member data

istyle @cosme Breach (Data of About 3 Million Members Leaked): What Members Should Do About Leaked Names, Addresses, Phone Numbers and Skin Type

istyle Inc. announced on November 2, 2026 that it confirmed unauthorized access to @cosme by a third party on October 28, and that part of the member information registered under the @cosme common ID had leaked. About 3 million people are affected, including people who have since left @cosme but were members at the time of the access. The leaked items are the user ID (not used for login), nickname, name (kanji and kana), postal code, address, phone number, email address, gender, date of birth, skin type and hair type. The company says that, as of now, login passwords and credit card information are not included. When the access happened and how are not disclosed, and a third-party security firm is investigating. The company has reported to Japan's Personal Information Protection Commission and plans to finish individually notifying affected people by email from the cosme.net domain on November 6. It says no misuse or secondary damage has been confirmed as far as it knows. This site's takeaway: if you are or were an @cosme member, do not open links in emails, texts or calls that do not come from cosme.net, and verify even messages that get your name, address and skin type right through the official app or a site you open yourself. The company says passwords are not included as of now, but change a reused one to be safe.