Security notice
Do you send customer shipping data to a fulfillment company? Openlogi says attackers took delivery details from shops that use its warehouses.
On November 11, 2026, Openlogi, a Japanese company that stores and ships goods for online shops, said unauthorized parties accessed its systems on November 8 and 9 and took some of the shipping data it holds. The data covers shipment requests from April 8 through November 8, 2026, and includes recipient names, addresses, phone numbers, email addresses when registered, and item names and quantities. Openlogi says it does not hold credit card numbers, so card numbers are not included. It says it cut off the access path it had found on November 9, and that it has not confirmed any further unauthorized access or any misuse so far. It has not published a total count, and it says the exact scope is still under investigation. Several shops that use Openlogi have published their own notices, including HUMAN MADE's CURRY UP shop, Weathernews's SORASHOP, BEAMS's Setinn official site and its ended official TikTok Shop, SKIYAKI's Bitfan stores, and Palette Project OFFICIAL STORE. This is not a named software flaw, so there is no CVE or patch to install. If you ordered from a shop that uses Openlogi, watch for fake delivery messages. If you run a shop, this is a reminder to know which vendors hold your customer shipping data and how you would tell customers if that vendor was breached. (Openlogi, Nov 11)
What happened
- Access on November 8 and 9. Openlogi says unauthorized parties accessed its systems from November 8 to 9, 2026, and that some of the shipping data it holds was taken out. It says it cut off the access path it had found on November 9, and that it has not confirmed any further unauthorized access since then. (Openlogi, Nov 11)
- Reported on November 11. Openlogi published the notice and says it is reporting the matter to Japan's Personal Information Protection Commission and consulting the police. It says it is working with an outside specialist firm to investigate the cause, the path in, and the scope. (Openlogi, Nov 11)
- Warehouses still shipping. Openlogi says that, aside from some system operations during emergency maintenance, inbound and outbound warehouse work is running as usual. (Openlogi, Nov 11)
- No misuse confirmed so far. Openlogi says that as of November 11, 2026, it has not confirmed any misuse of the leaked information or any secondary harm from this incident. (Openlogi, Nov 11)
What data
Openlogi says the data taken so far includes shipping records for requests it received from April 8 through November 8, 2026. It has not published a total count, and it says the exact range and number of records are still under investigation. (Openlogi, Nov 11)
- Recipient details: name, address, phone number, email address when one was registered, and item information such as product name and quantity.
- Card numbers: Openlogi says it does not hold credit card numbers, so card numbers are not included.
Shops that have published notices
Openlogi has not published a full list of affected shops. The shops below have published their own notices. This is not a complete list, and several of them say their exact customer counts are still being confirmed.
- HUMAN MADE's CURRY UP online shop, for shipments from April 8 through November 8. HUMAN MADE says its other brands, including HUMAN MADE, were not affected, and that it has not found unauthorized access to its own systems. In the same disclosure, HUMAN MADE said Openlogi also restricted access from outside Japan and reset all user login sessions on November 9. (HUMAN MADE, Nov 11; Nikkei, Nov 11)
- Weathernews's official online shop SORASHOP, for purchases from April 8 through November 8. Weathernews says Openlogi told it about the incident on November 10. It has stopped using Openlogi until it is satisfied the service is safe, and it has switched to another way of shipping. It says it will email affected customers once they have been identified. (Weathernews, Nov 12)
- BEAMS's Setinn official site, and the ended BEAMS official TikTok Shop, for shipments from April 8 through November 8. BEAMS says its main official online shop was not affected. (BEAMS, Nov 12)
- SKIYAKI's Bitfan stores, where SKIYAKI says it had outsourced some goods storage and shipping to Openlogi. SKIYAKI says the shipping data it provided may have been affected, and that the exact information, customers and counts are still being confirmed. (SKIYAKI, Nov 11)
- Palette Project OFFICIAL STORE, for orders whose shipping was arranged from April 8 through November 8. Palette Project says the address data can include postal code, building name and company name, and that Openlogi did not hold credit card numbers or the store's login passwords. (Palette Project, Nov 11)
Who should worry
- You bought from, or received a shipment from, a shop that uses Openlogi between April 8 and November 8, 2026, including if the goods were sent to you as a gift.
- You run an online shop that sends customer shipping data to Openlogi or to another fulfillment or warehouse company.
If you did not buy from or receive a shipment from a shop that uses Openlogi, and you do not send customer data to a fulfillment vendor, this notice does not apply to you.
What to do now
If you are a customer of a shop that uses Openlogi. This follows advice from Openlogi and from shops that have published notices.
