Reported breach

Shiseido data breach

JPJapan · 資生堂

Security NEXT reported a data breach at Shiseido (Japan) on 12 November 2026. It affected 2,515 customers.

People affected: 2,515customers
Reported: 12 November 2026News report

What was exposed 7

Email addresses
Names
Age
Gender
Member ID
Consultation data
Skin measurement results

How it happened

How: Hacking The online skin measurement system "Facial Condition Analyzer (FCA)" used in the skin measurement service provided by the group was breached by an external third party. source
Our translation from Japanese
グループが提供する肌測定サービスで使用されているオンライン肌測定システム「Facial Condition Analyzer（FCA）」が外部の第三者により侵害されたもの。

Sources 1

News reportSecurity NEXTPersonal information and measurement results leaked from skin measurement system - Shiseido (our translation from Japanese)12 November 2026 · 2,515 customers
Archived copy Wayback Machine, 12 November 2026

News reports are read by an AI model; every fact taken from an article was checked word for word against it, and anything it could not find was dropped. · Corrections and changes

If Shiseido had your data

Look for Shiseido’s own notice or letter: it should say what of yours was involved. Keep it.
Your email address is out: expect convincing phishing. Open Shiseido by typing its address yourself, never through a link in an email or text, and check the sender before you reply.
Expect scams that use your details: calls, texts or emails pretending to be Shiseido, your bank or the police. Never give codes or passwords, never approve a sign-in you did not start, never move money.

Use Shiseido? Hear first next time

Breach Radar tells you when a company you use is breached, and what to do. Free, and your list stays on your phone.

Download on the App Store

Questions about the Shiseido breach

Was Shiseido hacked?

Security NEXT reported a data breach at Shiseido (Japan) on 12 November 2026. It affected 2,515 customers. How it happened, by the sources: hacking. It has been reported but not confirmed by Shiseido or an authority.

What data was exposed in the Shiseido breach?

Email addresses, Names, Age, Gender, Member ID, Consultation data and Skin measurement results, by the notices and reports on this page.

How do I know if I was affected?

Organisations normally tell the people whose data was involved, by letter or email, and that notice says what of yours was in it. We cannot look up individual people. If you got a notice, check that it is real, then follow the steps on this page.

Is there a Shiseido data breach settlement?

No settlement open for claims is on record for Shiseido as of 15 November 2026. Every open settlement is listed with its deadline.

Is a letter, email or text about the Shiseido breach real or a scam?

A real notice names the breach, says what data was involved and never asks for a password, a code or a payment. Criminals often send fake notices after a breach is in the news. Do not use links or phone numbers in the message: go to Shiseido’s own site, or check the letter here.

More breaches in Japan

Every breach in Japan →

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.