For: members of Lindt's Japanese online shop and official app, and anyone who runs a members' site on an outside e-commerce platform. This article is based on Lindt & Sprüngli Japan's official notice and the contractor's own notices, and does not cover attack or scam techniques.
Developing: this article will be updated as the organisation publishes more
As of October 26, 2026Not yet known
- Details of the attack method (the company says it will not disclose them)
- Results of the outside security firm's investigation
- Which hashing method was used for passwords
- When the online shop reopens and how to change passwords
- Specific measures to prevent recurrence
In its October 23 notice, the company said it will promptly post any new facts on the notice page. When this site checked the page on October 26, nothing had been added and no follow-up had been published.
What Lindt Japan members should do today
Check whether you are affected: look for an email from October 26
The affected data is that of members registered with the online shop and official app. Members who had already cancelled their membership by 0:16 on October 18, when the data was taken, are not included.
The company says it will email affected members at their registered address from Monday, October 26, and that for people who do not receive an email, the notice page serves as notification. If you are unsure whether an email is genuine, do not use its links; open the notice on the official site yourself.
If you used your Lindt password elsewhere, change it there now
The leaked items include the login password. The company says it was stored hashed (converted into a form that cannot be read as is), but the hashing method has not been disclosed. Short or common passwords can sometimes be worked out over time (see What is password hashing?).
The company also asks members who use the same password on other services to change it there. Use a different password for each service and turn on two-step verification where you can (see getting started with two-step verification).
Change the Lindt password itself when the reopening notice comes
While the online shop is suspended, the Lindt password cannot be changed. The company says it plans to ask members to change it when the shop reopens, and will explain how on the notice page.
If an email or text urges you to change your password now through a link, do not use the link. Check the procedure on the official site that you open yourself.
Do not follow instructions in emails, texts, calls or letters claiming to be from Lindt
The company warns that the leaked data may be used for suspicious emails, texts, calls or letters pretending to be from the company or its online shop. It says it will never ask for passwords or credit card details by email or phone.
Because addresses and phone numbers also leaked, fake contact may not come only by email. If someone asks on the phone, hang up and call back on the number in the official notice (see What is phishing?). The company asks members to report suspicious contact to the contact points on the notice page.
Why the birth date, registered store and last login matter
On top of name, address and phone number, the leak includes date of birth, the store a member registered as their usual store, the registration date and the last login date. Together these make it possible to write messages that correctly mention when you joined and which store you use. Getting those details right is not proof that a message is genuine.
What happened (from Lindt Japan's notice)
On October 23, 2026, Lindt & Sprüngli Japan K.K. posted "Apology and notice regarding a personal data leak caused by unauthorized access to a contractor" on its official site. Unless stated otherwise, everything below is from that notice. The company says the facts are based on the contractor's report and may change as the investigation continues.
October 17, 2026, 23:02 to October 18, 0:16 (Japan time)
The contractor's server was accessed from outside by exploiting a vulnerability in software used on it, and member account data shared by the online shop and official app was taken (contractor's report).October 19 (Monday)
The contractor reported the incident to the company. The contractor identified and blocked the intrusion route and applied measures against the exploited vulnerability (contractor's report). According to the contractor's own notice, it found the suspicious access at about 15:30 during system monitoring.October 21 (Wednesday), 16:00
The online shop was suspended to prevent further harm.October 23 (Friday)
The company announced the incident on its official site. The dedicated member phone line opened at 11:00. At the time of the announcement, the company said it had reported to Japan's Personal Information Protection Commission jointly with the contractor, and that the contractor was consulting the police.October 26 (Monday)
Emails to affected members at their registered address are scheduled to begin (company).
- Scope
- Data of members registered with the online shop and official app (one shared member account). Members who had cancelled by 0:16 on October 18 are not included
- Records
- 3,147,469
- Items
- Member ID, name, email address, postal address, phone number, date of birth, gender, newsletter settings, registered store
- Password
- Login password (stored hashed)
- Other member data
- Name reading (furigana), registration date and time, last login date and time, and so on
- Not included
- Payment data such as credit card details. The online shop does not store card data
- Misuse
- No misuse of the leaked data confirmed (as of 11:00 on October 23)
- Cause
- Exploitation of a vulnerability in software used on the contractor's server. Attack details are not being disclosed
- Contact
- Dedicated member line 0120-713-065 (9:00 to 21:00 including weekends and holidays), email privacy-incident-jp@lindt.jp. The contact form on the official site can also be used. The company says replies to inquiries may come from a sender address listed in its notice that is not on lindt.jp
How this relates to the contractor's notices
The contractor that provides the online shop system (an e-commerce platform provider) also announced on its own site on October 23 that member data of one of its client stores, 3,147,469 records, had leaked (the store is not named). The contractor says it has found no trace of the same method being used to access other stores' data. In an October 25 notice, it explained that a separate unauthorized access detected on October 21 and a long platform-wide maintenance on October 21–22 were unrelated to this incident.
