@cosme confirms a leak of about 3 million members’ personal details
istyle says unauthorized access to @cosme exposed about 3 million members’ details, including addresses, birth dates and skin/hair types. It says passwords and credit-card data were not included. Former members can be affected; individual notifications are expected to finish on November 6 while investigation continues.
- Disclosed
- Nov 2, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- @cosme Common ID members at the time of unauthorized access, including people who have since left
- data breach · Japan · consumer accounts
- In the wild
- Yes
- istyle confirms unauthorized access and member information leakage.
What happened
The exposed fields listed by istyle are an automatically assigned user ID (not the login identifier), nickname, names in kanji/kana, postal code, address, phone number, email, gender, birth date, skin type and hair type. Not every field is necessarily present for every person. The company says login passwords and credit-card data are excluded and that no resulting misuse is known to it so far.
istyle has reported to Japan’s Personal Information Protection Commission and is investigating the cause and scope with an outside security company. It has not published an entry point or a complete exposure interval. Detection on October 28 is distinct from the November 2 public notice; this is a confirmed large personal-data leak, not evidence of payment-card theft.
Crime-scene timeline
Oct 28, 2026
istyle confirms that member details leaked through unauthorized access
Nov 2, 2026
Public notice describes about 3 million affected people and ongoing investigation
Nov 6, 2026 (scheduled)
Individual notifications expected to finish
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.