A third party gained unauthorized access to “Commerble,” the e-commerce site operated by Xebio Holdings' consolidated subsidiary GALLERY・2, and a possible leak of purchaser information and tampering with the payment screen were confirmed. The potential impact extends to approximately 128,000 purchaser records and other information. The e-commerce site has been suspended since the 18th.
On 23 October 2026, Xebio Holdings announced that unauthorized access had occurred to the database and payment-related screens of an e-commerce site operated by its consolidated subsidiary GALLERY・2. After management credentials were illegally obtained on 16 October, access to the customer database and the display of information were confirmed on 17 October. The site was suspended on 18 October after tampering with the payment-entry screen was discovered. According to the announcement, no evidence of data being taken outside the system has been found to date.
The potentially affected information falls into 3 categories. Purchaser information comprises up to approximately 128,000 purchaser names and email addresses, excluding duplicates; address information comprises up to approximately 122,000 purchaser and delivery addresses and telephone numbers, excluding duplicates; and email transmission history comprises up to approximately 158,000 order-confirmation email messages and recipient email addresses. The company said that counts were disclosed separately for each category and should not be added together to represent the number of leaked records.
Regarding the payment-screen tampering, unauthorized access to the customer database was also confirmed, and the e-commerce site has been suspended since the 18th. Card numbers and login passwords were reportedly not included, and it has not been determined whether information actually entered despite the tampering was taken outside the system.
Measures to prevent recurrence are currently being implemented, including suspending the e-commerce site and external access to administrative functions, changing authentication and connection information, restricting access and reviewing permissions. A phased reopening is being considered. The published information indicates that reopening will be pursued after preparations for individual notifications and confirmation of safety.