On 2 November 2026, istyle, which runs the cosmetics review and shopping site @cosme, announced that a third party had broken into @cosme and taken part of the member data registered to the @cosme common ID. The company confirmed the leak on 28 October. About 3 million people are affected, including people who have since left the service if they were members when the intrusion happened.
Data that leaked: user ID, nickname, full name (kanji and kana), postal code, address, phone number, email address, gender, date of birth, and skin type and hair type. istyle says the user ID is assigned automatically and isn't used to log in. As far as it has confirmed, login passwords and credit card details were not leaked.
What is still unknown: istyle hasn't said how the attackers got in or when the intrusion took place. An outside security firm is investigating the cause and scope, and istyle has reported the incident to Japan's Personal Information Protection Commission. As of the announcement, the company says it has not confirmed any misuse or secondary harm.
Notifications: istyle is contacting affected people one by one and expects to finish by 6 November. Its emails come from the cosme.net domain and never ask for passwords or card numbers. The company warns that spoofed emails, SMS messages and phone calls may follow. On 23 October istyle had separately disclosed unauthorised access to Cuenote FC, an outside email delivery system it uses. No link between the two incidents has been announced.
