For: people who received a 7NOW delivery (as the delivery recipient), and operators of services that outsource delivery. This article explains the official notice of Seven-Eleven Japan Co., Ltd. and does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who received a 7NOW delivery (as the delivery recipient), and operators of services that outsource delivery.
- Confirmed so farSee the table ↓
- Third-party unauthorized access at the delivery contractor
- 7NOW orderer data taken
- Name (katakana) only
4 more
- Name (katakana) and address
- Name (katakana), address, phone number, postal code
- Order date, store name and address, product name
- Individual contact
- Not yet confirmed
- Details of the cause and the route of the intrusion
- Period of the unauthorized access
- Whether any misuse or secondary harm occurs
2 more
- Which orders are covered and how the three counts relate
- Status of preventive measures
- What to do nowSee the steps ↓
- Do not follow links or instructions in calls, texts or emails claiming to be 7NOW or a delivery
- If you get an SMS from the company, compare it with the official notice page
- Passwords and cards: the notice gives no instruction to change them
2 more
- Do not give a password, card number or PIN to whoever contacted you
- Be careful with unknown calls and texts for a while
- Where to verify (source)All sources ↓
- Seven-Eleven Japan (SEJ) Co., Ltd., notice regarding the leak of 7NOW customer information following unauthorized access to its delivery contractor (Japanese, November 3, 2026)
- Last checked
- As of November 5, 2026
Follow-up plans and what we checked
The company's notice of November 3 does not state a schedule for follow-ups. The contractor says it will announce on its own site anything new it must disclose. We checked the company's notice and the contractor's notices on November 5 and found no follow-up on this incident newer than November 3.
What 7NOW users should do today
Taken: name (katakana) / for some, address, phone, postal code
Can fuel real-looking calls, texts and emails addressed to the recipient
Taken: for some, order date, store name and address, product name
Can fuel messages that seem to know your order, such as "about your recent order"
Not included: credit card information, IDs and passwords (company)
No leak or alteration of the company's credentials or integration settings was found either
Do not follow links or instructions in calls, texts or emails claiming to be 7NOW or a delivery
The items taken include name (katakana) and, for some records, address, phone number, postal code, store name and product name. With that, a message addressed to you can appear to know your order. In general, fake contact built around a parcel or an order is widely used.
If you get a message about an "order confirmation", "redelivery arrangement" or "refund procedure", do not open the link in it. Open your browser yourself and check on the official site. Fake texts (smishing) work the same way (what is phishing?).
If you get an SMS from the company, compare it with the official notice page
The company says it contacts affected customers in turn by SMS to their registered phone number. The notice does not say whether that SMS contains a URL or how the sender is shown, and we have not been able to confirm this.
So even if an SMS arrives, do not open its link. First check that it matches the notice (see Sources). You can also use the 7NOW inquiry line listed in the notice (0120-711-099, 9:00-21:00 JST). Take the number from the company's official notice, not from the SMS.
Passwords and cards: the notice gives no instruction to change them
The company says no credit card information and no IDs or passwords were leaked, and that the contractor's investigation found no leak or alteration of its own credentials or integration settings. The notice does not ask for a password or card change.
Our view: because the items taken do not include passwords, there is no need to change your 7NOW password right now. If you reuse passwords, reviewing them is good practice regardless of this incident (choosing a password manager).
Do not give a password, card number or PIN to whoever contacted you
If the caller can state your name, address or what you ordered correctly, that is not proof that the contact is genuine, because that is exactly the information that was taken. If you are asked for a password, card number or a verification code that arrives by SMS, treat it as fake.
Be careful with unknown calls and texts for a while
Unlike an email address, a phone number and an address are hard to change. In general, a phone number that has been taken can attract scam calls and texts, including ones that have nothing to do with 7NOW (our view). Turning on your phone's spam call and spam SMS filters reduces how many reach you (smartphone security basics).
What happened (according to Seven-Eleven Japan)
Seven-Eleven Japan Co., Ltd. posted a notice on its official site on November 3, 2026 (Japanese title: apology and notice regarding the leak of customer information following unauthorized access to the contractor of its delivery service 7NOW). Unless stated otherwise, everything below is based on that notice.
Sunday, November 1, 2026
The company writes that the contractor's investigation found that a service run by the contractor for part of 7NOW's deliveries had been accessed without authorization by a third party.Tuesday, November 3
The contractor's investigation found that part of the 7NOW orderer data was also taken, and the company was informed. The company posted its notice the same day and says it has reported to the Personal Information Protection Commission.Response (no date given)
According to the company's notice, the contractor cut off communication from the source of the access, suspended the accounts that were misused, fixed the flaw that was abused, and restricted some functions and access from outside Japan.As of November 5
We found no follow-up. Affected customers are being contacted in turn by SMS to their registered phone number.
- Data confirmed taken
- Orderer (recipient) name (katakana) only, 164,180 records / name (katakana) and address, 4,762 / name (katakana), address, phone number and postal code, 209. For some records, also order date, store name and address, product name
- Not included
- Credit card information, IDs and passwords. The contractor's investigation also found no leak or alteration of the company's credentials or integration settings
- Service status
- 7NOW is operating normally
- Harm
- No misuse caused by this incident has been confirmed so far
- Contact with customers
- Affected customers are being contacted in turn by SMS to their registered phone number
- Report to authorities
- Reported to the Personal Information Protection Commission
- Inquiries
- 7NOW inquiry line (0120-711-099, 9:00-21:00 JST). The notice also lists a contact at the contractor
What the contractor published on its own site
CBcloud Inc., the delivery contractor, has posted a first and a second report about its service "PickGo" on its own site (see Sources). The following is based on those two notices.
