourself, or call the customer contact listed in the notice (06-6631-1323, 9:30 to 18:30 Japan time). A message that gets your name, address or member number right is not proof that it is genuine.

QI was told my driver's license image or My Number card was involved. What should I do?

The company says it is contacting individually the people whose driver's license image, My Number card or bank account number is involved. First confirm the contact is genuine by calling the number listed in the notice yourself. Steps to take when a driver's license image leaks are in our article on leaked Japanese driver's license data. A My Number normally does not change, but under Article 7(2) of the My Number Act, the mayor of the municipality can assign a new number when it is recognised that the number has leaked and may be misused. If needed, consult the municipality where you are registered as a resident.