Who this is for: anyone who has registered on White Essence's booking site or My Page (teeth whitening and cleaning in Japan), and franchise clinic or head office personnel. This article is a guide based on White Essence Co., Ltd.'s own announcements; it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
As of October 30, 2026Not yet known
- Breakdown of the count (customers, clinic personnel, head office)
- Details of the vulnerability
- Who is notified individually and how
- Whether any secondary harm occurs
- When My Page will resume
- Whether there is compensation
In its October 5 notice the company says it will announce again when My Page resumes. In its August 12 notice it said it would promptly report any new facts found by the investigation. It gives no schedule for further news. We checked the company's news list on October 30 and found no notice on this incident newer than the October 5 one.
What White Essence users should do today
Know whether you could be affected
The information that leaked is what was registered with the company as of August 5, 2026. The number affected is about 1.05 million accounts, a total that includes customers, franchise clinic personnel and head office employees (the company). Registered details differ by person, so not every item applies to everyone.
If you have ever registered on the booking site or My Page, go on to the next steps as though you could be affected. The company says it contacts individually anyone whose leaked items go beyond those listed.
Change any other service that reuses the same ID and password
The company says the login ID and password were taken in encrypted form. Even when encrypted, an easily guessed password can be worked out (this is a general point, not something the company said).
The company asks you to change the password on any other service where you use the same login ID and password combination. For its own service, it says you do not need to do anything because My Page is currently suspended (as of October 5). For how to change them, see how to check whether your password leaked and choosing a password manager, and turn on multi-factor authentication where it is available.
Do not use the links or numbers in messages claiming to be from the company or a clinic
The company says that because the leaked information includes names and contact details, suspicious emails, calls or mail posing as the company or other businesses may arrive. Its August 12 notice also warned about direct mail, emails and calls posing as the company or its franchise clinics.
With an address, phone number, email address, birth date and usage details together, a convincing message is easy to write. If you get a message about a "booking confirmation", a "whitening refund" or an "account update", do not use the links or phone numbers in it; check on an official site you open yourself or through the company's dedicated line.
Refuse any request for card numbers, PINs or passwords
The company says it will never ask for credit card numbers, PINs, passwords or similar by phone or email. Even if a message claims to be from the company, do not comply, open the listed URL or enter information (the company's request). A message you do not recognise may be phishing or an SMS scam.
If you are unsure, contact the company's dedicated line yourself
The company set up a dedicated line for this incident: 0120-385-035 (toll-free in Japan). Hours were 10:00 to 19:00 every day including weekends and holidays from Monday, October 5 to Sunday, October 18, and weekdays only, 10:00 to 19:00, from Monday, October 19 (the October 5 notice). The notice also lists an email contact.
Confirm contact details on the company's official notice (see Sources on this page) before you use them. Do not call numbers written in an email or SMS you received.
1. An email / SMS / call / letter claiming to be from White Essence or a clinic
Name, address and birth date are correct -> do not judge here
↓
2. Do not use its links or numbers; open the official site yourself or contact the company's dedicated line
Confirm the contact details on the official notice first
↓
3-A. A request you cannot verify
Entering card numbers, PINs or passwords, opening the URL -> do not comply
3-B. The official channel gives the same guidance
Follow the official guidance for any steps
What happened (according to White Essence)
The following is based on the company's notices of August 12, 2026 (partly updated on August 19 and September 10) and October 5. The body of the October 5 notice is published as images; we read those images directly and transcribed the content.
August 5, 2026
Unauthorized access to its systems from outside was confirmedAugust 12 (Wed)
To protect customers' information and prevent further harm, the company suspended its systems and published its first notice on its website. At that point the affected items were still under investigationAfterwards
Continued investigation found that personal information had been taken outside. The company addressed the vulnerability and took the necessary measures and, after confirmation by the external specialist body, resumed services from the scope it could confirm to be safeOctober 5 (Mon)
Published 'Apology and Notice Regarding Leak of Personal Information Due to Unauthorized Access', giving the leaked items, about 1.05 million accounts and the cause. It states that it reported the matter to the Personal Information Protection Commission and consulted the police
- Number affected
- About 1.05 million accounts. A total that includes customers, franchise clinic personnel and head office employees
- Personal information that leaked
- Name, address, phone number, email address, date of birth, gender, workplace, login ID and password (in encrypted form), information about use of and responses to services, the company's management number and similar. Registered details differ by customer, so not every item applies to everyone
- Not included
- It does not hold financial institution account information, and none leaked. It has not confirmed that customers' images leaked
- Cause
- A vulnerability in the program of the booking site was exploited and used as a starting point to access the core systems without authorization. The vulnerability has already been dealt with under expert advice and guidance
- Prevention and authorities
- Introduced a mechanism to detect and block unauthorized communication; reviewing the authentication method, system configuration and permission settings; strengthening monitoring. Reported to the Personal Information Protection Commission and consulted the police
- Service status
- The My Page function is currently suspended; it will announce again when it resumes (as of October 5)
What is known and what is not
This is the state as of October 30, 2026. We will rewrite the table when there is news.
