istyle (@cosme) data breach

istyle (@cosme) announced a data breach on Nov 2, 2026 affecting about 3 million people, exposing names, addresses, phone numbers and email addresses. It is the first of 2 istyle (@cosme) breaches recorded on Teollimi. It was caused by a cyberattack. No settlement or compensation has been announced.

What happened

istyle, operator of Japan's @cosme beauty portal, said on November 2, 2026 that it confirmed on October 28 that a third party had accessed @cosme and leaked part of the member data of about 3 million people registered with the @cosme common ID. The data includes user IDs, nicknames, names, postal codes, addresses, phone numbers, email addresses, gender, dates of birth and skin and hair type; login passwords and card data were not included. istyle has reported to Japan's Personal Information Protection Commission and contacted members, including some who had already left.

What should I do?

1. Be wary of emails, texts and calls claiming to be from @cosme or istyle; they say they will not ask for passwords or card numbers.
2. Expect targeted phishing and parcel or shopping scams that use your name, address and phone number.
3. Check the notice from the cosme.net domain and contact security-support@cosme.net with questions.
4. Change your password if you reuse it elsewhere, as a precaution.

Other istyle (@cosme) breaches: Nov 9, 2026

More data breaches in Japan →

Check the other services you use →