- First report: it confirmed unauthorized access by a third party on November 1, 2026. It cut off communication from the source, suspended the misused accounts, fixed the abused flaw, and restricted some functions and access from outside Japan. It says it confirmed there was no malware or virus infection
- Second report: it says it has identified the range of information that may have leaked: company name, name of the registered contact person, registered address, phone number and email address, order information (names and addresses of pickup and delivery points, and so on), and information on the drivers who handled the orders. It describes this as the widest possible range and says the range differs from one client company to another. It says payment information such as bank accounts and card numbers was not taken, and login passwords are not included either
- The specific items and counts confirmed for 7NOW are as stated in Seven-Eleven Japan's notice. The contractor's notice does not give counts per client company
A separate announcement by another service through the same contractor
Demae-can Co., Ltd. also posted its own notice on November 3, 2026 (see Sources). According to it, a service of the same contractor was accessed without authorization, and part of the customer data in Demae-can's delivery cases was taken. The confirmed counts are orderer (recipient) name 799, address 794, phone number and postal code 33, and it says it will contact affected customers by email. These counts come from a separate announcement and are not added to the 7NOW counts. If you used Demae-can, check Demae-can's notice.
What is known and what is not
Status as of November 5, 2026. We will rewrite the status column when follow-ups appear.
| Item | What the notice says | Status |
|---|---|---|
| Third-party unauthorized access at the delivery contractor | Found on November 1, 2026 (contractor's investigation) | Confirmed (company) |
| 7NOW orderer data taken | Found on November 3. Confirmed taken | Leak confirmed (company) |
| Name (katakana) only | 164,180 records | Leak confirmed (company) |
| Name (katakana) and address | 4,762 records | Leak confirmed (company) |
| Name (katakana), address, phone number, postal code | 209 records | Leak confirmed (company) |
| Order date, store name and address, product name | Taken for some records | Leak confirmed (company) |
| Credit card information, IDs and passwords | Not leaked | Not included (company) |
| Leak or alteration of the company's credentials or integration settings | Not found in the contractor's investigation | Not included (company) |
| Details of the route and cause | The abused flaw has been fixed (contractor). No detail on the route | Not stated |
| Period of the unauthorized access | Found on November 1. No earlier period stated | Not stated |
| Misuse or secondary harm | None confirmed so far | Not confirmed so far (company) |
| Which orders are covered, overlap of the three groups | Not stated in the notice | Not stated |
| Individual contact | In turn, by SMS to the registered phone number | Confirmed (company) |
Note: the figures are records, not people, and the three counts are not added together
The notice gives figures per combination of items, in records. It does not say people, and it does not say whether the three groups overlap or are separate. So this site gives no total and does not convert them to a number of people. The company's notice gives no total.
What the combination of items could be used for
In general, these combinations can lead to the following kinds of misuse. This does not mean it has happened here.
- Name (katakana) + address: contact addressed to the recipient that pretends to be about a missed parcel or redelivery. Getting the name right is enough to look genuine
- Name (katakana) + phone number: calls or texts that pretend to check your identity in order to extract information
- Store name, product name, order date: contact such as "about your recent order" that appears to know a real order. Knowing the order is not proof that it is genuine
- Password, card information: the company says these were not leaked, so there is no instruction to change them
For operators of services that use a delivery contractor: what the published facts let you check
The details of the cause have not been published. This section does not evaluate the company or the contractor; it sticks to what an operator can check in their own service, based on published facts.
Take stock of what you hand to the contractor
According to the notice, the items taken were the orderer (recipient) name (katakana), address, phone number, postal code, store name, product name and so on. The group with the most records is name (katakana) only. Review whether what you pass to your contractor is limited to what delivery needs. Data you do not hand over cannot leak from the contractor.
Decide when to stop the integration and how to check before restarting
According to Demae-can's notice, it was informed on November 2, stopped its integration with the contractor shortly after 14:00 the same day, confirmed that the fix was complete, and restarted at around 21:00. If you decide in advance when to stop and what to check before restarting, you will not hesitate on the day such a message arrives.
Decide who receives the contractor's findings and how you will contact customers
For 7NOW, the contractor's investigation found that its data was also taken on November 3, and it was announced the same day. You need to decide in advance how you will contact affected customers (SMS, email, app) on the day the counts are known, and prepare a way for customers to check that the contact is genuine (the same content on an official page).
Sources (public records)
The facts in this article are based on the public information below. We have not speculated about the cause, the period or the route of the intrusion, which have not been published.
- Seven-Eleven Japan (SEJ) Co., Ltd., notice regarding the leak of 7NOW customer information following unauthorized access to its delivery contractor (Japanese, November 3, 2026) — sej.co.jp
- [Delivery contractor], "Unauthorized access to PickGo and possible leak of personal information (first report)" (Japanese) — cb-cloud.com
- [Delivery contractor], "Unauthorized access to PickGo and possible leak of personal information (second report)" (Japanese, updated November 3, 2026) — cb-cloud.com
- Demae-can Co., Ltd., notice regarding the leak of customer information following unauthorized access to its contractor (Japanese, November 3, 2026) — corporate.demae-can.co.jp
Update history
2026-11-05: First version, based on Seven-Eleven Japan's notice of November 3, the contractor's first and second reports, and Demae-can's notice of November 3. When we checked on November 5, we found no follow-up newer than November 3. We will update when the cause, the period, whether secondary harm occurs, and similar points are published.
Read next
- Similar Japanese cases: Yamato Transport and Sagawa Express unauthorized access / MrMax member data breach / Nojima Online unauthorized access
- Phones: Smartphone security basics
- Follow-on scams: What is phishing?
- Other 2026 incidents: Data breaches and cyberattacks (Japan and abroad)