---
title: "U.S.M.H. Scan&Go ignica intrusion"
description: "U.S.M.H. confirmed unauthorized access to Scan&Go ignica and possible exposure of names and email addresses for 64,003 accounts."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-13"
canonical_url: "https://www.ally.security/incidents/usmh-scan-go-ignica-intrusion-2026"
markdown_url: "https://www.ally.security/incidents/usmh-scan-go-ignica-intrusion-2026.md"
stix_url: "https://www.ally.security/incidents/usmh-scan-go-ignica-intrusion-2026/stix.json"
---

# U.S.M.H. Scan&Go ignica intrusion

U.S.M.H. confirmed unauthorized access to Scan&Go ignica and possible exposure of names and email addresses for 64,003 accounts.

Last modified Nov 13, 2026 · 1 source

## Summary

- **Environment:** Scan&Go ignica system
- **Operational impact:** Unauthorized access confirmed; data acquisition unconfirmed
- **Financial impact:** No confirmed incident cost quantified

## What happened

[United Super Markets Holdings](https://www.usmh.co.jp/) confirmed unauthorized access to its Scan\&Go ignica system. A file containing customer information was present, but actual external acquisition or leakage had not been confirmed. [1](#source-1)

## Impact

The potentially affected file contained names and email addresses for **64,003 accounts**, not a verified count of unique people. Card details, addresses, telephone numbers and birth dates were excluded from that file. [1](#source-1)

## Timeline

### November 12, 2026 — Possible account-data exposure disclosed

The [company notice](https://www.usmh.co.jp/wp-content/uploads/2026/11/us_20261112.pdf) distinguished confirmed access from possible leakage. [1](#source-1)

### November 13, 2026 — Briefing updated

This briefing was last reviewed and updated on November 13, 2026.

## Threat Group & Attack Vector

The notice does not establish an entry method, attacker identity or attack dates.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific ATT\&CK technique is mapped from the available evidence.

## Response

U.S.M.H. took measures to prevent further access and continued investigating. It planned email and app-login notices for affected users and had not confirmed associated misuse or secondary harm. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/usmh-scan-go-ignica-intrusion-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### U.S.M.H. Scan&Go ignica unauthorized-access notice

official · United Super Markets Holdings Inc. · Nov 12, 2026

<https://www.usmh.co.jp/wp-content/uploads/2026/11/us_20261112.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   U.S.M.H. Scan&Go ignica intrusion: U.S.M.H. confirmed unauthorized access to Scan&Go ignica systems containing a file of customer personal information. Actual external acquisition or leakage had not been confirmed.
2. **Resulted In · 100% confidence · current**  
   U.S.M.H. Scan&Go ignica intrusion: Intrusion and possible account-data exposure disclosed
3. **Occurred At · 100% confidence · current**  
   Intrusion and possible account-data exposure disclosed: 2026-11-12
4. **Disclosed At · 100% confidence · current**  
   U.S.M.H. Scan&Go ignica intrusion: 2026-11-12
5. **Affected Organization · 100% confidence · current**  
   U.S.M.H. Scan&Go ignica intrusion: United Super Markets Holdings Inc.
6. **Resulted In · 100% confidence · current**  
   U.S.M.H. Scan&Go ignica intrusion: The potentially affected file covered64003 accounts out of approximately 2.4 million app accounts, containing names and email addresses. This is an account count, not a unique-person count.
7. **Resulted In · 100% confidence · current**  
   U.S.M.H. Scan&Go ignica intrusion: U.S.M.H. had not confirmed misuse or secondary harm associated with the incident as of November 12.
8. **Resulted In · 100% confidence · current**  
   U.S.M.H. Scan&Go ignica intrusion: Payment-card information, addresses, telephone numbers and dates of birth were not present in the affected file.
9. **Resulted In · 100% confidence · current**  
   U.S.M.H. Scan&Go ignica intrusion: The company was notifying affected users by email and app-login notices. It had taken measures against further unauthorized access and continued investigating cause and scope with relevant parties.

</details>