Unauthorized Access to Lawson ID (2,155,345 Records): Email Addresses and Names Leaked — What Members and App Reservation Users Should Do

Email addresses and names leaked, and for some people phone numbers and addresses too. The company asks people to be careful with suspicious emails, texts and calls sent to the contact details registered to their Lawson ID.

Fake messages imitating Lawson existed before this incident. In June 2026 the company warned about fake websites that pose as giveaways or free-voucher campaigns to collect personal data. Whether a message says "your points are expiring", "claim your coupon" or "you have won", do not open the link and do not enter your ID, password or card details (how to tell: What is phishing?).

Lawson says it is contacting affected people individually from "Lawson ID Mail" (lawson_id@mailservice.lawson.jp), and it has posted a notice in the Lawson app.

The sender shown on an email can be faked, though. Lawson itself, in a separate notice on October 1 (about its mail server being misused), wrote that the sender display alone may not tell you whether a message is genuine. Even if a notification looks real, check through the official app on your home screen or a bookmark, not through the links in the email.

Passwords are not among the items the company says leaked, and it has not asked people to change them.

What is more likely to happen is a fake login page sent to a leaked email address, where you type your password yourself. Logging in only through the official app largely removes that risk. If you use your Lawson ID password on other services too, make them different regardless of this incident, so a leak somewhere else does not spread (a password manager makes this practical).

For Lawson App Reservation, the leaked items are name, phone number and part of the credit card number. The company says no misuse has been confirmed. A partial number is generally not enough to shop online, but check your statements and contact your card issuer about any charge you do not recognize. If someone calling as your "card company" asks for the rest of the number or your PIN, do not answer.

The contact listed in the notice is the dedicated form of the Lawson Customer Center (lawson-faq.lawson.co.jp). No phone number is given. For people who have already entered information into a fake message, the company's June warning advises consulting the nearest police station or the prefectural police cybercrime consultation desk.

Write down every feature that returns the logged-in user's data: my page, member details, reservation and order history, point balance, coupon list. Include the APIs (the endpoints the app uses to fetch data from the server) behind the app.

For each one, check that the owner of the returned data is decided from the login session. Where a member number sent by the app is used, change it so that it is checked against the logged-in member on every request. At the same time, check whether the response includes fields the screen never shows.

A feature that shows users their own data, used correctly, involves exactly one member per login. So from the access records of that feature, count how many different members' data was returned per login (or per source) per hour.

Normal use gives one, so alert the person in charge at two or more. Monitoring by volume misses slow, small-batch retrieval; this count flags the very first record that does not fit. If your records do not show whose data was returned, start by recording that.

After finding the problem, Lawson suspended the App Reservation feature. In a member service, a switch that turns off one feature while others keep running shortens the time between discovery and containment.