and ST HD Co., Ltd. (株式会社アンドエスティHD), a Japanese apparel holding company listed on the Tokyo Stock Exchange under ticker 2685, disclosed on 2026-10-23 that unauthorised access to its business servers may have exposed the personal data of about 2.5 million customers and 10,000 business partners. The intrusion began on 2026-10-22 and was detected, isolated and blocked within the same day. Email addresses are included in both affected data sets, while credit card and other settlement information and passwords set by customers are explicitly excluded. All figures are described by the company as possibilities rather than confirmed leaks, and no misuse of the information had been confirmed at the time of disclosure.
Incident timeline
On 2026-10-22 at around 07:30 JST, an external party carried out sequential login attempts, intrusions and data extraction against multiple company servers, according to the company notice published on 2026-10-23. The company detected the unauthorised operations at around 10:00 JST the same morning and isolated the affected servers. By 17:00 JST on 2026-10-22, it had blocked the unauthorised access route and stopped internal business systems, and confirmed that access via that route was no longer possible. The company stated that it has identified the means of unauthorised access and completed countermeasures, but it has not publicly named the means. Kyodo News described the firm as an apparel company operating the Global Work brand among others.
Disclosure and reporting
On 2026-10-23, the company published its notice and apology regarding the incident, describing the event as unauthorised access to company business servers with the possibility of personal data leakage. The notice's own chronology records the 07:30 JST start, the 10:00 JST detection and isolation, and the route blocking by 17:00 JST on 2026-10-22. The Reuters wire carrying the disclosure was timestamped 2026-10-23 at 08:05 UTC, which is 17:05 JST, and it identified the company as And ST HD Co Ltd, TSE: 2685.
Kyodo News reported that no misuse of the information had been confirmed at the time of disclosure, that the company is notifying affected customers and partners in sequence, and that a dedicated inquiry desk will be set up. The Nikkei reported the company's statement that the impact of the incident on earnings is under review. livedoor News reported the same day that the notice itemised the customer data categories and stated the business-partner count. The company notice itemises email addresses in both the customer and the partner lists.
On 2026-10-23 the company also consulted the police and reported the incident to Japan's Personal Information Protection Commission, the regulator for personal data handling in Japan. Whether any of the data actually left the company network remains unconfirmed; the notice uses the language of potential leakage throughout.
Data involved
The company notice itemises three groups of possibly leaked information. The customer group covers about 2.5 million records, each containing name, date of birth, gender, address, phone number, email address and member ID. The business-partner group covers about 10,000 records, containing company name, ordering and returns addresses, contact person name, phone number and email address. The employee group is currently under investigation, and the company has not stated which categories or how many records are included.
Credit card and other settlement information is not included in the possibly leaked data, according to the company. Passwords set by customers themselves are also excluded. The included name, address, phone and email combinations remain the standard material for impersonation of the retailer itself: phishing messages or phone calls that reference a real member ID, an order history or a registered address. The full record counts rest on the company's own notice and have not been independently verified.
The employee data scope is unknown. The company stated that it is investigating the employee information, and no categories, counts or systems have been named. Until that investigation concludes, the incident's total scope is incomplete in the company notice itself.
Company response
The company stated that its emergency measures are complete and that group stores and the and ST web store remain usable. Member points are currently unusable at stores and on the web store, which is the only service interruption the company has announced. The company has not stated when member points will become usable again, and has not published further detail on the internal business systems that were stopped on 2026-10-22.
According to Kyodo News, the company is notifying affected customers and business partners in sequence and will set up a dedicated inquiry desk. The details of the inquiry desk had not been published at the time of disclosure, and the company has not published a schedule for the notifications. The Nikkei reported that the company said the impact of the incident on earnings is under review.
Measures for affected customers
The company stated that it will contact affected customers and business partners sequentially, and that a dedicated inquiry desk will be established for questions about the incident. Beyond notification, the company has not published specific instructions for affected individuals. Published guidance for people whose email address appears in a breach is collected in what to do when your email is in a data breach, and the mechanism by which leaked addresses feed impersonation attempts is described in how phishing uses your leaked email. Whether an address has appeared in a known breach can be checked at Have I Been Pwned, the public breach-exposure database.
The leaked combination of name, address, email and member ID can be used in messages that appear to come from the retailer itself, referencing real account details. That property makes direct verification with the company, rather than responses to incoming messages, the relevant check for affected customers.
The company's report to the Personal Information Protection Commission on 2026-10-23 puts the incident on the regulatory record under Japan's personal information protection framework. The report was filed alongside the police consultation, one day after the intrusion, and the public disclosure followed the same day. The following details remain unpublished: the exact notification schedule, the details of the dedicated inquiry desk, the attack vector, the confirmation or denial of actual exfiltration, and the scope of the employee data.
Email addresses and aliases
Email addresses are explicitly itemised in both the customer and the business-partner data lists, and AliasFleet is an email alias service that issues a dedicated forwarding address per service. An address used only at one retailer is traceable to that retailer if it later appears in a leak, which makes the source of the exposure identifiable from the address itself. Aliases are managed, persistent identities under the user's control; they are not separate mailboxes. An email alias is a forwarding address that routes to a destination inbox chosen by the user.
An alias does not prevent the retailer's own servers from being breached, and the name, address and phone number stored in the retailer's customer database sit outside the alias system entirely. A breach of the scale stated in the and ST HD notice therefore exposes the same identity data regardless of how the email address was issued, while the traceability property limits how far a single leaked address can be correlated across other sites. Pausing or replacing the alias tied to the affected retailer stops any future mail referencing that address from reaching the destination inbox.
Top comments (0)