For: anyone who has used the inquiry forms on Yakult Honsha's website in Japan, its school lunch site "Tanoshii Kyushoku", or its press inquiry form. This article is based on the official notice from Yakult Honsha Co., Ltd. and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 31, 2026Not yet known
- Breakdown of the count
- Period affected
- Cause and how the intruder got in
- How and when affected people will be contacted
- A dedicated inquiry line for this incident
- When the website reopens
The company says it will announce details such as the count and the period in sequence, and will contact affected customers once ready. It says it is preparing a dedicated inquiry line for this incident and, for now, is handling inquiries at the Yakult Customer Consultation Center.
What affected people should do today
Do not open links or attachments in calls, emails or texts claiming to be Yakult
The leaked items include names, addresses, phone numbers and email addresses. With all of those, a scammer can build a convincing contact with your correct name and details.
The company names "prize wins", "delivery notices" and "refund offers" as pretexts to watch for, and asks people not to open links or attachments in messages they do not recognise. Check on the official site you open yourself, not through a URL in the message (see What is phishing?).
Assume the other side may know what you wrote in your inquiry
For email inquiry form users, the contents of the inquiry are among the leaked items. Depending on what you wrote, such as products, health, orders or complaints, a message that knows that content can look genuine.
A message that raises a topic you once asked about is not proof that it comes from the company. Do not open its links; check through an official channel.
School lunch site members: change a reused password on other services
For school lunch site members, the registration password is among the leaked items in encrypted form. Because it is encrypted, it is not simply readable. Short or common passwords can still be guessed from converted data (see What is password hashing?).
If you used the same password on other services, change those first. A password manager is the realistic way to do the inventory, and turning on multi-factor authentication afterwards adds safety. How to check if your password was leaked helps you check reuse.
Press inquiry form users: watch for fake messages sent to your workplace too
For press inquiry form users, the leaked items are name, occupation, media name, company or organisation, company address, phone number, email address and inquiry contents. Before opening an attachment in an email that claims to come from a media outlet or company, such as an interview request or a materials delivery, confirm the sender by another route.
Never give anyone a password, account number or card number
The company says it will never ask you for a password, account number or credit card number, and that its website did not hold credit card or bank account data. If you are asked for any of these, treat it as fake.
Contact the company through the channel in its notice
The notice says the company is preparing a dedicated line for this incident and, for now, handles customer inquiries at the Yakult Customer Consultation Center (0120-11-8960, 10:00 to 16:00, excluding weekends and holidays; calls from Japan). Use the channel in the company's notice, not a phone number or email address in a message you received.
What happened (from Yakult Honsha's notice)
The company published a first report at 19:00 on October 26 and a second report at 9:00 on October 30. Everything below is based on the company's notices.
October 26, 2026 (Mon)
Unauthorized access to its website was confirmed. To prevent further harm, the company suspended the website's functions. The first report at 19:00 said the impact on customer data was under investigation.October 30 (Fri), 9:00
Second report. The company said its investigation confirmed that customers' personal data provided through the website leaked. About 40,000 records at this point. It has made a first report to the Personal Information Protection Commission and consulted the police.Next (company's plan)
It will announce details such as the count and the period in sequence, and contact affected customers once ready.
- (1) Users of the email inquiry form
- Name, gender, age band, address, phone number, email address, inquiry contents
- (2) Members of the school lunch site Tanoshii Kyushoku
- Name, type of business, workplace, department or contracted company, workplace address, workplace phone number, email address, registration password (encrypted), how they found the site (optional), products of interest (optional), reason for registering (optional)
- (3) Users of the press inquiry form
- Name, occupation, media type, media name, company or organisation name, department (optional), job title (optional), company address, phone number, email address, inquiry contents
- (4) Company staff who handled the inquiries in (1) and (3)
- Name
- Data not held
- The website did not hold credit card or bank account data
- Response
- Suspended the website's functions to prevent further harm. Investigating in detail, made a first report to the Personal Information Protection Commission and consulted the police
- Count
- About 40,000 records at this point. Details such as the count and period will be announced in sequence
What is known and what is not
Status as of October 31, 2026. When a follow-up notice is published, we will update the status column.
