Bic Camera (with Kojima and Sofmap) data breach

What happened

Japanese electronics retailer Bic Camera and its group chains Kojima and Sofmap said customer data leaked after an intrusion at Arara, the company that sends their marketing emails. Arara found the unauthorized access on October 28, 2026 and told the group on November 2, when it first announced the leak. In a second notice on November 6 the group put the total at 15,204,757 records: 14,218,934 Bic Camera records with email address, name, gender, prefecture, date of birth, point card number and registration date (plus 183 that also include order details), 960,688 Kojima email addresses, 24,895 Sofmap records (almost all email addresses only) and 57 email addresses not yet assigned to a company. Records are counted per company, so the total is higher than the number of people. Card data, phone numbers, home addresses and website passwords were not stored in the email system, and no resulting harm had been confirmed.

What should I do?

1. Be wary of emails claiming to be from Bic Camera, Kojima, Sofmap or Arara, and don't open links or attachments in messages you weren't expecting.
2. The group says it will never ask for card numbers, security codes or login passwords about this incident; don't enter them on pages reached from an email.
3. Expect phishing that uses your name, birthday or point card number to look genuine, and check your point balance in the official app or site rather than through email links.
4. Consider filtering or changing the email address you used for these newsletters if spam or scam emails increase.

More data breaches in Japan →

Check the other services you use →