The Nojima data breach is the leak of about 7 million member records from Japanese retailer Nojima, confirmed on 1 November 2026 after unauthorised access to the member management system for Nojima Online and its used-smartphone buyback site, and announced on 2 November 2026. Nojima is a Japanese electronics retailer, and the two affected sites are its e-commerce site, Nojima Online, and its used-smartphone buyback site. The count refers to records, not to unique people, and former members are excluded from the count. No credit card information was held on either site, while the leaked records contain a full set of identity details, including names, addresses, dates of birth, phone numbers, login IDs, encrypted passwords and email addresses.
Public dates of the Nojima incident
On 1 November 2026, Nojima detected unauthorised access to the member management system for Nojima Online, and confirmed on the same day that personal data had leaked externally from that system. The company notice covering the incident is dated 2 November 2026, and the notice states that the leak affected both Nojima Online and the used-smartphone buyback site. The 2 November notice is the primary source for the dates, the record count, the data types and the suspension of both sites, and it is published as a PDF on the Nojima corporate site. On 3 November 2026, the Nojima Online notice page was updated with a forced password reset for customers suspected to be affected, which is the first dated victim measure in the public record of the incident.
| Date | Event |
|---|---|
| 1 November 2026 | Unauthorised access to the member management system detected, and a leak of personal data confirmed on the same day. |
| 2 November 2026 | Nojima issues its apology and notice about the leak, covering Nojima Online and the used-smartphone buyback site. |
| 3 November 2026 | The Nojima Online notice page is updated with a forced password reset for customers suspected to be affected. |
Secondary reporting matches the primary notice on the core facts. TSN reports the same figure of about 7 million records, the same two sites and the same 3 November password reset. Kyodo News reports personal information of around 7 million registered customers leaked after unauthorised access to the e-commerce site member management system. LegalAgent lists the Nojima entry with the same dates, figure and data types, and Japan Cyber Watch lists Nojima at 7 million records taken, with access detected on 1 November and the leak confirmed on the same day. The agreement across those secondary sources is on facts already stated in the primary notice, and this article does not rely on secondary reporting for any fact that the primary notice does not contain.
Contents of the leaked records
Nojima lists the following fields in each affected member record:
- Name, in kanji and katakana
- Date of birth
- Gender
- Postcode
- Address
- Phone number
- Login ID
- Encrypted password
- Email address
The absence of payment data is a defined limit on the financial exposure in this incident, because Nojima states that both sites are set up not to retain payment data. The identity exposure remains substantial, because the combination of a name, a home address, a date of birth, a phone number and an email address is sufficient for a message about a delivery, a repair or a buyback payment to appear plausible to the recipient. Nojima warned in its notice that leaked personal data could be used for impersonation emails and phishing, and asked customers to treat unexpected emails, text messages and phone calls with caution and to leave unfamiliar links and attachments unopened. The risk in this case therefore sits in impersonation and account access through reused passwords, rather than in direct use of card details, since no card details were held on either site.
Nojima describes the leaked passwords as encrypted, but the sources checked do not state the encryption method. No specific hashing method is claimed in this article, and no claim is made that the passwords are safe, because the method, and therefore the practical difficulty of recovering a password from the leaked value, is undisclosed.
Suspension and notification to authorities
After the leak was found, Nojima stated that it blocked outside access and strengthened security measures and monitoring for the affected systems. Both affected sites were temporarily suspended, and Nojima stated that reopening would be announced on the sites themselves once safety is confirmed. No restart date was given in the sources checked, so this article gives no date for the return of either site. The suspension covers the full public operation of both sites, not a single page or a single function, and the public record at the time of writing contains no separate reopening notice.
Nojima also stated that it consulted the local police about the incident and that it is preparing a report to Japan's Personal Information Protection Commission and other bodies, to be submitted promptly. The 2 November notice presents the police consultation as completed and the commission report as in preparation, and those two states are kept distinct in this article. Nojima stated that it would continue investigating the scope and the cause of the incident and would publish further information promptly when new information became available. The customer centre contact given in the notice is 0120-574-853, open from 9:30 to 19:00 Japan time, with an online form also provided.
Measures for members
The measures in this section are the measures stated by Nojima and the standard published guidance for a leak of this type, described in the third person and attributed to those sources. The forced password reset is the measure with a date in the public record. On 3 November 2026, Nojima forcibly reset the login passwords of customers suspected to be affected, with customer account safety stated as the top priority. The reset is completed through the official password reset page, using the registered email address and phone number, with a reset link sent to that email address. Nojima also asked members to choose a password that is hard to guess and not to reuse a password used on another service, and the reset applies to the Nojima account only, not to any other service where the same password was used.
Password reuse is the second measure, and it follows from the leaked password field rather than from a separate Nojima statement about other services. Where the same password was used on another account, the password on that account is exposed by the same logic that exposes the Nojima password, and published guidance treats email accounts and shopping accounts as the priority for a change. Does Changing Your Password Stop Hackers explains that a password change alone does not close every route into an account, including live sessions and recovery methods added by an attacker, so a password change is a step in a wider account check rather than a complete remedy on its own. The third measure is the handling of unexpected messages. Nojima asked customers to be careful with unexpected emails, text messages and phone calls about the incident, and How Phishing Uses Your Leaked Email explains how leaked contact details are used to build messages that match the recipient, the retailer and the timing of a real breach notice. A message about a Nojima delivery, repair, refund or buyback payment is therefore tested by its channel, through the official notice page or the customer centre, rather than by its wording alone. Members who are unsure whether a message is genuine can contact the Nojima Customer Centre on 0120-574-853, and an address that appears in other known leaks can be checked through Have I Been Pwned.
A Nojima member address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Matters not yet disclosed
The investigation was not finished in the sources checked, and four matters remain undisclosed in the public record. The attack vector is undisclosed, so this article states no method by which the attacker gained access to the member management system. The encryption method for the leaked passwords is undisclosed, for the reason stated in the callout in the data section, so no assessment of password safety is offered. Misuse of the leaked data is not confirmed, because Nojima stated in its 2 November notice that misuse and secondary damage were under investigation, and no later source checked for this article states a confirmed case of misuse. The de-duplicated number of affected individuals is also undisclosed, because Nojima gives a count of about 7 million records with former members excluded, and gives no count of distinct people behind those records.
Those four gaps define what a follow-up notice would need to contain before this article could be updated with a firmer statement on any of them. A statement of the attack vector would explain the entry point, a statement of the encryption method would allow a practical assessment of the password exposure, a statement on misuse would move the impersonation risk from a warned risk to a confirmed outcome or a confirmed absence, and a de-duplicated count would convert the record figure into a count of affected people. Until Nojima publishes an update covering one or more of those points, the article holds the record figure, the undisclosed method and the under-investigation status exactly as the primary notice states them, without filling any gap with speculation.
Wider context in Japan
Japan Cyber Watch lists more than 50 breaches of a million records or more disclosed in Japan in 2026, which places the Nojima incident inside a wider autumn 2026 sequence of large Japanese disclosures rather than as an isolated case. The Nojima case stands out inside that sequence on two stated facts: the leak is confirmed, not only possible, and the data set is a full identity set without card data, because Nojima states that no payment data was held on either affected site. The primary sources for the Nojima facts in this article are the company notice dated 2 November 2026 and the Nojima Online notice page updated on 3 November 2026, and later updates to either source would be the correct basis for a follow-up article.
Top comments (0)