Summary
- Environment: PickGo delivery processing for 7NOW
- Operational impact: Customer delivery records obtained; 7NOW remained operational
- Financial impact: No incident cost publicly quantified
- Record status: Developing record. Reviewed November 5, 2026; updated as evidence emerges.
What happened
Seven-Eleven Japan said unauthorized access to its delivery contractor CBcloud’s PickGo service exposed some 7NOW customer information. [1]
Impact
The notice lists 164,180 records with kana names, 4,762 with names and addresses, and 209 with those fields plus phone numbers and postal codes. Some order details were also obtained. [1]
Seven-Eleven Japan said card information, IDs and passwords were not exposed, and 7NOW continued operating normally. [1]
Timeline
CBcloud identified unauthorized access
CBcloud identified unauthorized access, as described in the incident notice.
[1]7NOW data acquisition confirmed and disclosed
7NOW data acquisition confirmed and disclosed, as described in the incident notice.
[1]Briefing updated
This briefing was last reviewed and updated on November 5, 2026.
Threat Group & Attack Vector
The reviewed notice does not establish the initial access method.
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
CBcloud identified unauthorized access November 1 and confirmed 7NOW data acquisition November 3. It blocked connections, suspended abused accounts and fixed the exploited defect. [1]
The incident was reported to Japan’s Personal Information Protection Commission, and affected customers were to receive SMS notices. [1]