---
title: "Nojima Online member-data incident"
description: "Nojima detected unauthorized access and confirmed member-data leakage on November 1 from its online shop and used-smartphone buyback site."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-05"
canonical_url: "https://www.ally.security/incidents/nojima-online-member-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/nojima-online-member-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/nojima-online-member-data-incident-2026/stix.json"
---

# Nojima Online member-data incident

Nojima detected unauthorized access and confirmed member-data leakage on November 1 from its online shop and used-smartphone buyback site.

Last modified Nov 5, 2026 · 2 sources

## Summary

- **Environment:** Online-shop and used-smartphone buyback member system
- **Operational impact:** About seven million member records reported exposed
- **Financial impact:** No incident cost publicly quantified

## What happened

[Nojima](https://www.nojima.co.jp/) detected unauthorized access and confirmed member-data leakage on November 1 from its online shop and used-smartphone buyback site. [2](#source-2)

## Impact

The notice reports about seven million records, excluding former members. Fields include names, birth dates, gender, addresses, phones, login IDs, encrypted passwords and email addresses. [2](#source-2)

Nojima said the two sites did not retain card information. Its November 4 FAQ excludes in-store Nojima Mobile membership data. [1](#source-1)

## Timeline

### November 1, 2026 — Unauthorized access and leakage detected

Unauthorized access and leakage detected, as described in the [incident notice](https://www.nojima.co.jp/wp-content/uploads/2026/11/fa47750556e505f2ddb83dc080a6420f.pdf). [2](#source-2)

### November 2, 2026 — Initial notice issued

Initial notice issued, as described in the [incident notice](https://www.nojima.co.jp/wp-content/uploads/2026/11/fa47750556e505f2ddb83dc080a6420f.pdf). [2](#source-2)

### November 4, 2026 — FAQ clarified excluded store-member data

FAQ clarified excluded store-member data, as described in the [incident notice](https://contents.online.nojima.co.jp/oshirase20261102/). [1](#source-1)

### November 5, 2026 — Briefing updated

This briefing was last reviewed and updated on November 5, 2026.

## Threat Group & Attack Vector

The reviewed notice does not establish the initial access method.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Nojima restricted external access, consulted police, prepared regulator reports and temporarily suspended the affected sites. [2](#source-2)

The updated notice says passwords were forcibly reset for customers suspected of exposure; it does not establish that all services or individual notifications were complete. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/nojima-online-member-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Nojima Online incident FAQ and password reset update

official · Nojima · Nov 4, 2026

<https://contents.online.nojima.co.jp/oshirase20261102/>

<a id="source-2"></a>

### Nojima Online notice of unauthorized access and personal-information leakage

official · Nojima · Nov 2, 2026

<https://www.nojima.co.jp/wp-content/uploads/2026/11/fa47750556e505f2ddb83dc080a6420f.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Occurred At · 100% confidence · current**  
   Initial notice issued: 2026-11-02
2. **Resulted In · 100% confidence · current**  
   Nojima Online member-data breach: The notice reports about seven million records, excluding former members. Fields include names, birth dates, gender, addresses, phones, login IDs, encrypted passwords and email addresses.
3. **Resulted In · 100% confidence · current**  
   Nojima Online member-data breach: Nojima detected unauthorized access and confirmed member-data leakage on November 1 from its online shop and used-smartphone buyback site.
4. **Resulted In · 100% confidence · current**  
   Nojima Online member-data breach: Unauthorized access and leakage detected
5. **Discovered At · 100% confidence · current**  
   Nojima Online member-data breach: 2026-11-01
6. **Resulted In · 100% confidence · current**  
   Nojima Online member-data breach: The updated notice says passwords were forcibly reset for customers suspected of exposure; it does not establish that all services or individual notifications were complete.
7. **Resulted In · 100% confidence · current**  
   Nojima Online member-data breach: FAQ clarified excluded store-member data
8. **Resulted In · 100% confidence · current**  
   Nojima Online member-data breach: Nojima restricted external access, consulted police, prepared regulator reports and temporarily suspended the affected sites.
9. **Occurred At · 100% confidence · current**  
   FAQ clarified excluded store-member data: 2026-11-04
10. **Affected Organization · 100% confidence · current**  
   Nojima Online member-data breach: Nojima
11. **Resulted In · 100% confidence · current**  
   Nojima Online member-data breach: Nojima said the two sites did not retain card information. Its November 4 FAQ excludes in-store Nojima Mobile membership data.
12. **Occurred At · 100% confidence · current**  
   Unauthorized access and leakage detected: 2026-11-01
13. **Disclosed At · 100% confidence · current**  
   Nojima Online member-data breach: 2026-11-02
14. **Resulted In · 100% confidence · current**  
   Nojima Online member-data breach: Initial notice issued

</details>