For: anyone who has used Rohto Pharmaceutical's mail-order business, including ordering or inquiring by phone. This article is an explanation based on the official notices from Rohto Pharmaceutical; it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
anyone who has used Rohto Pharmaceutical's mail-order business, including ordering or inquiring by phone.
- Confirmed so farSee the table ↓
- Discovery
- Cause
- Customer management system information
5 more
- Customer management system items
- Customer management system count
- Call recordings
- Card number and expiry date
- Outside investigation
- Not yet confirmed
- How the customer management system group (2,797,545) and the call recording group (9,715) overlap
- The specific route of access (only the unauthorized use of phone system account credentials is disclosed)
- The response if further people needing action are identified
- What to do nowSee the steps ↓
- Check your card statements
- If you are worried, talk to your card issuer
- List the recurring payments on that card
5 more
- Check the contents of your notice
- Be suspicious of calls, emails, text messages and mail in Rohto's or the mail-order business's name
- Do not open links in suspicious messages or call back the number they give
- Just in case, think back to whether you read out your card number on a call
- If you are worried, ask the official contact point
- Where to verify (source)All sources ↓
- Rohto Pharmaceutical Co., Ltd., "Apology and notice regarding the leak of customers' personal data due to unauthorized access" (November 6, 2026; Japanese)
- Last checked
- As of November 9, 2026
Follow-up plans and what we checked
The company says it will respond appropriately if further people needing action are identified. When we checked the news list on the company's official website on November 9, 2026, we found no follow-up after the November 6 notice. As of now, no secondary damage has been confirmed.
What to do today, by how you ordered
First, work out which group is closer to you. If you have ordered by phone from the mail-order business and read out your card number, you are a "phone-order customer". If you ordered online or another way and never gave your card number by phone, you are in "everyone else". If you received an individual notice, follow what it says first.
Phone-order customers (you gave your card number by phone)
Check your card statements
The company asks affected card users to check statements from September 2026 onward for charges they do not recognize, and, if there are any, to contact the company named on the back of the card.
The call recordings in scope start on September 10, 2025. If you ordered by phone in that period, it is reassuring to review statements from September 2025 onward as well, on your card company's website or app (this site's view).
If you are worried, talk to your card issuer
If your card number and expiry date may have been taken, contact your card issuer and explain the situation. The issuer may offer to change the card number (reissue) or to watch for unusual use.
The company says it has asked card issuers to ensure users do not bear the cost of reissuing affected cards. Handling may differ by issuer, so confirm any fee before deciding to reissue.
List the recurring payments on that card
If the card is reissued, subscriptions, regular deliveries and utility payments charged to it may stop. When you are told about the reissue, make a list of what needs the new card number.
Check the contents of your notice
The company says it is notifying affected people individually by post, email or similar means, in turn. If you received one and do not understand it, ask at the dedicated line 0120-610-654 (9:00 to 18:00 Japan time, including weekends and holidays) or through the dedicated inquiry form.
Use the number and form URL listed in the notices on the company's official website, not ones written in an email or text message.
Everyone else (people whose name, address and phone number may be included)
Be suspicious of calls, emails, text messages and mail in Rohto's or the mail-order business's name
The company asks customers to watch out for suspicious calls, emails, text messages and postal mail, and not to respond to requests for personal information, PINs or passwords. It says it will not ask customers to enter or re-provide PINs or passwords as part of its response to this incident.
With a name, address and phone number, it is easier to build a contact that sounds convincing by quoting them. A person who knows these details has proved nothing (this site's view). For how to spot fakes, see What is phishing?.
Do not open links in suspicious messages or call back the number they give
Do not open URLs in emails or text messages, do not open attachments, and do not enter information. If it is a call, hang up and call back using a number listed on the official website.
Do not give out card numbers, PINs or verification codes by phone or text message.
Just in case, think back to whether you read out your card number on a call
According to the notice, card numbers are in part of the call recordings, for 9,715 people. If you never gave your card number by phone, you are normally not expected to be in that group, but compare with your notice (this site's view). If you have any doubt, follow the "phone-order customers" steps above.
If you are worried, ask the official contact point
A dedicated line, 0120-610-654 (9:00 to 18:00 Japan time, including weekends and holidays), and a dedicated inquiry form are available.
Both groups: if you entered details or paid money
If you entered card details on a page reached from a suspicious message, contact your card issuer immediately. If you entered a password, change it right away, and change it on any other service where you used the same password (Choosing a password manager). In Japan you can also call the police consultation line (#9110) or the consumer hotline (188).
What happened (from Rohto's notices)
Rohto published this matter three times on its official website: on September 11, September 15 and November 6, 2026. Everything below comes from the company's notices. The phone system's service provider is described here by role.
September 10, 2025 to September 5, 2026
The period covered by the call recordings. Calls in three periods within it are in scope: September 10 to November 16, 2025; December 9, 2025 to March 22, 2026; and August 21 to September 5, 2026.September 10, 2026
The service provider of the phone system used for mail order reported suspicious access. The company suspended the accounts concerned, changed passwords and started an investigation by an outside expert.September 11
First notice: "Possible unauthorized access to our systems". No counts, items or cause stated. Access restrictions and other measures taken.September 14
Reported the damage to the local police station.September 15
Reported to the Personal Information Protection Commission. Published a follow-up, "Status of the investigation", saying call recordings with accompanying information, and customer management system information, may have been obtained (counts and items under investigation). Announced the dedicated line 0120-610-654.October 16
The outside expert investigation of the phone system was completed.October 22
Dedicated inquiry form opened (added to the September 15 notice).November 6
Published the investigation results: 2,797,545 people in the customer management system, and card numbers and expiry dates in call recordings for 9,715 people. Individual notices sent to affected people.
