Edion data breach
Was I affected?
Edion confirmed a breach affecting about 13,685 people, exposing names, email addresses, phone numbers and dates of birth. You may be affected if you shop on Edion's online store, especially if you typed a new card into the checkout on a computer from the evening of November 4, 2026 until the store closed on November 7; Edion is emailing the 1,141 customers whose passwords were exposed.
| Announced | Nov 6, 2026 |
|---|---|
| When it happened | Intrusion confirmed around 6:30 p.m. on November 5, 2026; a malicious script ran on the PC checkout page from just after 7 p.m. on November 4, 2026 |
| Country | Japan |
| People affected | 13,685 |
| Data exposed | Names, Email addresses, Phone numbers, Dates of birth, Addresses, Payment card numbers, Passwords and Other details |
| Status | Confirmed by the company or a regulator filing |
What happened
Edion, one of Japan's largest electronics retailers, said on November 6, 2026 that attackers exploited a vulnerability to reach a server area holding log files for its online store, and that personal data in those logs may have leaked. The logs tied names (with phonetic reading), email addresses, phone numbers, dates of birth, gender, addresses and customer numbers to up to 4,131 customers, and order data that could be matched to other details for up to 9,554 customers; Edion says the combined figure of 13,685 counts some people twice, so the real number is lower. In a second notice dated November 9, it said the logs also held full card details from up to 5 failed orders, the numbers and PINs of 5,360 Edion gift cards, and login IDs and passwords for up to 1,141 customers. It also found that attackers had planted a malicious program in the PC checkout page from just after 7 p.m. on November 4, which may have sent card numbers, expiry dates, cardholder names and security codes entered up to 556 times directly to a third party; smartphone checkouts were not affected. Edion shut its online store at 10 p.m. on November 7, asked card companies to step up fraud monitoring and has reported the breach to Japan's Personal Information Protection Commission.
What should I do?
- If you entered a new card on Edion's online store from a computer on or after November 4, 2026, check your card statements for charges you don't recognize and call the number on the back of your card if you see any; consider asking for a replacement card.
- If Edion emails you about a password change, change your Edion password once the store reopens, and change it anywhere else you used the same password.
- Be wary of emails, texts and calls that claim to be from Edion or mention your orders; don't open links or attachments in them, and contact Edion's customer center (0120-77-0095) through its official website if in doubt.
- If you hold an Edion gift card, wait for Edion's notice on how exposed cards will be handled, and don't share the card number or PIN with anyone who contacts you.
How Korea fines a breach this size
For comparison, Korea's privacy regulator fined Tiffany Korea ₩2.4 billion (about US$1.6M) in February 2026 over a breach of 4,600 people. Korean law fines the security failure itself, not only misuse of the data.
Check the other services you use →
Sources
- 当社ECサイトへの不正アクセスによる個人情報漏洩の可能性に関するお詫びとお知らせ (Notice on a possible personal data leak caused by unauthorized access to our online store) · Edion (in Japanese) · official
- 当社ECサイトにおける新たに判明した事象と個人情報漏洩の可能性、およびサービス停止に関するお詫びとお知らせ（第２報） (Second notice: newly found issues, possible data leak and service suspension) · Edion (in Japanese) · official
- エディオン顧客情報1万3685人分漏洩か クレカ情報も、ECサイト停止 · Nikkei (in Japanese) · news
- エディオン、クレカ情報流出か · Jiji Press (in Japanese) · news