Incident Briefings@cosme member-data incident

@cosme member-data incident

istyle confirmed on October 28 that unauthorized access to @cosme had leaked member information.

Last modified

Summary

  • Environment: @cosme Common ID member information
  • Operational impact: Approximately three million members affected
  • Financial impact: No incident cost disclosed
  • Record status: Developing record. Reviewed November 3, 2026; updated as evidence emerges.

What happened

istyle confirmed on October 28 that unauthorized access to @cosme had leaked member information. [1]

Impact

Approximately three million people were affected, including some former members who held accounts at the time of access. [1]

Exposed fields included assigned user IDs, nicknames, names, addresses, phone numbers, email addresses, gender, birth dates, skin type and hair type. [1]

istyle said login passwords and credit-card information were excluded and it had not confirmed resulting misuse as of November 2. [1]

Timeline

  1. Leak confirmed

    Leak confirmed, as described in the company notice.

    [1]

  2. Member impact disclosed

    Member impact disclosed, as described in the company notice.

    [1]

  3. Briefing updated

    This briefing was last reviewed and updated on November 3, 2026.

Threat Group & Attack Vector

The reviewed notice does not establish the initial access method.

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

The company engaged an outside security firm, reported to Japan’s Personal Information Protection Commission and planned to finish individual notifications by November 6. [1]