For: people who have used Shiseido group skin measurement services (Shiseido Online Store, SHISEIDO, ELIXIR, IPSA). This article is an explanation based on Shiseido's official notice; it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who have used Shiseido group skin measurement services (Shiseido Online Store, SHISEIDO, ELIXIR, IPSA).
- Confirmed so farSee the table ↓
- Unauthorized access, service suspension
- Alteration and taking of data
- Count
3 more
- Name, email address, age, gender, member ID
- Questionnaire data, skin measurement results (including date and time)
- Report to the Personal Information Protection Commission and police
- Not yet confirmed
- Cause (how the access happened)
- Details of the scope (final count)
- What the altered information was
2 more
- When the suspended services will restart
- Whether the data has been misused
- What to do nowSee the steps ↓
- Do not respond to emails in the name of Shiseido or its brands
- Check whether you used the skin measurement services concerned
- Take into account that questionnaire data and skin measurement results leaked
3 more
- Check other services that use the same member ID or email address
- If you are worried, contact the official line
- If you entered information or sent money, get help right away
- Where to verify (source)All sources ↓
- Shiseido, "Apology and notice about the personal information leak due to unauthorized access to our skin analysis system" (November 6, 2026, in Japanese)
- Last checked
- As of November 13, 2026
Follow-up plans and what we checked
The company says it has not confirmed suspicious emails related to its skin measurement services. When we checked the company's official notice on November 13, 2026, we found no follow-up or update after the November 6 notice.
What users should do today
Do not respond to emails in the name of Shiseido or its brands
The company says it never asks for credit card details, PINs or passwords directly by email or phone. It has not confirmed suspicious emails related to its skin measurement services, but if you receive one, do not open the URL or enter any information.
Someone who knows your email address, name and skin results can more easily write a convincing message such as "your skin analysis results are ready" or "steps to restart the skin measurement service" (this site's view). Check on a service by opening the official site or app yourself, not by following a link in a message. For how to spot fakes, see What is phishing?.
Check whether you used the skin measurement services concerned
A leak was confirmed for "Beauty Alive Circulation Check" on the Shiseido Online Store and at SHISEIDO. "Hada Pasha", "Men's Skin Checker", "AI Skin Analyzer", "AI Recipist mico" and "CO-HADA Scan" have no confirmed leak but are suspended as a precaution.
The company says it will contact individually the customers it can identify. For some customers it holds no identifying information, so individual contact is difficult and it reports to them through the notice. If you have used these services, you may be affected even if you have not been contacted.
Take into account that questionnaire data and skin measurement results leaked
The notice does not list the questions in the questionnaire. In general, information about your skin condition and concerns, age and gender is something many people prefer to keep private. If someone pitches a product or service that fits your skin concerns and seems to know your results, do not trust it; check with the official line yourself.
The company says some information was altered but does not say which information or how. When you view your results or registered details after the services restart, check for anything that looks wrong.
Check other services that use the same member ID or email address
The leaked items include member ID and email address. Passwords are not listed, so the notice does not give a reason to change your password because of this incident alone. If you reuse the same email address and password across several services, this is a good time to review that (this site's view). For how to check, see How to check whether your password has leaked.
If you are worried, contact the official line
The line given in the notice is Shiseido's customer line 0120-81-4710 (10:00 to 17:00 Japan time, excluding weekends, holidays and summer and year-end breaks), or an email inquiry through the form on Shiseido's official site. For IPSA, IPSA has its own official contact page. Use the lines in the official notice, not a number written in an email.
If you entered information or sent money, get help right away
If you entered personal or card information on a page reached from a suspicious message, contact your card company immediately. You can also call the police consultation line (#9110) or the consumer hotline (188) in Japan. For suspicious activity on accounts, see How to check for unauthorized access.
What happened (from Shiseido's notice)
On November 6, 2026, the company published "Apology and notice about the personal information leak due to unauthorized access to our skin analysis system" (in Japanese). Everything below is the company's statement.
October 27
The company confirmed unauthorized access by an outside third party to the online skin analysis system "FCA" that the group uses. To prevent further damage, it suspended some skin measurement services that use the system from that day and carried out emergency response with the system developer.During the investigation
The company confirmed that some information in the system had been altered and that data had been taken outside (the date of confirmation is not given). It reported to the Personal Information Protection Commission and the police (the date is not given).November 6
The notice was published. The company says it is working with outside specialists to identify the scope and the cause.
