Teollimi

Lawson (Lawson ID) data breach

Was I affected?

Lawson (Lawson ID) confirmed a breach affecting about 2.2 million people, exposing names, dates of birth, phone numbers and addresses. You may be affected if you have a Lawson ID used with the Lawson app or Lawson services in Japan, or placed a seasonal pre-order through the Lawson app.

Lawson (Lawson ID) breach facts
AnnouncedOct 8, 2026
When it happenedSeptember 12–14, 2026 (Lawson ID); September 17, 2026 (app reservations)
CountryJapan
People affected2.2 million
Data exposedNames, Dates of birth, Phone numbers, Addresses, Payment card numbers and Other details
StatusConfirmed by the company or a regulator filing

What happened

Convenience store chain Lawson said on October 8, 2026 that an investigation on October 7 found outsiders had accessed its Lawson ID account service between September 12 and 14, and its in-app seasonal pre-order service on September 17. Data for 2,155,345 Lawson ID accounts leaked: names, plus gender, phone numbers and addresses where members had entered them (for example to enter giveaways). In an October 24 correction, Lawson said email addresses and newsletter settings were not leaked after all, but dates of birth may have been. Separately, names, phone numbers and partial card numbers for 26 app pre-order users leaked; Lawson says a security mechanism meant to show users their own information was abused.

What should I do?

  1. Treat calls and texts that use your name or address and claim to be from Lawson as suspect, and don't give out card numbers or passwords.
  2. Update the Lawson app before using it again, as Lawson requires after the incident.
  3. If you made an app pre-order around September 17, 2026, check your card statement for charges you don't recognize.
  4. Use Lawson's official notice page for contact details rather than links in messages.
XRedditWhatsApp

More data breaches in Japan →

Check the other services you use →

Sources