| Item | What the notice says | Status |
|---|---|---|
| Unauthorized access | Confirmed on October 26, 2026; functions suspended | Confirmed (company) |
| Leak of personal data | About 40,000 records confirmed leaked (at this point) | Leak confirmed (company) |
| Items for inquiry-form users | Name, gender, age band, address, phone, email, inquiry contents | Leak confirmed (company) |
| Items for school lunch site members | Name, type of business, workplace, workplace address and phone, email, encrypted password and more | Leak confirmed (company) |
| Items for press inquiry form users | Name, occupation, media name, company name, company address, phone, email, inquiry contents and more | Leak confirmed (company) |
| Staff who handled inquiries | Name | Leak confirmed (company) |
| Credit card and bank account data | Not held on the website | Not included (company) |
| Count breakdown and period | To be announced in sequence | Under investigation |
| Cause and how the intruder got in | Not stated in the notice | Not stated |
| Fraudulent use or secondary harm | Not stated in the notice | Not stated |
| Individual contact with affected people | Will contact once ready | Planned (company) |
| Website reopening | Suspended since October 26; no reopening time given | Not set |
How to read this: about 40,000 is the figure ‘at this point’, not a final count
The company writes "about 40,000 at this point" and says details such as the count and period will follow. There is no breakdown by the four groups, and the number counts records, not people.
Because the count may change, do not judge from the number alone whether you are affected. If you recall using the inquiry forms or Tanoshii Kyushoku, treat yourself as possibly affected and follow the steps above.
What these combinations of items can enable
The following is what such combinations can generally enable. It does not mean any of it happened in this case.
- Name + address + phone number + email address: fake emails, texts, calls and postal mail that have your correct name and contact details. "Prize wins", "delivery notices" and "refund offers" are the pretexts the company itself warns about.
- Inquiry contents: a message from someone who knows the topic you wrote about looks genuine. If you wrote something sensitive, such as health or family circumstances, be especially suspicious of messages that use it.
- Workplace details (school lunch site members, press): fake business messages or interview requests in the name of your workplace. They reach a work email address, so sharing the warning inside your organisation helps.
- Encrypted password: not simply readable, but a weak password can be guessed. If you have not reused it, the effect on other services is small.
Name + address + phone number + email address
↓→
Fake contact with your correct details
→ Do not open links or attachments / check on the official site
Encrypted password (school lunch site members)
↓→
A weak password can be guessed
→ Change the same password on other services
Said not to be held in the notice
- Credit card data
- Bank account data
Leak confirmed (varies by group)
- Name, address, phone number, email address
- Inquiry contents
- Workplace, company, media name, job title (varies by group)
- Encrypted registration password (school lunch site members)
What operators should review
The cause has not been disclosed, so this lists only what follows from what was published.
Decide how long, and where, you keep what forms collect
The affected data includes the contents of inquiry forms and members' registration data. If inquiries stay near a public-facing site after they are handled, one incident reaches many people.
Set a period after which handled inquiries are deleted, or store them without the items that identify a person. Where member features and inquiry forms live on the same website, think about where each is kept and for how long.
Check the stop procedure together with the conditions for reopening
The company suspended the website's functions on the day it confirmed the unauthorized access, which, in this site's view, is effective for preventing further harm. It also helps to decide in advance where customers' inquiries will be taken during a suspension (here, the existing consultation center) and what conditions must be met to reopen.
Sources
- Yakult Honsha Co., Ltd., second report "Apology and notice about the leak of personal information through unauthorized access to our website [Second Report]" (October 30, 2026, 9:00) and first report "About the occurrence of unauthorized access to our website [First Report]" (October 26, 2026, 19:00); titles translated from Japanese — yakult.co.jp (currently shown as the maintenance page)
- Press: ASCII.jp, Nikkei (both in Japanese)
Update history
2026-10-31: First version, based on Yakult Honsha's second report of October 30. The company says it will announce the count, period and other details in sequence. We will update this article when it does.
Read next
- Preparing for follow-on scams: What is phishing? / Smartphone security basics
- Passwords: Choosing a password manager / How to check if your password was leaked / Getting started with multi-factor authentication
- Other cases from the same period in Japan: MUJI app breach / MrMax app and online store breach
- Other 2026 incidents: Data breaches and cyberattacks (Japan and overseas)