Japan: BOOKOFF member system hacked, over 6.3 million user records leaked
Japanese second-hand goods chain BOOKOFF confirmed a data breach affecting over 6.3 million users. The intrusion occurred in October 2026, potentially exposing personal and account information.
Japanese second-hand goods retailer BOOKOFF has confirmed a significant data breach impacting its customer membership system. The company announced on October 13, 2026, that unauthorized access by a third party led to the exposure of over 6.4 million user data records.
The breach was detected on October 4, 2026, and involved user accounts registered through BOOKOFF's official app, online store, and website. The incident affected approximately 6.38 million individuals, including data from 212,000 previously deregistered users.
Potentially compromised information includes names, dates of birth, gender, email addresses, phone numbers, postal addresses, loyalty card numbers, membership IDs, and hashed passwords. BOOKOFF stated that users with only a physical membership card who were not digitally registered are not affected.
BOOKOFF is in the process of notifying affected members via email and urges them to change their passwords for the app and online store, as well as any other services where similar passwords may have been used. The company also cautioned users to be vigilant against phishing attempts that may arise from the data leak.