- Watch for fake delivery messages. Openlogi and the shops warn that leaked names, addresses, phone numbers and emails could be used in emails, texts or calls that pretend to be the shop or a delivery company. Do not open unexpected delivery notices or attachments, and do not click links you were not expecting. (Openlogi, Nov 11; BEAMS, Nov 12; Weathernews, Nov 12)
- Do not enter personal details, card numbers or make a payment on a page you reached from a suspicious message, even if it asks you to arrange a redelivery or pay an extra fee. (Openlogi, Nov 11; Palette Project, Nov 11)
- Wait for a message from the shop you bought from if that shop is identifying affected orders. For questions about Openlogi's own investigation, Openlogi points people to cs@openlogi.com. (Openlogi, Nov 11; Weathernews, Nov 12)
If you run an online shop. These are general steps, not from Openlogi. We are not claiming any tool, including EverThread, would have stopped this attack.
- Know which vendors hold your customer shipping data. Make a list of every fulfillment, warehouse and shipping company you use, what data you send them, and which orders or date ranges that covers. Openlogi is still investigating the total count. Shops that already knew which orders they had sent to Openlogi have been able to describe their own scope more quickly.
- Have a backup way to ship. Weathernews says it stopped using Openlogi and switched to another shipping arrangement so it could keep filling orders. Know how you would do the same if you had to pause a vendor. (Weathernews, Nov 12)
- Tell customers to watch for fake delivery messages. Even when card numbers are not involved, names, addresses, phone numbers, emails and item details are enough for someone to impersonate your shop or a carrier.
- Review how you manage vendors. SKIYAKI says it will review how it manages and supervises the companies it hires. Know who at your shop can approve a vendor, what access that vendor has, and how you would notify customers if that vendor was breached. (SKIYAKI, Nov 11)
What to send your developer, agency or host
Openlogi, a Japanese fulfillment company used by online shops, said on November 11, 2026 that unauthorized parties accessed its systems on November 8 and 9 and took shipping data for requests from April 8 through November 8, including recipient names, addresses, phone numbers, emails and item details. It says it does not hold credit card numbers. Several shops that use Openlogi have published their own notices. Please list every fulfillment, warehouse and shipping vendor that holds our customer names, addresses, phone numbers, emails or order details, including the date ranges and order counts we have sent them. Please tell us how we would pause a vendor, ship by another route, and notify affected customers if we had to. Source: Openlogi notice of November 11, 2026.
Common questions
Has my site been hacked?
This notice does not mean your site has been hacked. It is about a breach at Openlogi, a fulfillment company some online shops use to store and ship orders. If you use Openlogi, your customer shipping data may be involved even if your own shop systems were not broken into.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see your shop's vendors, shipping data or customer records, and we cannot tell you whether a shop you use, or a shop you run, sent orders through Openlogi.
How did the attacker get in?
Openlogi has not said. It says the cause, the path in and the exact scope are still under investigation. (Openlogi, Nov 11)
Were credit card numbers stolen?
Openlogi says it does not hold credit card numbers, so card numbers are not included. Several shops that published notices say the same. (Openlogi, Nov 11; BEAMS, Nov 12; Weathernews, Nov 12; Palette Project, Nov 11)
Is there a complete list of affected shops?
Not from Openlogi. The company has not published a full list or a total count. The shops named above are ones that have published their own notices. Other shops may still come forward.
Is there anything to update?
No. This was an attack on a fulfillment company, not a named flaw in software you run. The general steps for store owners above are worth doing anyway.
Where can I follow official updates?
Openlogi's notice (in Japanese). Shops that have published their own notices include HUMAN MADE, Weathernews, BEAMS, SKIYAKI and Palette Project. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Openlogi: Apology and notice about the leak of personal information following unauthorized access to our systems, November 11, 2026, in Japanese, checked November 12, 2026
- HUMAN MADE, as reported by Nikkei: HUMAN MADE, possible leak of personal information after unauthorized access at a logistics contractor, November 11, 2026, in Japanese, checked November 12, 2026
- Weathernews Inc.: Possible leak of customer information following unauthorized access at a shipping contractor, November 12, 2026, in Japanese, checked November 12, 2026
- BEAMS: Apology and notice about the leak of personal information following unauthorized access at a contractor's system (Setinn official site and BEAMS official TikTok Shop), November 12, 2026, in Japanese, checked November 12, 2026
- SKIYAKI Inc.: Notice and apology about the leak of personal information following unauthorized access at a contractor (Openlogi), first report, November 11, 2026, in Japanese, checked November 12, 2026
- Palette Project (jig.jp): Possible leak of personal information following unauthorized access at a contractor (Openlogi), November 11, 2026, in Japanese, checked November 12, 2026