Rohto Pharmaceutical data breach
Was I affected?
Rohto Pharmaceutical confirmed a breach affecting about 2.8 million people, exposing names, addresses, phone numbers and payment card numbers. You may be affected if you bought from Rohto's mail-order service in Japan; card holders whose numbers were in call recordings are being contacted individually.
| Announced | Nov 6, 2026 |
|---|---|
| When it happened | Reported by its phone system provider on September 10, 2026 |
| Country | Japan |
| People affected | 2.8 million |
| Data exposed | Names, Addresses, Phone numbers, Payment card numbers and Other details |
| Status | Confirmed by the company or a regulator filing |
What happened
Rohto Pharmaceutical, the Japanese maker of eye drops and skincare, said on November 6, 2026 that an outsider used stolen account details for the phone system of its mail-order business and, through it, took data from its customer management systems. Names, addresses and phone numbers of 2,797,545 customers were taken. Recordings of mail-order phone calls from September 2025 to September 2026 were also taken, and for 9,715 customers those recordings include credit card numbers and expiry dates; security codes were not collected. The company first disclosed the intrusion in September and reported it to police and Japan's Personal Information Protection Commission.
What should I do?
- If Rohto tells you your card number was in a call recording, check your statements from September 2026 onward and ask your card issuer for a new card; Rohto says it has asked issuers not to charge for reissuing.
- Be wary of calls, emails, texts or letters claiming to be from Rohto or its mail-order service, and don't give PINs, passwords or card details in reply.
- Expect scam calls that know your name, address and past orders; hang up and call Rohto's dedicated line (0120-610-654) if unsure.
- Report any unfamiliar card charges to the number on the back of your card right away.
Check the other services you use →
Sources
- 不正アクセスによるお客様の個人データ漏えいに関するお詫びとお知らせ (Notice on customer data leak caused by unauthorized access) · Rohto Pharmaceutical (in Japanese) · official
- ロート製薬 不正アクセスで約280万人分の個人情報漏えい · NHK (in Japanese) · news
- ロート製薬、顧客情報279万件漏えい＝通話データ、クレカ番号も · Jiji Press (Jiji Medical) (in Japanese) · news