Security notice
Run an online shop with customer accounts? Euglena says its akyrise shop was broken into and up to about 900,000 records may have leaked.
On November 5, 2026, Euglena Co., Ltd., which runs the cosmetics brand akyrise, said it had confirmed unauthorized access to the akyrise online shop on November 4 and that member information registered there had leaked. It closed the shop the same day it found the access. Euglena says login records for up to about 490,000 accounts, including hashed passwords, and registration and purchase records for up to about 900,000 customers, including former members, may have been exposed. It says it does not keep credit card numbers on the servers it uses, and that card numbers are not included. It has not said how the attacker got in, and it says the exact counts are still being reviewed. This is not a named software flaw, so there is no CVE or patch to install. If you shopped at akyrise, watch for fake messages. If you run an online shop, this is a reminder to know where your customer data lives and how you would tell customers if it leaked. (Euglena, Nov 5)
What happened
- Found and closed on November 4. Euglena says it confirmed unauthorized access to the akyrise online shop on November 4, 2026, closed the shop at once, and later found that member information registered on the shop had leaked. (Euglena, Nov 5)
- Reported on November 5. It published the notice and says it filed a preliminary report with Japan's Personal Information Protection Commission the same day. It says the cause, the exact customers affected, and the exact counts are still under investigation. (Euglena, Nov 5)
- Shop still closed. The company says the shop is temporarily closed for maintenance, and that it plans to reopen after it makes the system changes it needs and confirms the shop is safe. Orders it already has, including ongoing subscription orders, are still being shipped after checks. (Euglena, Nov 5)
- Contacting customers. Euglena says it will email affected customers with details on changing passwords, existing subscription orders, and other steps. It has a dedicated inquiry line at 0120-405-142, open 10 a.m. to 5 p.m. Japan time, Monday to Saturday, closed Sundays and public holidays. (Euglena, Nov 5)
- No misuse confirmed so far. Euglena says it has not confirmed any secondary damage from this incident so far. (Euglena, Nov 5)
What data, akyrise online shop
Euglena's table covers customers who previously bought akyrise products on the akyrise online shop, including people who later closed their accounts. It lists two groups as separate counts and does not give a combined total. Both figures are "up to about" counts that Euglena says are still being reviewed. (Euglena, Nov 5)
- Login account information, up to about 490,000 records: customer ID, email address and login password. Euglena says the passwords were stored hashed.
- Registration and purchase information, up to about 900,000 records: name, address, phone number, date of birth, gender, email address, and purchase and delivery details.
- Card numbers: Euglena says credit card numbers are not kept on the servers it uses, and are not included in either group.
Same notice, separate incidents
The same November 5 notice also describes two other incidents that Euglena says are separate from the shop break-in. They involve services that a contractor used, not the shop itself. (Euglena, Nov 5)
- Email delivery service. Euglena says a contractor told it on November 2 that the email delivery service repica, provided by arara inc., had been broken into, and that 177,063 email addresses of akyrise customers who received newsletters and similar mail through that service had leaked. It says only email addresses were involved, and that this count is confirmed. (Euglena, Nov 5)
- Package tracking service. Euglena says a contractor told it on October 1 that Sagawa Express's package inquiry service had been broken into, and that name, address and phone number for about 5,000 shipments (about 3,000 people) may have leaked. This covers akyrise shop customers, including subscription orders, whose goods were sent by Sagawa Express between June 21 and September 30, 2026. Euglena says Sagawa Express is still investigating who was affected and how many records were involved. For questions about that incident, Euglena points customers to Sagawa Express's dedicated line at 0120-28-3449, open 9 a.m. to 5 p.m., including weekends and public holidays. (Euglena, Nov 5)
Who should worry
- You have an akyrise online shop account, or you previously bought from that shop, including if you later closed the account.
- You received email newsletters from akyrise, or you had goods from that shop sent by Sagawa Express between June 21 and September 30, 2026.