- Confirmed
- Unauthorized access by an outside third party to the online skin analysis system "FCA", confirmed on October 27, 2026; some services suspended from that day
- Count
- A total of 2,515 records of personal information confirmed leaked (scope under investigation)
- Information that leaked
- Name, email address, age, gender, member ID and other identifying information; questionnaire data; skin measurement results (including date and time)
- Not included
- Face images taken during measurement (not among the information confirmed as leaked); credit card information (not handled by the system)
- Cause
- Unauthorized access by an outside third party. Some information in the system was altered and data was taken outside (cause under investigation with the system developer and outside specialists; route and method not disclosed)
- Reports
- Reported to the Personal Information Protection Commission and the police
- Contact
- Shiseido customer line 0120-81-4710 (10:00 to 17:00 Japan time, excluding weekends, holidays and summer and year-end breaks)
Services that are suspended
These are the services the company lists as using the same skin analysis system "FCA". No restart date is set; the company plans to restart after the system's safety is confirmed.
| Service | What it is | Status |
|---|---|---|
| Shiseido Online Store "Beauty Alive Circulation Check" | Online skin measurement service | Leak confirmed, suspended (company) |
| SHISEIDO "Beauty Alive Circulation Check" | In-store and online skin measurement service | Leak confirmed, suspended (company) |
| Shiseido Online Store "Hada Pasha" and "Men's Skin Checker" | Online skin measurement services | No leak confirmed, suspended as a precaution (company) |
| ELIXIR "AI Skin Analyzer" | Online skin measurement service | No leak confirmed, suspended as a precaution (company) |
| IPSA "AI Recipist mico" and "CO-HADA Scan" | Online skin measurement services | No leak confirmed, suspended as a precaution (company) |
What is known and what is not
This table is based on the company's notice of November 6, as of November 13, 2026. When follow-up notices appear, we will update the status column.
| Item | What the notice says | Status |
|---|---|---|
| Unauthorized access, service suspension | Confirmed on Oct 27; some services suspended from that day | Confirmed (company) |
| Alteration and taking of data | Some information in the system was altered and data was taken outside | Confirmed (company) |
| Count | A total of 2,515 records; scope under investigation | Confirmed (company; under investigation) |
| Name, email address, age, gender, member ID | Leak confirmed | Confirmed (company) |
| Questionnaire data, skin measurement results (including date and time) | Leak confirmed; the specific questions are not described | Confirmed (company) |
| Face images | Not among the information confirmed as leaked | Not included (company) |
| Credit card information | Not handled by the system; no leak | Not included (company) |
| Passwords | Not listed among the items | Not stated |
| What was altered | Some information was altered, but which information is not described | Not stated |
| Cause | Unauthorized access by an outside third party; under investigation with the system developer and outside specialists | Under investigation (company) |
| Route and method of the intrusion | Not described | Not stated |
| Misuse | No suspicious emails related to the skin measurement services have been confirmed | Not confirmed (company) |
| Individual contact | Individual contact for customers who can be identified; others are informed through the notice | Planned (company) |
| Restart of suspended services | To restart after the system's safety is confirmed; no date | Not stated |
| Report to the Personal Information Protection Commission and police | Reported | Confirmed (company) |
What can happen with questionnaire data and skin measurement results
The table below is what can generally happen with combinations of such items. It does not mean this happened in this incident.
| Information that leaked | What can generally happen | What users should do |
|---|---|---|
| Name + email address + member ID | Realistic emails in the name of Shiseido or its brands | Do not open links; check on the official site or app |
| Questionnaire data + skin measurement results | Product or service pitches that quote your skin concerns or results | Do not trust it even if they get it right; check with the official line |
| Age + gender + email address | Emails with convincing wording tailored to your profile | Check the sender and URL, and do not enter anything |
What can happen with the leaked information
- Realistic emails in the name of Shiseido or its brands
- Pitches that quote your skin results or concerns
- Contact made to look like a service restart procedure, asking you to enter information
What the notice puts outside the leak
- Face images taken during measurement
- Credit card information (not handled by the system)
- Suspicious emails related to the skin measurement services (not confirmed as of November 6)
What operators should review: managing measurement services built on an outside system
The cause has not been disclosed, so we write only what can be said from the published facts.
- Scope when one system serves many services: besides the two services with a confirmed leak, five more services that use the same system were also suspended. In general, the more services share a system, the wider the effect of a suspension. Deciding at design time how a shared system is managed and how services are separated helps keep the suspension narrow.
- Checking for alteration: the company says some information was altered as well as taken. Alteration requires checking that the data is correct, separately from confirming the leak. Deciding in advance how to compare logs and stored data helps confirm the scope faster.
Sources (public record)
The facts in this article are based on the official notice below. We have not speculated about details of the cause that have not been disclosed.
- Shiseido, "Apology and notice about the personal information leak due to unauthorized access to our skin analysis system" (November 6, 2026, in Japanese) — corp.shiseido.com
Update history
2026-11-13: First version. Based on Shiseido's notice of November 6. We checked the company's official notice the same day and found no follow-up or update.
Read next
- Cosmetics-related incidents around the same time: Unauthorized access to istyle's @cosme (about 3 million people) / The Beauty Garage data breach
- How to spot fake contact: What is phishing? / Smartphone security basics
- Checking for reused passwords: How to check whether your password has leaked
- Suspicious activity on an account: How to check for unauthorized access
- Other incidents in 2026: Data breaches and cyberattacks (Japan and overseas)