The istyle @cosme data breach is an unauthorised access incident disclosed on 2 November 2026 that exposed member information of about 3 million people registered to the @cosme common ID system. istyle, the operator of the Japanese beauty platform @cosme, confirmed the access on 28 October 2026. The exposed fields include names, postal codes, addresses, phone numbers, email addresses, birth dates, and profile fields for skin type and hair type. The company states that login passwords and credit card details were not included, and that no misuse or secondary harm had been identified within the scope it was aware of at the time of the notice.
Unauthorised access and disclosure
On 28 October 2026, istyle confirmed that a third party had gained unauthorised access to @cosme and that part of the member information registered to the @cosme common ID had leaked externally. The company notice, published on the @cosme site, is written in Japanese, and its wording is the source for the dates, the count, and the field list in this article. The notice appeared under a 2 November 2026 directory, and secondary reporting published the same day matches it on the count, the dates, the data fields, and the exclusions, as covered by iSec News.
Five days passed between the confirmation on 28 October and the disclosure on 2 November. The notice gives no explanation for that interval, and no reason for it is stated here. The notice also gives no attack method, no named vulnerability, and no entry point, so the route into the system remains undisclosed. The affected records are the member information registered to the @cosme common ID, which is the shared member identity system for @cosme, rather than the records of a single shop checkout.
The incident was recorded alongside other large Japanese disclosures in late 2026. Japan Cyber Watch added @cosme to its 2026 list on the night of 2 November, alongside the Nojima disclosure of the same day, and Vietnam.vn reported the @cosme case in the same roundup of attacks on Japanese businesses. That context does not change the facts of the @cosme case, and no shared cause between these incidents has been stated by any source cited here.
Exposed member data
The company notice lists the following fields for the affected members:
| Data field | Notes from the company notice |
|---|---|
| User ID | Auto-assigned at registration, not used for login |
| Nickname | As registered on @cosme |
| Name | Including kanji and kana forms |
| Postal code | As registered |
| Address | As registered |
| Phone number | As registered |
| Email address | As registered |
| Gender | As registered |
| Birth date | As registered |
| Skin type | Profile field |
| Hair type | Profile field |
The user ID in that list is not a login credential. The company states that it was automatically assigned at registration and is not used for login, so the ID on its own does not give access to an account. The profile fields are unusual for a breach list, because skin type and hair type are personal profile details rather than contact or financial data. Their presence in the exposed set means that an impersonation message can quote a detail specific to the recipient, which makes the message look more convincing than a generic message would.
The count is approximate. About 3 million people are affected, and the group includes people who were members when the unauthorised access occurred, plus some former members whose information was retained for a period under the @cosme privacy policy. The notice gives no breakdown between current and former members, and it does not state the retention period in days or months. The company states that login passwords and credit card details are confirmed not included at present, and that statement is a current confirmation while the investigation continues, not a final closed finding.
Company response and regulator report
After confirming the incident, the company states that it moved to prevent further harm and that it is investigating the cause and scope with a third-party security specialist company. The matter has already been reported to Japan's Personal Information Protection Commission, according to the notice and to LegalAgent's incident listing, which records the same 2 November entry, the same count, and the same field list. The company states that it will consider and carry out recurrence prevention measures based on the third-party investigation results, and that it will publish further information on its site promptly if new matters that should be announced come to light.
Individual notices to affected people are being sent in sequence through the contact details the company holds, and completion is scheduled for Friday 6 November 2026. The size of the affected group is the reason given for the time required, and the notice states that completion will take a certain period. For questions, the notice gives a dedicated contact address, security-support@cosme.net, with hours of 10:00 to 18:00 excluding weekends and public holidays, and states that replies may take time depending on enquiry volume.
Impersonation risk
The company warns that messages impersonating @cosme, by email, SMS, or phone, may arrive in connection with the incident. The notice gives a concrete test for such messages: genuine notice mail comes from the cosme.net domain, and notice mail never asks for a password, credit card details, or other personal information to be entered. A message that asks for those details fails that test, whatever personal details it quotes.
Genuine notice mail comes from the cosme.net domain and never asks for a password, credit card details, or other personal information to be entered. A message that asks for any of those details is not a genuine @cosme notice, even if it quotes a real name, address, or birth date.
The risk here follows directly from the exposed fields. A message that quotes a real name, address, birth date, or skin or hair type can still be an impersonation message, because those details are now in the exposed set. The check that matters is the sender domain and the request being made, not the accuracy of the personal detail quoted. The company also asks recipients to take care with unexpected contact, suspicious links, and requests to enter password or personal information.
Published guidance for affected members
The measures in this section are stated as published guidance and the company's own warnings, described in the third person. First, an unexpected message about this incident should be treated with suspicion unless it passes the company's own test, with a sender domain of cosme.net and no request for credentials or card details. A message that links to a login page asking for credentials should be treated as impersonation, and credentials or personal details should not be entered through a link in an unexpected message.
Second, accounts that share the exposed email address deserve review. The exposed data do not include passwords, so a password reset is not forced by this incident alone. Where the same email address is used across many services, and especially where a password is reused across services, changing that password to a unique one and turning on two-factor authentication where available reduces the value of the exposed address to an attacker. The breach response guide sets out the order of steps after a breach notice.
Third, an affected address should be checked against other breaches as well, because the same address may appear in more than one incident. Have I Been Pwned lists breaches by email address, but no @cosme listing there was verified for this article, so a check should be made once a listing appears rather than on the assumption that one already exists. The guide to tracing which website leaked an email explains how to read that kind of result. Fourth, former members should not assume they are out of scope, because the company states that former members are included where their information was retained under the privacy policy, so a person who left @cosme can still be in the affected group and can still receive a notice.
A @cosme member address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Remaining investigation scope
The investigation is not closed. Cause and scope are still being investigated with an external security specialist, the regulator report has been made, and no misuse or secondary harm had been identified as of the notice. What is still owed is a statement of how the access happened, a final affected count, and confirmation that the exclusion of passwords and card details still holds once the investigation completes. The notice wording states that part of the registered member information leaked externally, and it does not distinguish between data that was viewed and data that was downloaded, so no stronger claim about removal is made here. The company states that further announcements will follow on its site if new matters emerge, and until then the confirmed facts are the count, the field list, and the exclusions above, while the cause and the misuse picture remain open.
Top comments (0)