| Item | What the company says | Status |
|---|---|---|
| Unauthorized access occurred | Confirmed August 5; systems suspended August 12 | Confirmed (company) |
| Personal information was taken outside | The investigation found it had been taken | Leak confirmed (company) |
| Number affected | About 1.05 million accounts (customers, clinic personnel and head office employees in total) | Confirmed (company) |
| Name, address, phone, email, birth date, gender, workplace | Listed as leaked items (not every item for everyone) | Leak confirmed (company) |
| Login ID and password | Leaked in encrypted form | Leak confirmed (company) |
| Service usage and response information, management number | Listed as leaked items | Leak confirmed (company) |
| Financial institution account information | Not held; did not leak | Not included (company) |
| Customers' images | No leak has been confirmed | Not confirmed (company) |
| Credit card information | Not among the leaked items listed | Not stated |
| Breakdown of customers, clinic personnel and head office | Not given | Not stated |
| Cause | A vulnerability in the booking site's program exploited, then the core systems | Confirmed (company); no detail on the vulnerability |
| Secondary harm | None confirmed as of October 5; suspicious messages may arrive | Not confirmed (company) |
| Individual notices | Individual contact for people whose leaked items go beyond those listed; in turn to those with confirmed contact details | Not stated (who exactly and how) |
| Compensation | Not stated | Not stated |
Reading note: the number is 'accounts', not the number of customers
The roughly 1.05 million is a count of accounts, described as a total that includes customers, franchise clinic personnel and head office employees. The number of customers alone, and how accounts relate to people, are not given. The notice also does not say how the passwords were 'encrypted' (reversible or not), so we do not assume they are safe and recommend changing any reused password.
What the combination of leaked items could be used for
The following is what such a combination of items can generally lead to, not something the company has said happened here.
- Name + address + phone + email + birth date: lets someone write convincing emails, SMS, calls or letters posing as the company or a dental clinic. A birth date is easy to use to pretend to verify your identity (the company itself lists suspicious messages as a possibility)
- Service usage and response information: lets a message sound as if it knows about your treatment or booking, and can be used to lead you to a fake "booking change" or "refund"
- Email + login ID + encrypted password: if the password is easy to guess, it may be tried on other services. Ending reuse is the most effective step
- Workplace: lets a message sound as if it knows where you work
Most of these can be stopped by not using the links or numbers in a message and checking through an official channel you look up yourself.
What operators should review
The cause has not been explained in detail, so we list only what can be said from what was published.
- A booking site as the way into core systems: the company says a vulnerability in the booking site's program was the starting point. In general it helps to check the separation between public-facing screens and core systems that hold customer data, and the permissions between them. The company also lists a review of system configuration and permission settings among its prevention measures.
- How much information to hold: addresses, birth dates, workplaces and usage information were all stored. Decide what the service needs and check that you do not keep what it does not.
- Explaining how passwords were stored: saying only "encrypted" does not let users judge how safe they are. Being able to explain the storage method, and what protects against reuse, makes a breach notice easier to act on.
Sources (public records)
The facts in this article come from the public information below. We have not speculated about anything that has not been published.
- White Essence Co., Ltd., "Apology and Notice Regarding Leak of Personal Information Due to Unauthorized Access" (October 5, 2026; in Japanese) — whiteessence.com
- White Essence Co., Ltd., "Notice of Suspension of Booking Site and Systems Following Unauthorized Access to Our Systems" (August 12, 2026; partly updated August 19 and September 10; in Japanese) — whiteessence.com
Update history
2026-10-30: First version. Based on White Essence Co., Ltd.'s October 5 notice (the body is images, which we read directly) and its August 12 notice. We checked the company's news list on October 30 and found nothing newer on this incident than October 5. We will update when the breakdown, vulnerability detail, compensation and similar are published.
Read next
- Similar cases (members' login details and contact information): NIFTY unauthorized access / So-net member database unauthorized access
- A Japanese retail case from the same period: MrMax (members' names, emails and phone numbers)
- Follow-on scams: What is phishing? / Smartphone security basics
- Protect your accounts: How to check if your password was leaked / Choosing a password manager / Choosing multi-factor authentication
- Other 2026 incidents: Data breaches and cyberattacks in 2026 (Japan and worldwide)