What: H2O Retailing reported that unauthorized access to a website run by its subsidiary Hankyu Hanshin Department Stores may have exposed personal data across about 1.26 million H2O ID accounts, almost its entire membership database.

Why it is important: Japanese experts attribute the surge to basic weaknesses in internet-facing applications, such as known vulnerabilities and configuration errors, rather than sophisticated attacks, which makes customer-facing websites the main exposure point.

H2O Retailing is the latest major Japanese company to disclose a large data breach, as disclosures continue almost daily and expose millions of customer records. On Oct. 19, the group reported that unauthorized access to a website operated by Hankyu Hanshin Department Stores may have exposed personal data across roughly 1.26 million H2O ID accounts. Potentially compromised data includes names, email and mailing addresses, telephone numbers, birthdates and the last four digits of credit card numbers.

Other recent cases include Times Mobility, with about 6.6 million records including driver's license images, Yamato Transport with 5.31 million records, and Estore Corp., an e-commerce operations provider, with data on about 23.35 million people. According to MM Research Institute, 454 leaks were reported between January and September, 1.5 times the year-earlier figure. As of mid-October, 19 cases involved at least 1 million records, already above the annual total for every year since 2022.

Experts say the attacks are not particularly sophisticated. Attackers target weaknesses in internet-facing applications and web services, often known vulnerabilities or configuration errors. Lac's chief technology officer urges companies to minimize retained data, and Times Mobility will now delete driver's license images right after verification.

IADS Notes: Customer data has been the common target in recent retail incidents, often reached through indirect routes. At Asos, a hacker impersonating a trusted contact obtained an employee's credentials and accessed customers' names and contact details on third-party platforms, while payment card data and passwords were not exposed (Reuters, October 2026). De Bijenkorf customers' names, addresses, contact details and payment-method descriptions were exposed through an attack on logistics partner CEVA, which also delayed orders, returns and refunds (nu.nl, September 2026). That dependency on suppliers of suppliers is one that vendor risk programmes, which typically stop at direct suppliers, leave largely unmonitored (RH-ISAC, August 2026). Loyalty databases are directly in scope: a ransomware attack on Magasin du Nord exposed customers' names, contact details, addresses and purchase histories, including the data of all Goodie loyalty club members (Computerworld, October 2026). The same incident also shows the limits of resilience: the store kept its stores and webshop open, and payment card data sat outside the affected systems, yet only 5% of surveyed Danish companies said they could largely operate without central IT (Magasin du Nord, October 2026).

Millions of users exposed as Japan data breaches continue to surge