Breach · · 3 min read
@cosme says details of about 3 million members leaked, including addresses, birth dates and skin type
istyle, the company behind Japan’s @cosme beauty site, says an intruder took names, addresses, phone numbers, emails, birth dates and skin and hair type. Passwords and cards weren’t included.
istyle, the company that runs @cosme, Japan’s large beauty review and shopping site, said on November 2, 2026 that member information had leaked after someone got into @cosme without permission. About 3 million people are affected. If you have an @cosme ID, including one you’ve since closed, here’s what the company has said.
What happened
According to istyle’s notice (in Japanese), it confirmed on October 28 that part of the member information registered to @cosme IDs had leaked to an outside party. The information that leaked is:
- user ID (assigned automatically at sign-up and not used to log in)
- nickname
- name, in kanji and katakana
- postal code and home address
- phone number
- email address
- gender
- date of birth
- skin type and hair type
istyle says it has confirmed that login passwords and credit card details aren’t included. People who have closed their accounts are included if they were members at the time of the break-in. The company says it will use the details it keeps for a period after an account is closed to contact them.
It hasn’t said when the break-in happened or how the intruder got in, ITmedia reported (in Japanese). istyle is investigating with an outside security firm, has reported the incident to Japan’s Personal Information Protection Commission and says it hasn’t found any misuse of the information so far.
Emails from @cosme this week
istyle says it is emailing everyone affected, one by one, and expects to finish by Friday, November 6. Its emails come from the cosme.net domain, and it says they will never ask you to enter a password or card details. It also warns that scammers may send fake emails, texts or calls about the leak.
What this means for you
Your name, address, phone number, email and birth date together are enough for a scammer to sound convincing. Your skin and hair type adds a personal touch: a fake “free sample” or “member gift” offer that seems made for you is a likely lure. Since passwords and cards weren’t included, there’s nothing to change in your @cosme account just because of this leak.
What you can do
- Check that any email about this comes from cosme.net, and still don’t sign in or pay through a link in it. Open the @cosme site or app yourself instead.
- Be wary of beauty offers, free samples and prize notices that know your name or skin type, especially ones asking for a delivery fee or card number.
- Never give out passwords, card numbers or verification codes to someone who contacts you about this.
- Ask istyle directly if you have questions, at its dedicated address, security-support@cosme.net (weekdays, 10 a.m. to 6 p.m. Japan time).
- Learn the patterns. See how scammers use leaked data.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each shopping site its own address, so one leak doesn’t reach everything. Frame never collects or stores the leaked records themselves.
Sources
- istyle, 不正アクセスによる個人情報漏えいに関するお詫びとお知らせについて (in Japanese), November 2, 2026
- @cosme Shopping, 不正アクセスによる個人情報漏えいに関するお詫びとお知らせについて (in Japanese), November 2, 2026
- ITmedia NEWS, アットコスメ、会員約300万人分の情報漏えい 不正アクセスで (in Japanese), November 2, 2026
- NHK, 「アットコスメ」不正アクセス 約300万人分漏えい 肌質 髪質も (in Japanese), November 2, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.