---
title: "and ST HD business-server data incident"
description: "and ST HD disclosed possible leakage of about 2.5 million customer records and 10,000 business-partner records."
incident_type: "Data incident"
status: "active"
last_modified: "2026-10-24"
canonical_url: "https://www.ally.security/incidents/and-st-hd-business-server-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/and-st-hd-business-server-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/and-st-hd-business-server-data-incident-2026/stix.json"
---

# and ST HD business-server data incident

Unauthorized access to business servers led to possible data extraction and temporary limits on member-point use.

Last modified Oct 24, 2026 · 1 source

## Summary

- **Environment:** Business servers holding customer, business-partner and employee information
- **Operational impact:** Possible data leakage; stores and webstore available with member-point use restricted
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[and ST HD](https://www.andst-hd.co.jp/) reported unauthorized access and data extraction activity affecting multiple business servers on October 22, 2026. The company detected the activity at about 10:00 Japan Standard Time, isolated the affected systems and said it blocked the entry route by 17:00. [1](#source-1)

## Impact

The [October 23 notice](https://www.andst-hd.co.jp/news/notice/entry-17234/) described approximately 2.5 million customer records and approximately 10,000 business-partner records as potentially leaked. These are record estimates, not a confirmed count of distinct people; employee-information exposure remained under investigation. [1](#source-1)

Potential customer fields included names, dates of birth, gender, addresses, telephone numbers, email addresses and member IDs. Business-partner information included company and contact details and order or return contact information. The company said payment information, including credit-card data, and customer-set passwords were excluded. [1](#source-1)

Stores and the webstore remained usable, while member-point use was unavailable. The company said the webstore itself had not been intruded upon. [1](#source-1)

## Timeline

### October 22, 2026 — Server access detected and isolated

The notice dates login attempts, intrusion and data extraction to around 07:30 JST, detection and isolation to around 10:00, and blocking of the entry route to 17:00. [1](#source-1)

### October 23, 2026 — Notice and regulatory reporting

The company [disclosed the incident](https://www.andst-hd.co.jp/news/notice/entry-17234/), reported it to police and the Personal Information Protection Commission, and began notifications. [1](#source-1)

### October 24, 2026 — Briefing updated

This briefing was last reviewed and updated on October 24, 2026.

## Threat Group & Attack Vector

The notice describes unauthorized login attempts, server intrusion and data extraction. It does not establish an initial-access vulnerability or an attacker identity. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

and ST HD isolated affected servers, blocked the identified entry route and continued investigating the scope. It began contacting affected customers and business partners. The employee-information scope and financial impact remained under review. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/and-st-hd-business-server-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### 当社業務サーバーへの不正アクセスの発生および個人情報等流出の可能性に関するお詫びとお知らせ

official · and ST HD · Oct 23, 2026

<https://www.andst-hd.co.jp/news/notice/entry-17234/>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   and ST HD business-server data incident: and ST HD reported login attempts, intrusions and data extraction across multiple business servers beginning around 07:30 on October 22; it detected unauthorized operations around 10:00, isolated servers and blocked the access route by 17:00, all Japan time.
2. **Disclosed At · 100% confidence · current**  
   and ST HD business-server data incident: 2026-10-23
3. **Resulted In · 100% confidence · current**  
   and ST HD business-server data incident: Customer fields included names, birth dates, gender, addresses, phone numbers, email addresses and membership IDs; partner data included company/contact names, order or return addresses, phone numbers and email addresses.
4. **Occurred At · 100% confidence · current**  
   Potential exposure disclosed and authorities notified: 2026-10-23
5. **Resulted In · 100% confidence · current**  
   and ST HD business-server data incident: The company said payment information such as credit-card details and customer-set passwords were not included in the potentially exposed data.
6. **Resulted In · 100% confidence · current**  
   and ST HD business-server data incident: Stores and the and ST web store remained usable, but membership points could not be used. The company said the web store itself was not affected by the intrusion.
7. **Affected Organization · 100% confidence · current**  
   and ST HD business-server data incident: and ST HD Co., Ltd.
8. **Began At · 100% confidence · current**  
   and ST HD business-server data incident: 2026-10-22
9. **Exposed Record Count · 100% confidence · current**  
   and ST HD business-server data incident: 2,500,000 record
10. **Resulted In · 100% confidence · current**  
   and ST HD business-server data incident: Server intrusion detected and access blocked
11. **Resulted In · 100% confidence · current**  
   and ST HD business-server data incident: The company consulted police and reported to Japan’s Personal Information Protection Commission on October 23, began notifications and continued investigating financial impact.
12. **Resulted In · 100% confidence · current**  
   and ST HD business-server data incident: Potential exposure disclosed and authorities notified
13. **Occurred At · 100% confidence · current**  
   Server intrusion detected and access blocked: 2026-10-22
14. **Resulted In · 100% confidence · current**  
   and ST HD business-server data incident: Potentially leaked information covered about 2.5 million customer records and about 10,000 business-partner records; employee scope was still being checked.
15. **Discovered At · 100% confidence · current**  
   and ST HD business-server data incident: 2026-10-22

</details>