Komori
Occurring Fact2685and ST HD Co.,Ltd.Retail

Apology and Notice Regarding Unauthorized Access to Our Business Servers and the Potential Leakage of Personal Information and Other Data

It has been discovered that a third party gained unauthorized access to multiple company servers, and that approximately 2.5 million customer records and approximately 10,000 business partner records may have been leaked externally. The scope of employee information potentially affected and the impact on financial results are still being investigated.

Worth reading
60In focus
0–100. This measures how worthwhile something is to read, not how good or bad the company is.
Direction
Deterioration
Direction inferred from the company’s description.
Scale
2500000
records (customer information)
Wording
Avoiding a definitive answer
How definitive the wording is.

Apology and Notice Regarding Unauthorized Access to Our Business Servers and the Potential Leakage of Personal Information and Other Data

Subject Entity

株式会社アンドエスティHD

Target Locations / Products

Multiple company servers. The web store “アンドエスティ” was not affected by this unauthorized access, but members are currently unable to use their loyalty points at stores or on the web store.

OccurrenceAround 7:30 a.m. on Thursday, 22 October 2026
Same day
Awareness or receipt of noticeAround 10:00 a.m. on 22 October 2026
This disclosure10/23/2026
Cause

Unauthorized external access led to successive login attempts, unauthorized access to multiple servers, and data extraction.

Accounting period in which recognized

Current fiscal year (the specific fiscal year and quarter are Not disclosed)

Impact on Earnings Forecast

The impact of this incident on financial results for the current fiscal year is currently being investigated. We will promptly announce any material impact on future financial results if one is expected.

Related procedures

Type

Consultation with the police and a report to the Personal Information Protection Commission

Court or authority

Police and the Personal Information Protection Commission

Company response

Suspended operations

Internal business systems were suspended. Use of member loyalty points at stores and on the web store was suspended.

Measures to prevent recurrence

Necessary emergency measures, including isolating servers and blocking unauthorized access routes. Identification of the means used for the unauthorized access and implementation of countermeasures.

Outlook

We will begin contacting affected customers and business partners sequentially and establish an inquiry contact point for this incident. If a material impact on financial results is expected, we will promptly disclose it.

Planned follow-up disclosure

We will promptly announce any material impact on future financial results if one is expected.

Event that occurred
ItemDetails
Event nameApology and Notice Regarding Unauthorized Access to Our Business Servers and the Potential Leakage of Personal Information and Other Data
Date of occurrenceAround 7:30 a.m. on Thursday, 22 October 2026
Date recognized / date notice receivedAround 10:00 a.m. on 22 October 2026
Subject Entity株式会社アンドエスティHD
Target Locations / ProductsMultiple company servers. The web store “アンドエスティ” was not affected by this unauthorized access, but members are currently unable to use their loyalty points at stores or on the web store.
CauseUnauthorized external access led to successive login attempts, unauthorized access to multiple servers, and data extraction.
Accounting period in which recognizedCurrent fiscal year (the specific fiscal year and quarter are Not disclosed)
Impact on Earnings ForecastThe impact of this incident on financial results for the current fiscal year is currently being investigated. We will promptly announce any material impact on future financial results if one is expected.
Type of litigation or proceedingConsultation with the police and a report to the Personal Information Protection Commission
Court or authorityPolice and the Personal Information Protection Commission
Suspended operationsInternal business systems were suspended. Use of member loyalty points at stores and on the web store was suspended.
Measures to prevent recurrenceNecessary emergency measures, including isolating servers and blocking unauthorized access routes. Identification of the means used for the unauthorized access and implementation of countermeasures.
OutlookWe will begin contacting affected customers and business partners sequentially and establish an inquiry contact point for this incident. If a material impact on financial results is expected, we will promptly disclose it.
Planned follow-up disclosureWe will promptly announce any material impact on future financial results if one is expected.
Items this document does not state (11)
Amount of Impact on Business PerformancePlaintiffDefendantDate of filing / date of actionClaim amount / surcharge amountAmount of receivables at risk of non-collection or delayed collectionScheduled resumption dateInvestigation structureDirectors' and officers' liabilityVoting rights ownership percentage before the changeVoting rights ownership percentage after the change

These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.

The reasons the company gives

The company's own explanation, not something inferred from the numbers.

A third party externally attempted to log in to and gain access to multiple company servers and extracted data.

How to read this page

This is not the documentKomori reads the disclosure the company filed and writes this summary. Figures are as stated by the company and are not audited.
Weight is not a verdictIt measures how much this changes what the company had already told the market. It is not a view on the shares.
Corrections happenIf the company reissues this disclosure, the page is rebuilt from the corrected version and the revision number moves up.
Apology and Notice Regarding Unauthorized Access to Our Business Servers and the Potential Leakage of Personal Information and Other Data | and ST HD Co.,Ltd. (2685) timely disclosure | Komori