Contact details
Email, postal address, phone number
Personal attributes
Name, name reading, birth date, gender, member ID
Login and usage data
Hashed password, registered store, join date, last login
↓ What can generally happen
Fake messages that know your details
Posing as password resets, apologies or points
Logins to other services with a reused password
If the password is worked out
↓ To prevent it
Ignore instructions and check the official site / change reused passwords
What is known and what is not
Based on the company's notice of October 23 and the contractor's notices, as of October 26, 2026. The status column will be updated as follow-ups are published.
| Item | What was announced | Status |
|---|---|---|
| Member ID, name, email, address, phone, date of birth, gender | Leaked as member data | Leak confirmed (company) |
| Newsletter settings, registered store | Leaked as member data | Leak confirmed (company) |
| Name reading, registration date, last login, etc. | Leaked as "other information managed as member data" | Leak confirmed (company) |
| Login password | Leaked; stored hashed | Leak confirmed (company) |
| Hashing method | Not stated | Not stated |
| Payment data such as credit cards | Not included; card data is not stored | Not included (company) |
| Number of records | 3,147,469; members who had cancelled by 0:16 on October 18 not included | Confirmed (company) |
| Time of the unauthorized access | 23:02 on October 17 to 0:16 on October 18 | Confirmed (company, per contractor's report) |
| Cause | Unauthorized access exploiting a vulnerability in software used on the contractor's server | Confirmed (company, per contractor's report) |
| Details such as the attack method | Withheld to prevent recurrence and further harm | Not disclosed (company) |
| Name of the exploited software | Not given in the notice | Not stated |
| Misuse or secondary harm | None confirmed (as of 11:00 on October 23) | Not confirmed (company) |
| Impact on other stores | No trace of the same method being used on other stores' data | Not confirmed (contractor) |
| Outside security investigation | Planned by the contractor | Under investigation |
| Individual notices to members | By email to the registered address from October 26 | Confirmed (company) |
| Shop reopening and password change | Date to be announced on the notice page; password change to be requested at reopening | Not stated (date not set) |
What can happen when names, addresses, birth dates and hashed passwords leak together
In general, when contact details and personal attributes leak together, it becomes easy to create messages that recipients believe are genuine. Hashed passwords cannot be used as they are to log in, but short or common ones can sometimes be worked out (there has been no announcement that this happened in this incident).
What can generally happen
- Emails or texts saying "you need to change your password" that lead to a fake login page
- Messages posing as apologies or point rewards that ask for card details
- Attempts to log in to other services with a worked-out password, where the same password was reused
What you can do
- Check any notice on the official site that you open yourself
- Change the password now on other services where you reused it
- Never give a password or card number to anyone who asks
Another breach from the same period in which names, addresses and hashed passwords leaked is the Furusato Choice breach. To check whether a reused password has leaked, see how to check if your password has leaked.
For people who run a members' site on an outside e-commerce platform
The software and method involved have not been disclosed, so this section is limited to what the published sequence of events shows. It is not an assessment of how well the contractor responded.
Plan a way for members to change passwords even while the shop is down
Here, the online shop and the official app share one member account, and suspending the shop also blocked password changes. The company plans to ask for password changes at reopening. Check in advance whether your platform lets you keep password resets, or signing out existing sessions, running separately even when sales are stopped. That lets you protect members right after a leak.
Agree on what happens after a contractor reports an incident, at the contract stage
In this case the contractor reported on the day it found the access (October 19), and the company then suspended the shop (October 21), announced and opened a dedicated line (October 23), and began emailing members (from October 26). For incidents at a contractor, deciding in the contract or runbook who decides to stop the shop, who drafts the announcement, and who reports to the regulator (done jointly here) shortens the time spent deciding.
Do not keep data on members who have left
According to the company, members who had already cancelled when the data was taken are not included. Deleting the data of people who have left makes any leak that much smaller. Decide when to delete data on cancelled or long-inactive members, and check that it is actually deleted on the contractor's system.
Store passwords in a form that is hard to work out if leaked
The company says passwords were stored hashed. The baseline is never to store member passwords in plain text or in a reversible form, and to use a slow, salted hash such as bcrypt or Argon2. If you use an outside platform, find out which method it uses. See storing passwords with hashing and salt.
Sources (public records)
The facts in this article are based on the public information below. Attack details and causes that have not been disclosed are not guessed at.
- Lindt & Sprüngli Japan K.K., "Apology and notice regarding a personal data leak caused by unauthorized access to a contractor" (October 23, 2026, Japanese, checked October 26) — lindt.jp
- The contractor (e-commerce platform provider), "Important: Apology and notice regarding a personal data leak caused by unauthorized access (first report)" (October 23, 2026, Japanese) — contractor's notice
- The same contractor, "Apology and explanation regarding the long maintenance for PHP vulnerability measures and the unauthorized access incidents" (October 25, 2026, Japanese) — contractor's notice
Update history
2026-10-26: First version, based on Lindt & Sprüngli Japan's notice of October 23 and the contractor's notices of October 23 and 25. Will be updated when follow-ups on the investigation or the shop's reopening are published.
Read next
- Member data leaks from the same period: the FANCL and Attenir online store breach / the Furusato Choice breach
- A food brand incident from the same week: Fujicco campaign entry data possibly leaked
- Preparing for fake emails: What is phishing?
- Passwords: How to check if your password has leaked / Choosing a password manager
- Other 2026 incidents: list of breaches and cyberattacks (Japan and worldwide)