Bookoff's follow-up notice swaps "may have leaked" for confirmed: 6,427,735 records went out, covering 6,383,279 people, 212,371 already quit. Quitting does not delete you from the next breach. I run AliasFleet, an email-alias service. One address per site, so leaks name their source. If you read our first article on this breach, the headline figure barely shifted. The verb did.
The update, side by side
Bookoff Group Holdings put out the second disclosure on 13 October. ITmedia carried it the next day. Same incident, same subsidiary member-management system, far less wiggle room.
| 9 October, first notice | 13 October, second notice |
|---|---|
| Notification promised once the investigation concluded | Notification starts 15 October, reaching registered email addresses in sequence |
| Intrusion window unstated; detection 6 October | Data taken between 4 and 6 October |
| No mention of withdrawn members | 212,371 of the affected people had already withdrawn |
| No count of unique people; the population was still being narrowed down | 6,383,279 people, deduped by email address |
| Up to about 6.43 million member records may have leaked | 6,427,735 member records confirmed sent externally |
Confirmed lands just under the old ceiling. Dull, on its own. The live part is that the ceiling no longer exists. Where the original notice sketched a worst case that might have happened, the follow-up describes an event that did: across 4 to 6 October, member data left Bookoff's system and reached an outside party. The original notice had already given 6 October as the detection date, so the taking ended on the day it was spotted, as far as the reported window shows.
Two counts, two meanings. Keep them apart. Some members registered more than one member record under a single email address, which is why 6,427,735 records compress to 6,383,279 people once deduped by email. Quote the people figure as 6,383,279. Never restate the records figure as people.
One more number falls out of the same pair, and it belongs in the open. Take 6,383,279 people, subtract the 212,371 who had withdrawn, and you land on 6,170,908 active members. Bookoff published the two inputs; the subtraction is derived arithmetic, not a company figure. Say so whenever you repeat it.
What was taken has not changed. Names, dates of birth, gender, email addresses, phone numbers, postal codes and addresses, password hash values, point-card numbers, member numbers. Same list as the original notice. One nuance survives the shift from possible to confirmed: ITmedia still describes the fields as data that may have leaked. Confirmation covers the records going out, not a field-by-field audit of each one. Treat the whole list as exposed until your own notification says otherwise.
Who is in, and who is out
This time Bookoff drew the line harder. Out of scope: anyone who only ever used a physical member card, with no app, online store or web registration. Out of scope too: Booklog and Aoyama Book Center members. In scope: app members, online store members and web members across BOOKOFF, the BOOKOFF official online store, BOOKOFF FASHION and similar services.
Anyone who sold books by post gets one more exclusion. ID document images handed over at mail-in buyback through the official online store sit in a separate system, and they are not affected.
Nobody can split the total by service. The disclosure never broke the 6,383,279 down that way, so do not try to divide it between BOOKOFF, the online store and BOOKOFF FASHION. The original notice had also named Bookoff Online, Hugall and Bookoff U.S.A., and nothing in the follow-up says those members sit outside the count. It describes the affected population in the terms above, full stop.
Practical rule, unchanged: if you ever registered a Bookoff membership with an email address, count yourself in the file until the notification says otherwise. Quitting cancelled the membership. The record stayed where it was, and that covers the 212,371.
The genuine mail has no link
Starting 15 October, Bookoff reaches affected people one batch at a time at their registered email addresses. The mail asks members to change their official online store and app passwords, and no link to the password-change screen travels with it.
Read that last line again. It is the most useful fact in the whole follow-up. Genuine mail, no link. So any Bookoff mail carrying a password-reset link is a forgery. Full stop: no judgment call, no header inspection, no squinting at the sender domain. A link means forgery.
Everything else from the original notice's advice still holds: Bookoff never asks for passwords, verification codes, or card and bank details by mail, SMS or phone. The notification wave doubles as the phishing wave's raw material. Millions of genuine mails go out, and forgeries go out beside them, quoting the real one, pointing at a lookalike page, asking for the rest. The no-link test is the one check that separates them without effort.
One wrinkle, from 4Gamers' reporting on the disclosure. If a notification cannot be delivered because the registered email address changed, the official announcement stands in place of individual notice. Changed your email since registering with Bookoff? Do not wait for a letter that cannot reach you. Read the official announcement and work through the steps below.
The address you left behind still answers
You cannot un-give an email address. Hand it to a company and it stays handed over, whatever you do afterwards, and your only remaining control is what that address is worth to the next person who gets hold of it.
That is the entire case for one dedicated email alias per signup. A Bookoff-only alias, forwarding to your real inbox, keeps working as a tripwire after you quit. Every message on it comes from Bookoff or from whoever stole the file. No third option. A breach notification quoting the real apology, landing on an address nobody but Bookoff ever had, asking for your password or card details, exposes itself as the forgery on arrival. Kill the alias and the impersonation channel dies while your real inbox stays clean. That is the leak-tracing mechanism doing exactly what it is for. The set-up guide takes about two minutes.
Now the proof. Of the 6,383,279 people in this file, 212,371 had already walked away. Cancelled. Stopped shopping there. Their data stayed put, and now it sits in an attacker's hands next to everyone else's.
One limit, same as in the first article. An alias guards the email field, not the rest of the record. Name, birthdate, phone number, address: all still in that file, and no alias changes that. The narrower, more practical win is this. The impersonation arrives labelled.
What to do now
- Change your Bookoff official online store and app passwords through the app or site you opened yourself, never through a link in a mail. If that password matches one you use elsewhere, change it there too. The leaked copies are hashed, but credential stuffing pairs your leaked email with passwords from other breaches.
- Treat any Bookoff mail carrying a password-reset link as a forgery. The genuine notification has none. Delete it, and report it through the app if you want to help the investigation.
- Do not click links in any message about this breach. Open the Bookoff app or type the site address yourself. Genuine notification included. The habit has to work against the real ones to work against the forgeries.
- Expect SMS and calls that "confirm your identity" with your own details. Names, birthdates, phones and addresses leaked. Anyone reading them back to you is proving they hold the file, not that they are Bookoff.
- Quit Bookoff already? Act anyway. Your record is in the file, and the attacker does not care about your membership status.
- Check Have I Been Pwned once the incident is listed. Then walk the breach-response order of operations.
What the follow-up still leaves open
Three gaps carry over from the original notice. The hash algorithm behind the leaked password hashes is still unstated, so nobody can judge how hard the hashes are to crack. The attack vector into the subsidiary's member system is still undisclosed, and reporting still does not name the subsidiary. And the follow-up, as reported, says nothing about misuse or public surfacing of the dataset: neither confirmed nor ruled out. Silence is not good news. Do not read it that way.
Per 4Gamers' reporting, Bookoff has commissioned external experts to help investigate and has contacted police, and the emergency inspection of all group systems continues. Business impact is still under assessment. Should anything requiring disclosure arise, such as a revised earnings forecast, the company says it will announce it promptly.
This story follows the pattern of the whole Japan wave: the first notice hands you a ceiling, the follow-up hands you a count, and the count is always worse in the specific ways that matter. Here the specifics are 212,371 people who believed they had left, plus a notification mail with no link that turns every linked mail into a forgery. That is the update, so act on it. More breach coverage lives on the AliasFleet blog.
Top comments (0)