Short answer
istyle, the operator of the beauty site @cosme, said on 2 November 2026 that a third party had accessed @cosme and that about 3 million members' information leaked. The company confirmed the leak on 28 October and said login passwords and credit card details were not involved, as currently confirmed.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | istyle Inc. (@cosme) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Beauty reviews and e-commerce |
| Country | Japan |
| Detected | 2026-10-28 |
| Disclosed | 2026-11-02 |
| People or records affected | About 3 million members registered under the @cosme common ID |
What data was exposed
- User ID and nickname
- Name in kanji and kana, postal code, address, phone number and email address
- Gender and date of birth
- Skin type and hair type
What happened
On 2 November 2026 istyle Inc. published a notice titled as an apology for a personal information leak caused by unauthorized access to @cosme, its beauty review and shopping service. The company says it confirmed the leak on 28 October. It reported the incident to the Personal Information Protection Commission and began measures to prevent further damage.
Who and what
The notice says about 3 million people are affected. The data comes from member information partly stored under the @cosme common ID, and former members are included if they were members when the access happened. ScanNetSecurity reports the same count on 6 November.
The items listed are the auto-assigned user ID, which is not used for login, plus nickname, name in kanji and kana, postal code, address, phone number, email address, gender and date of birth. Skin type and hair type were also included. The notice says login passwords and credit card information are, as currently confirmed, not part of the leak.
What the company has said
istyle says a third-party security firm is investigating the cause and the scope. The notice does not describe how the access happened, and we found no public claim by an attacker. Affected customers are being contacted individually using the contact details on file, with completion targeted for 6 November. istyle said it will consider recurrence prevention once the outside findings are in and will post new information on its website. It said it had seen no confirmed misuse or secondary harm.
What to watch for
The notice asks customers to be wary of spoofed emails, SMS and calls related to the incident and not to click suspicious URLs or enter passwords or personal information on unfamiliar pages. It states that its notification emails will never ask for passwords or card details. Inquiries go to security-support@cosme.net on weekdays from 10:00 to 18:00.
Skin and hair type are an unusual extra. They give a scammer something personal to mention in a fake offer, which makes a message feel like it came from a beauty brand that knows you. Our guide to phishing messages shows how to spot these, and online shopping scams covers fake offers that follow. The data breach checklist lists the first steps. More incidents are on the breaches index.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake @cosme emails or SMS about a 'security update', prize or points that link to a lookalike login page.
- Beauty-brand or online-shop messages that use your real name, skin type or hair type to look personal.
- Calls from someone who knows your address and birth date and asks for card numbers or SMS codes.
- Fake parcel or delivery notices sent to the phone number or address now in the leaked data.
What to do if you are affected
- 01Do not click links in messages about this incident. Open the @cosme app or site yourself.
- 02Remember that istyle says its notification emails will never ask for passwords or card details. Treat any that do as fake.
- 03Check that mail from the cosme.net domain is not caught by your spam filter, so you do not miss the real notice.
- 04Change the password on any account where you reused your @cosme one, as a precaution.
Frequently asked questions
How many @cosme members were affected?
istyle's notice says about 3 million people, from member information partly stored under the @cosme common ID. Former members are included if they were members at the time of the access.
Were my password or credit card leaked?
As currently confirmed, no. The notice lists login passwords and credit card information as not involved.
Has the data been misused?
istyle said it had not confirmed misuse of the leaked data or any secondary harm at the time of the notice.
How will I be told?
istyle said it would notify affected customers individually using the contact details it holds. Because of the numbers this takes time, and it aimed to finish on 6 November.
Sources
- 不正アクセスによる個人情報漏えいに関するお詫びとお知らせについて (Apology and notice on personal information leak from unauthorized access), istyle Inc., 2026-11-02
- 「@cosme」不正アクセス、約300万人の会員情報が流出 (@cosme unauthorized access, about 3 million members' data leaked), ScanNetSecurity, 2026-11-06
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.