Short answer
Bookoff Group Holdings confirmed on 6 October 2026 that a third party had accessed the member management system of a subsidiary and taken member data. On 9 October it said up to about 6.43 million records may have leaked, and it began emailing affected members on 15 October.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Bookoff Group Holdings |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Retail (second-hand books and goods) |
| Country | Japan |
| Detected | 2026-10-06 |
| Disclosed | 2026-10-09 |
| People or records affected | Up to about 6.43 million member records, roughly 6.4 million people. The company says not every member's data was taken. |
What data was exposed
- Names, dates of birth and gender
- Email addresses, phone numbers, postal codes and addresses
- Password hashes (not plain-text passwords)
- Point card numbers and member numbers
What happened
Bookoff Group Holdings confirmed on 6 October 2026 that a third party had gained unauthorized access to the member management system run by one of its subsidiaries, according to Kyodo News via Kumamoto Nichinichi Shimbun. Member information in that system was retrieved from outside. The company announced the incident on 9 October and said up to about 6.43 million records may have leaked.
GAME Watch reports that Bookoff began emailing affected people individually from 15 October. It puts the number of people at about 6.4 million, based on a second report the company issued on 13 October. The company says not all members had their data taken.
What was exposed
The fields listed by GAME Watch are names, dates of birth, gender, email addresses, phone numbers, postal codes, addresses, password hashes, point card numbers and member numbers. Bookoff says the system does not hold credit card or other payment information, so none was included.
The reports we read do not explain how the intruder got in, who they are, or whether a ransom was demanded. ScanNetSecurity links to the company’s apology notice and a separate response statement but does not describe an attack method either. As of the announcement, no misuse of the data had been confirmed.
Why this matters
A list of millions of names, addresses, phone numbers and email addresses is useful to scammers even with no card data. Japan saw several large member-data leaks in October 2026, which means inboxes are already full of breach-themed lures. Bookoff has also published the sender address and subject line of its real notices, which makes copycats easier to spot: if a message does not match, it is not from the company.
Password hashes are the other concern. If you used your Bookoff password elsewhere, attackers may try it on other sites. Our guide to phishing messages shows how to check a link before you tap it, and what to do after a data breach walks through password changes and monitoring. If a caller uses your leaked details to push you toward a payment, the urgent payment guide covers the pressure tactics.
What we do not know
The cause of the intrusion, the exact count of former members included and any later findings have not been reported in the sources we read. We will update this page if Bookoff publishes more. See our editorial policy.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake Bookoff emails or SMS that copy the real apology notice and link to a lookalike login page
- Credential-stuffing logins on other sites if you reused your Bookoff password
- Calls or texts that quote your name, address and birth date to sound legitimate
What to do if you are affected
- 01Change your Bookoff password by opening the official app or typing the site address yourself, not from an email link.
- 02Change the same password anywhere else you used it, and turn on two-step verification where offered.
- 03Treat any message about the incident as suspect unless it matches the sender and subject the company published on its FAQ page.
- 04Do not enter card details or one-time codes in response to a message about this breach. Bookoff says the system held no payment data.
- 05Watch your point balance and account details for changes you did not make.
Frequently asked questions
How many people are affected by the Bookoff data breach?
Kyodo News reports the company said up to about 6.43 million records may have leaked. GAME Watch estimates about 6.4 million people based on the company's second report of 13 October. Bookoff says not every member's data was taken.
What data was leaked from Bookoff?
According to GAME Watch, names, dates of birth, gender, email addresses, phone numbers, postal codes and addresses, password hashes, point card numbers and member numbers. Credit card and other payment data is not held in the system.
Were Bookoff passwords exposed?
Password hashes were included, not plain-text passwords. A hash can sometimes be cracked, especially if the password was simple or reused, so changing it is sensible.
Has the leaked data been misused?
Kyodo News reports no misuse had been confirmed at the time of the announcement. We have not seen any report that the data has been published.
How is Bookoff contacting affected members?
GAME Watch reports it has emailed people one by one since 15 October, with the subject line about an apology and notice on the personal information leak. Check the company's FAQ page for the current sender address before trusting any message.
Sources
- Bookoff: up to 6.43 million records may have leaked after unauthorized access, Kumamoto Nichinichi Shimbun (Kyodo News), 2026-10-09
- Bookoff begins notifying people affected by the member data leak, GAME Watch (Impress)
- Bookoff Group Holdings subsidiary hit by unauthorized access, up to about 6.43 million member records, ScanNetSecurity, 2026-10-14
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.