Joshin Data Breach: What Happened and What to Do

In short: Japanese electronics retailer Joshin detected unauthorized access to its systems on October 16, 2026, and, according to a follow-up report covered by Internet Watch, later said up to roughly 6 million pieces of member data may have been exposed, after first disclosing the intrusion in its October 17 notice. Joshin has not confirmed exactly who was affected or who carried out the intrusion, so affected customers should watch for phishing and change reused passwords now.

Joshin runs an electronics store chain in Japan plus a subscription service and a reform (home-renovation) photo-upload tool. The exposure spans all three systems, each with its own type of customer information.

What happened in the Joshin breach?

Joshin says it detected unauthorized access to its systems on October 16, 2026, and restricted external network access in response, which knocked some services offline. The company announced the incident publicly the next day. As teiss reported, "Joshin, a Japanese consumer electronics retailer operating the Joshin store chain, restricted external network access after detecting unauthorized access by a third party on Oct. 16, resulting in the suspension of some services." Joshin's own notice says it is working with outside cybersecurity specialists to establish the scope of the intrusion, and has filed an initial report with Japan's Personal Information Protection Commission because it cannot rule out a leak of personal data.

What data was exposed in the Joshin breach?

In a second report dated October 26, Joshin said up to roughly 6 million records may have leaked from its member database server, covering names, addresses, phone numbers and member numbers. According to Internet Watch's coverage of that report, the breakdown Joshin gave was: "会員情報データベースサーバー 最大約600万件（氏名、住所、電話番号、会員番号）" — the member database, up to about 6 million records. A separate subscription service, Joshin no Subsc, may have exposed up to about 230,000 records including member numbers, phone numbers paired with handwritten signatures, login IDs and initial passwords, billing history, and contract or device identifiers. A reform-photo upload tool may have exposed a much smaller set — up to about 800 records — including two driver's license images, one My Number card image, five bank account numbers, and renovation work photos. Joshin describes all of these as ceilings on possible exposure, not confirmed final counts.

How do I know if I was affected?

Joshin has not published a way to check individual exposure, and it has not said how many actual people — as opposed to records — were involved. If you have ever created a Joshin membership account, used Joshin no Subsc, or uploaded photos through the reform system, your information could be among the data Joshin says may have leaked. As teiss noted, as of its October 19 report Joshin "has not disclosed which services remain unavailable or what types of information may have been compromised" beyond what it has since detailed in the October 26 update.

What should I do right now if I'm a Joshin customer?

1. Watch for phishing emails, texts, or calls that reference your name, address, phone number, or Joshin membership details — scammers can use exposed data to make fake messages look convincing. See our guide on how to spot phishing after a data breach.
2. Change your Joshin account password now, especially if you used Joshin no Subsc, where login IDs and initial passwords may have been exposed.
3. Change the password anywhere else you reused the same Joshin password or security questions.
4. If you used the reform-photo upload system, watch your bank account tied to any account number you submitted there, since up to five account numbers may have been exposed.
5. Don't click links in unexpected messages claiming to be from Joshin asking you to verify account details. General security guidance from Denmark's digital-safety agency applies here too: never hand login details, one-time codes, passwords, or card numbers to anyone who contacts you out of the blue.
6. If you submitted a driver's license or My Number card image through the reform system, watch for identity-related fraud attempts in the coming months and report anything suspicious promptly.

What is not yet known about the Joshin breach?

Several key facts remain unconfirmed. Joshin's own notice does not name who carried out the intrusion or their motive, and the company has not said how many individual people — as opposed to records — were affected. The roughly 6 million figure is described as a ceiling for possible exposure, not a settled total. Joshin says it will post confirmed facts to its website as the investigation with outside specialists progresses.