- You run an online shop that keeps customer accounts, or you send customer data to an email or shipping service.
If you never used the akyrise online shop and you do not run a shop with customer data, this notice does not apply to you.
What to do now
If you are an akyrise customer. This follows Euglena's advice.
- Change reused passwords now. If your akyrise shop password is the same as, or similar to, a password you use anywhere else, change the password on those other services at once. (Euglena, Nov 5)
- Watch for fake messages. Euglena says leaked information could be used to send emails, texts, calls or post pretending to be akyrise, Euglena, a delivery company or another partner. Do not open links or attachments in messages you were not expecting, and do not enter personal details, passwords or card details on a site you do not trust. (Euglena, Nov 5)
- Do not hand over passwords, card numbers or money. Euglena says that even if a message or caller claims to be the company or a partner, you should not give a password, card number, payment, money transfer or verification code. It says it will not ask you for those. (Euglena, Nov 5)
- Wait for Euglena's email for next steps on the shop, including how to change your shop password once it reopens, and use the inquiry line above if you see a suspicious message or think you have been harmed. (Euglena, Nov 5)
If you run an online shop. These are general steps, not from Euglena. We are not claiming any tool, including EverThread, would have stopped this attack.
- Know where your customer data lives. Make a list of every system and vendor that holds customer names, addresses, emails, passwords or order details, including email delivery and shipping tools. Euglena's notice covers a break-in at its own shop and, separately, incidents at an email service and a shipping inquiry service that a contractor used. (Euglena, Nov 5)
- Do not keep card numbers you do not need. Euglena says it does not store credit card numbers on the servers it uses, and that card numbers were not included. A lot of other personal data still leaked. Review what your shop, plugins and vendors still keep, and delete what you no longer need. (Euglena, Nov 5)
- Treat hashed passwords as sensitive. Euglena says the leaked login passwords were stored hashed. That is the right way to store them, but customers who reused those passwords on other sites can still be at risk. Ask customers to use a password they do not use anywhere else, and offer two-step sign-in if your platform supports it.
- Have a plan before you need one. Know how you would take the shop offline, tell customers, and notify a regulator, including who can make those calls after hours.
What to send your developer, agency or host
Euglena Co., Ltd. said on November 5, 2026 that its akyrise online shop had been broken into, that it closed the shop on November 4, and that up to about 490,000 login records with hashed passwords and up to about 900,000 registration and purchase records may have leaked. It has not said how the attacker got in. The same notice also describes separate incidents at an email delivery service and a shipping inquiry service used by a contractor. Please list every system and vendor that holds our customer names, addresses, emails, passwords or order details, including email and shipping tools. Please tell us what customer and card data we still keep, how we would take the shop offline and force password resets if we had to, and whether customers can use two-step sign-in. Source: Euglena Co., Ltd. notice of November 5, 2026.
Common questions
Has my site been hacked?
This notice does not mean your site has been hacked. It is about a breach of Euglena's akyrise online shop, and about two separate incidents at services a contractor used. It matters to you as a shopper if you used that shop, and as a store owner because many shops keep the same kinds of customer data and use similar email and shipping services.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see your shop's customer records, vendors or passwords, and we cannot tell you whether you were one of Euglena's customers.
How did the attacker get in?
Euglena has not said. It says the cause is still under investigation. (Euglena, Nov 5)
Were the three incidents the same attack?
No. Euglena says the shop break-in and the two incidents at contractor services are each separate events. (Euglena, Nov 5)
Is there anything to update?
No. This was an attack on one company's shop and, separately, on services a contractor used, not a named flaw in software you run. The general steps for store owners above are worth doing anyway.
Where can I follow official updates?
Euglena's notice (in Japanese). All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Euglena Co., Ltd.: Apology and notice about the leak of member information at the cosmetics brand akyrise following unauthorized access by a third party, November 5, 2026, in Japanese, checked November 11, 2026