Summary
- Environment: Online-shop and used-smartphone buyback member system
- Operational impact: About seven million member records reported exposed
- Financial impact: No incident cost publicly quantified
- Record status: Developing record. Reviewed November 5, 2026; updated as evidence emerges.
What happened
Impact
The notice reports about seven million records, excluding former members. Fields include names, birth dates, gender, addresses, phones, login IDs, encrypted passwords and email addresses. [2]
Nojima said the two sites did not retain card information. Its November 4 FAQ excludes in-store Nojima Mobile membership data. [1]
Timeline
Unauthorized access and leakage detected
Unauthorized access and leakage detected, as described in the incident notice.
[2]Initial notice issued
Initial notice issued, as described in the incident notice.
[2]FAQ clarified excluded store-member data
FAQ clarified excluded store-member data, as described in the incident notice.
[1]Briefing updated
This briefing was last reviewed and updated on November 5, 2026.
Threat Group & Attack Vector
The reviewed notice does not establish the initial access method.
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
Nojima restricted external access, consulted police, prepared regulator reports and temporarily suspended the affected sites. [2]
The updated notice says passwords were forcibly reset for customers suspected of exposure; it does not establish that all services or individual notifications were complete. [1]