istyle Inc., which operates the comprehensive cosmetics website “@cosme,” announced that information on approximately 3 million members had been leaked following unauthorised access to the @cosme unified ID system.
On 2 November, istyle Inc. announced that some member information registered with the “@cosme unified ID” system had been leaked as a result of unauthorised access. The leaked information includes names, postal codes, addresses, telephone numbers, email addresses, user IDs, genders, dates of birth, nicknames, skin types and hair types.
It has been confirmed that login passwords and credit card information were not included in the leaked data at this time. The leak was confirmed on 28 October. Although the specific date and method of the unauthorised access have not been disclosed, former members may also be affected.
The company is investigating the cause and scope of the impact with a third-party security specialist and will consider and implement measures to prevent recurrence based on the findings. Affected individuals will be contacted in sequence, and notices are scheduled to be sent from the cosme.net domain. Individuals who have cancelled their memberships will also be contacted for a certain period after cancellation based on their information.