---
title: "@cosme member-data incident"
description: "istyle reported an @cosme breach affecting approximately three million members, including contact details, birth dates and beauty-profile information."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-03"
canonical_url: "https://www.ally.security/incidents/cosme-member-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/cosme-member-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/cosme-member-data-incident-2026/stix.json"
---

# @cosme member-data incident

istyle confirmed on October 28 that unauthorized access to @cosme had leaked member information.

Last modified Nov 3, 2026 · 1 source

## Summary

- **Environment:** @cosme Common ID member information
- **Operational impact:** Approximately three million members affected
- **Financial impact:** No incident cost disclosed

## What happened

[istyle](https://www.istyle.co.jp/) confirmed on October 28 that unauthorized access to @cosme had leaked member information. [1](#source-1)

## Impact

Approximately three million people were affected, including some former members who held accounts at the time of access. [1](#source-1)

Exposed fields included assigned user IDs, nicknames, names, addresses, phone numbers, email addresses, gender, birth dates, skin type and hair type. [1](#source-1)

istyle said login passwords and credit-card information were excluded and it had not confirmed resulting misuse as of November 2. [1](#source-1)

## Timeline

### October 28, 2026 — Leak confirmed

Leak confirmed, as described in the [company notice](https://www.istyle.co.jp/news/info/2026/11/1102.html). [1](#source-1)

### November 2, 2026 — Member impact disclosed

Member impact disclosed, as described in the [company notice](https://www.istyle.co.jp/news/info/2026/11/1102.html). [1](#source-1)

### November 3, 2026 — Briefing updated

This briefing was last reviewed and updated on November 3, 2026.

## Threat Group & Attack Vector

The reviewed notice does not establish the initial access method.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

The company engaged an outside security firm, reported to Japan’s [Personal Information Protection Commission](https://www.ppc.go.jp/en/) and planned to finish individual notifications by November 6. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/cosme-member-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Apology and notice regarding personal information leakage through unauthorized access

official · istyle · Nov 2, 2026

<https://www.istyle.co.jp/news/info/2026/11/1102.html>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Affected Organization · 100% confidence · current**  
   @cosme member-data breach: istyle
2. **Disclosed At · 100% confidence · current**  
   @cosme member-data breach: 2026-11-02
3. **Discovered At · 100% confidence · current**  
   @cosme member-data breach: 2026-10-28
4. **Resulted In · 100% confidence · current**  
   @cosme member-data breach: Approximately three million people were affected, including some former members who held accounts at the time of access.
5. **Resulted In · 100% confidence · current**  
   @cosme member-data breach: Member impact disclosed
6. **Resulted In · 100% confidence · current**  
   @cosme member-data breach: istyle confirmed on October 28 that unauthorized access to @cosme had leaked member information.
7. **Resulted In · 100% confidence · current**  
   @cosme member-data breach: Exposed fields included assigned user IDs, nicknames, names, addresses, phone numbers, email addresses, gender, birth dates, skin type and hair type.
8. **Resulted In · 100% confidence · current**  
   @cosme member-data breach: istyle said login passwords and credit-card information were excluded and it had not confirmed resulting misuse as of November 2.
9. **Resulted In · 100% confidence · current**  
   @cosme member-data breach: The company engaged an outside security firm, reported to Japan’s Personal Information Protection Commission and planned to finish individual notifications by November 6.
10. **Resulted In · 100% confidence · current**  
   @cosme member-data breach: Leak confirmed
11. **Occurred At · 100% confidence · current**  
   Leak confirmed: 2026-10-28
12. **Occurred At · 100% confidence · current**  
   Member impact disclosed: 2026-11-02

</details>