Short answer
H2O Retailing said on 19 October 2026 that unauthorized access to systems run by its subsidiary Hankyu Hanshin Department Stores partly leaked personal data of about 1.26 million H2O ID holders. The company said it had found no secondary harm at the time.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | H2O Retailing / Hankyu Hanshin Department Stores |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Department stores and retail |
| Country | Japan |
| Detected | 2026-10-16 |
| Disclosed | 2026-10-19 |
| People or records affected | About 1.26 million H2O ID records (partial leak) |
What data was exposed
- H2O ID, name in kanji and katakana, gender, email address, postal code and address
- Mobile and landline phone numbers, age, date of birth, and services used under H2O ID
- Possibly: purchase history, card type, last four digits, cardholder name and expiry date, and address book entries
What happened
H2O Retailing, the parent of Hankyu Hanshin Department Stores, announced on 19 October 2026 that outsiders had reached its customer management system through the department stores’ reservation site. FASHIONSNAP’s account of the announcement puts the leak at partial personal data of about 1.26 million H2O ID holders. H2O ID is the shared membership ID used across the group.
Timeline
According to FASHIONSNAP, the company confirmed the access on 16 October. It blocked outside malicious traffic and shut the reservation site. On 17 October it found access on two more services, HANKYU HANSHIN E-STORES and Remo Order, and closed both sites the same day. By 19 October the investigation had put the number of H2O ID holders with leaked data at about 1.26 million.
What is and is not confirmed
Fields described as confirmed or likely leaked include name, gender, email, address, phone numbers, date of birth and services used. Purchase history, partial card details and address book data are listed as possible, not confirmed. We read this from FASHIONSNAP only; Kyodo’s wire report we opened confirms the headline figure and the access route.
The same Kyodo report lists several other Japanese organizations announcing unauthorized access on the same day, among them Nifty, mail delivery firm Yumil Link and Trustbank. We have not verified those separately.
Company response
The company said it was investigating the cause and analyzing the vulnerability. It reported to the Personal Information Protection Commission, filed with police, and emailed H2O ID members. It also warned that emails, SMS or calls pretending to be from the company could be sent to registered addresses and numbers.
For the practical steps, see our data breach checklist. The warning above matches the pattern in our guide to phishing messages, and shopping-related fakes are covered in online shopping scams. More incidents are listed on the breaches index, and our editorial policy explains how we label claims.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Emails, SMS or calls posing as Hankyu, Hanshin or H2O, which the company itself warned about.
- Fake order or payment problems that quote your name and address to look real.
- Card-related calls that use the last four digits and expiry date to sound credible, if you are in the group whose card details may have leaked.
What to do if you are affected
- 01Treat any unexpected message mentioning H2O ID, Hankyu or Hanshin as suspect and do not tap its links.
- 02Change your H2O ID password and any other account that used the same one.
- 03Check card statements for unfamiliar charges and call the card issuer if you find any.
- 04Wait for the company's email to H2O ID members and confirm any notice on the official site before acting.
Frequently asked questions
How many people were affected by the H2O Retailing breach?
The company reported that partial personal data of about 1.26 million H2O ID holders leaked, according to FASHIONSNAP. Kyodo News, carried by Kumamoto Nichinichi Shimbun, gives the same figure.
What sites were shut down?
According to FASHIONSNAP, the Hankyu and Hanshin department store reservation site was shut on 16 October, and HANKYU HANSHIN E-STORES and Remo Order were shut on 17 October. No restart date was given.
Was my credit card number leaked?
The company said some card details may have leaked: card type, last four digits, cardholder name and expiry date. It did not say full numbers were involved.
Has the data been misused?
At the time of reporting, the company had not confirmed secondary harm or misuse, according to FASHIONSNAP.
Did the company report it to authorities?
Yes. FASHIONSNAP reports it informed the Personal Information Protection Commission and filed a damage report with local police.
Sources
- H2O unauthorized access (company announcement report, 19 October 2026), FASHIONSNAP, 2026-10-19
- H2Oのシステムに不正アクセス 顧客126万件の個人情報漏えい (Unauthorized access to H2O's system, 1.26 million customer records leaked), Kumamoto Nichinichi Shimbun (Kyodo News), 2026-10-20
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.