Nojima reports about seven million exposed member records and forces password resets
Nojima confirms about seven million member records leaked from its online store and used-phone buyback site, excluding former members. Names, contacts, birth dates, gender, login IDs and passwords described as encrypted were exposed. The sites do not store credit-card data. Suspected affected accounts face forced password resets.
- Disclosed
- Nov 2, 2026
- Updated Nov 3, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Members of Nojima Online and its used-phone buyback site; about seven million records, not a verified unique-person count
- Nojima · data breach · credentials
- In the wild
- Yes
- Nojima confirms November 1 unauthorized access and member-data leakage.
What happened
The full field list is names in kanji/kana, birth dates, gender, postal codes, addresses, phone numbers, login IDs, passwords described by the company as encrypted, and email addresses. The notice counts about seven million records and excludes former members; it does not establish a deduplicated victim count. Nojima says these two sites do not retain credit-card data, not that every financial service or system is unaffected.
The company is investigating cause, scope and subsequent misuse. It identifies no password-protection algorithm, exploited vulnerability or restoration deadline. Its November 2 notice says police were consulted and reports to the Personal Information Protection Commission and other bodies were being prepared, not already submitted. Await an official safety/reopening notice; the reset notice alone does not establish full service restoration. L4 reflects the company-confirmed mass data leakage.
Crime-scene timeline
Nov 1, 2026
Unauthorized access detected and data leakage confirmed
Nov 2, 2026
Company publishes its notice covering about seven million records
The two services are suspended; containment includes blocking external access, and regulatory reports are being prepared.
Nov 3, 2026
Forced password reset and reset procedure announced
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Nojima original incident notice (PDF)PrimaryNovember 2 notice: November 1 leakage, about seven million records and fields, exclusion of former members, no stored credit-card data, service suspension and investigation.
- Nojima Online password-reset noticePrimaryUpdated November 3: forced resets for suspected affected users and the reset procedure.