Shogakukan data breach
Was I affected?
Shogakukan confirmed a breach involving up to 2 million records (duplicates possible), exposing email addresses and dates of birth. Shogakukan ID members and others whose details Shogakukan passed to Arara for its emails, including some people with provisional or no current Shogakukan ID registration.
| Announced | Nov 6, 2026 |
|---|---|
| When it happened | Intrusion at email vendor Arara; Arara told Shogakukan on November 2, 2026 and confirmed on November 5 that leaked files contained Shogakukan's member data |
| Country | Japan |
| Records exposed (may include duplicates) | 2 million |
| Data exposed | Email addresses, Dates of birth and Other details |
| Through a vendor | Arara (email delivery service) |
| Status | Confirmed by the company or a regulator filing |
What happened
Japanese publisher Shogakukan said on November 6, 2026 that part of the member data for Shogakukan ID and its other services leaked after an outsider broke into the email delivery system of Arara, the company it used to send emails. Shogakukan puts the leak at 1,993,665 records containing email addresses, birth dates, gender, nicknames and similar details; the records may include people with provisional Shogakukan ID registrations and people who are not current members. Card data was not held in Arara's service and was not leaked. Shogakukan stopped sending member data to the system on October 28 and says no resulting harm had been confirmed.
What should I do?
- Be wary of emails claiming to come from Shogakukan, Arara or a card company, and don't open links or attachments you weren't expecting.
- Shogakukan says it will never email you asking for passwords or card details; delete any message that does without replying.
- If you reuse your Shogakukan ID password on other sites, change it there to be safe.
- Consider tightening spam filtering on the email address you registered if scam emails increase.
How Korea fines a breach this size
For comparison, Korea's privacy regulator fined Dior Korea ₩12.2 billion (about US$8M) in February 2026 over a breach of 1.95 million people. Korean law fines the security failure itself, not only misuse of the data.
Other Shogakukan breaches: Nov 9, 2026
Check the other services you use →
Sources
- 弊社が委託する外部メール配信サービス会社「アララ社」への不正アクセスによる個人情報漏えいのおそれに関するお詫びとお知らせ (Apology and notice about a possible personal data leak caused by unauthorized access at email delivery vendor Arara) · Shogakukan (in Japanese) · official
- 小学館 会員メールアドレスなど約199万件漏えいおそれ · NHK (in Japanese) · news