- Cause
- As the cause identified so far, according to the company: account credentials for the phone system used for mail order were used without authorization by a third party, who gained unauthorized access to that system. Customer management system information was confirmed to have been obtained via the phone system
- Customer management system
- Name, address, phone number. 2,797,545 people. Items differ by person and data, and in some cases only some items are included
- Call recordings
- Mail-order calls (product inquiries, order details and so on). Part of them contain credit card numbers and expiry dates, for 9,715 people
- Not included
- Card security codes, passwords and other authentication information (not obtained or stored)
- Measures
- Changed the passwords of the accounts concerned all at once. Stopped taking card numbers by voice on calls and switched to written payment procedures. Monitoring transactions on affected cards with card companies
- Contact
- Dedicated line 0120-610-654 (9:00 to 18:00 Japan time, including weekends and holidays) and a dedicated inquiry form
What is known and what is not
This table is based on the company's notices of September 11, September 15 and November 6, as of November 9, 2026. When follow-up notices appear, we will update the status column.
| Item | What the notices say | Status |
|---|---|---|
| Discovery | Reported on September 10, 2026 by the phone system's service provider | Confirmed (company) |
| Cause | Phone system account credentials used by a third party without authorization | Confirmed (company) |
| Customer management system information | Confirmed to have been obtained via the phone system | Leak confirmed (company) |
| Customer management system items | Name, address, phone number (differs by person) | Leak confirmed (company) |
| Customer management system count | 2,797,545 people | Confirmed (company) |
| Call recordings | Mail-order calls (inquiries, order details and so on); calls in three periods | Leak confirmed (company) |
| Card number and expiry date | Contained in part of the call recordings; 9,715 people | Leak confirmed (company) |
| Security code | Not included (not obtained or stored) | Not included (company) |
| Passwords and other authentication information | Not included (not obtained or stored) | Not included (company) |
| Email address | Not listed among the items in the notice | Not stated |
| Overlap of the 2,797,545 and the 9,715 | Not stated | Not stated |
| Specific route of access | Up to the unauthorized use of account credentials; nothing further | Not stated |
| Outside investigation | The phone system investigation was completed on October 16, 2026 | Confirmed (company) |
| Notice to affected people | Individual notices by post, email or similar means, in turn | Done (company) |
| Secondary damage | No misuse that appears to result from this incident has been confirmed | Not confirmed (company) |
| Police and regulator | Reported to the police on September 14 and to the Personal Information Protection Commission on September 15 | Done (company) |
Why card numbers in call recordings matter
Unlike information typed on a screen, a call recording keeps a number as spoken. The company has stopped taking card numbers by voice and switched to written payment procedures. With a card number and expiry date, payment methods that do not require a security code could be used, which is why checking statements matters. The points below are what can happen in general; they do not mean it has happened in this incident (this site's view).
What the leaked data can be used for
- Charges you do not recognize that use the card number and expiry date (for people who gave a card number)
- Calls, text messages or postal mail in the name of a company or card issuer that quote your name, address and phone number to seem genuine
- Messages that lead to fake pages asking for a PIN or password
What the leaked data alone cannot do (this site's view)
- Payments that require the security code (the security code was not obtained)
- Replace a page you opened yourself from the official site or a bookmark
- Log in to the account of someone who has not typed their password anywhere (passwords and similar are not included)
What operators should review: card numbers taken by phone, and system accounts
The details of the cause have not been disclosed, so this section only covers what follows from the published facts.
- Keep card numbers out of call recordings. The company stopped taking card numbers by voice and switched to written payment procedures. A business that takes orders by phone can shrink what leaks if a recording is stolen by not taking card numbers verbally (for example, by directing the customer to a payment page).
- Do not let a phone system account be a doorway into other systems. According to the notice, a phone system account was used without authorization, and customer management system information was also obtained via the phone system. Map the permissions between accounts on external services such as the phone system and the systems that hold customer data, and remove access that is not needed; this narrows the damage.
Sources (public record)
The facts in this article are based on the public information below. We have not speculated about details of the cause that were not disclosed, or about the name of the service provider.
- Rohto Pharmaceutical Co., Ltd., "Apology and notice regarding the leak of customers' personal data due to unauthorized access" (November 6, 2026; Japanese) — rohto.co.jp
- Rohto Pharmaceutical Co., Ltd., "Status of the investigation into unauthorized access to our systems" (September 15, 2026, with an addition on October 22; Japanese) — rohto.co.jp
- Rohto Pharmaceutical Co., Ltd., "Possible unauthorized access to our systems" (September 11, 2026; Japanese) — rohto.co.jp
Update history
2026-11-09: First version, based on Rohto Pharmaceutical's notice of November 6 and its notices of September 11 and 15. We checked the news list on the company's official website the same day and found no follow-up after November 6.
Read next
- Other mail-order and card-information incidents: Good Smile Company official shop unauthorized access / RIZAP and Aporito card information theft
- Spotting fake contacts: What is phishing? / Smartphone security basics
- Passwords: Choosing a password manager
- Other 2026 incidents: list of breaches and cyberattacks (Japan and worldwide)