{
  "id": "unicolle-member-data",
  "url": "https://ohshit.app/incidents/unicolle-member-data/",
  "title": "Unicolle confirms online store intrusion affecting up to 19,468 registered customers",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-05",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Unicolle",
    "e-commerce",
    "data breach"
  ],
  "ecosystems": [],
  "summary": "Uniform retailer THS says an attacker exploited a flaw in its Unicolle store and obtained member data. Up to 19,468 registered customers are in scope. Passwords and credit card information are excluded. The company reopened ordering after repairs and an outside security assessment.",
  "splash": "Unicolle customers registered on October 18, 2026, excluding customers who had already withdrawn.",
  "wipe": "Confirm your notice through THS, watch for order or invoice impersonation, and report suspicious contact.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Confirm which of your details were involved",
      "hint": "Check the original notice and use THS customer support at 079-335-1212 on weekdays from 10:00 to 17:00 Japan time, or info@ths-fooduniform.jp. THS says it is emailing affected members individually. Keep the notice and verify any unexpected message through contact details you open yourself."
    },
    {
      "title": "Verify invoices and delivery changes through the store",
      "hint": "Open the store directly to check an order. Ignore unexpected links and attachments in email or SMS. THS says it will never ask for passwords or credit card details. If you already disclosed information, contact the relevant bank or account provider through its official channel."
    }
  ],
  "sources": [
    {
      "name": "THS November 5 data breach notice",
      "url": "https://ths-fooduniform.jp/blog/articles/notice/18421/",
      "says": "Confirms exploitation and data access, gives the customer upper bound, lists data fields and exclusions, and describes the response.",
      "primary": true
    },
    {
      "name": "THS November 5 reopening notice",
      "url": "https://ths-fooduniform.jp/blog/articles/notice/18419/",
      "says": "Confirms the November 5 reopening after repairs and assessment by an external specialist.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "THS confirms that an attacker exploited a program flaw and obtained member data.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 18, 2026",
      "title": "Attacker exploits a flaw in the online store",
      "body": "THS confirms that member information was obtained."
    },
    {
      "date": "Oct 22, 2026",
      "title": "THS disables the affected program and blocks access",
      "body": "The store temporarily closes."
    },
    {
      "date": "Nov 5, 2026",
      "title": "THS discloses the breach and reopens ordering",
      "body": "THS reports an upper bound of 19,468 registered customers and announces completed repairs and external security assessment."
    }
  ],
  "body_markdown": "THS says an attacker exploited a flaw in its online uniform store on October 18 and obtained member data. The **19,468** figure is the maximum number of customers registered at that point. Fields vary by customer and can include name and kana spelling, member ID, email, date of birth, telephone, postal code, address, mailing-list preference, company name and its kana spelling, individual or corporate classification, industry, and employer. THS excludes passwords, credit card information and the data of customers who had already withdrawn.\n\nTHS says it reported the incident to Japan’s Personal Information Protection Commission and is notifying affected members. Its reopening notice confirms ordering resumed November 5 after remediation and an external security assessment. The notice gives no public patch version or detailed description of the exploited flaw."
}