Incident Briefingsand ST HD business-server data incident

and ST HD business-server data incident

Unauthorized access to business servers led to possible data extraction and temporary limits on member-point use.

Last modified

Summary

  • Environment: Business servers holding customer, business-partner and employee information
  • Operational impact: Possible data leakage; stores and webstore available with member-point use restricted
  • Financial impact: No incident cost established in the reviewed evidence
  • Record status: Developing record. Reviewed October 24, 2026; updated as evidence emerges.

What happened

and ST HD reported unauthorized access and data extraction activity affecting multiple business servers on October 22, 2026. The company detected the activity at about 10:00 Japan Standard Time, isolated the affected systems and said it blocked the entry route by 17:00. [1]

Impact

The October 23 notice described approximately 2.5 million customer records and approximately 10,000 business-partner records as potentially leaked. These are record estimates, not a confirmed count of distinct people; employee-information exposure remained under investigation. [1]

Potential customer fields included names, dates of birth, gender, addresses, telephone numbers, email addresses and member IDs. Business-partner information included company and contact details and order or return contact information. The company said payment information, including credit-card data, and customer-set passwords were excluded. [1]

Stores and the webstore remained usable, while member-point use was unavailable. The company said the webstore itself had not been intruded upon. [1]

Timeline

  1. Server access detected and isolated

    The notice dates login attempts, intrusion and data extraction to around 07:30 JST, detection and isolation to around 10:00, and blocking of the entry route to 17:00.

    [1]

  2. Notice and regulatory reporting

    The company disclosed the incident, reported it to police and the Personal Information Protection Commission, and began notifications.

    [1]

  3. Briefing updated

    This briefing was last reviewed and updated on October 24, 2026.

Threat Group & Attack Vector

The notice describes unauthorized login attempts, server intrusion and data extraction. It does not establish an initial-access vulnerability or an attacker identity. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

and ST HD isolated affected servers, blocked the identified entry route and continued investigating the scope. It began contacting affected customers and business partners. The employee-information scope and financial impact remained under review. [1]