Short answer
Lawson announced on 8 October 2026 that unauthorized access to Lawson ID and the Lawson app reservation service exposed 2,155,345 ID records. A further 26 reservation records included names, phone numbers and partial card numbers.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Lawson, Inc. |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Convenience retail |
| Country | Japan |
| Detected | 2026-10-07 |
| Disclosed | 2026-10-08 |
| People or records affected | 2,155,345 Lawson ID records and 26 Lawson app reservation records |
What data was exposed
- Email address and name
- Gender, phone number and address, depending on what was registered
- For app reservations: name, phone number and part of a credit card number
What happened
Lawson, the Japanese convenience store chain, said on 8 October 2026 that two services had been accessed without authorization: Lawson ID, the account used across its apps, and the Lawson app reservation service. By ScanNetSecurity’s account, the company found the problem during an investigation on 7 October. The access itself dated back to 12 to 14 September for Lawson ID and 17 September for the reservation service.
That left about three weeks between the access and its discovery. The outlets we read did not describe the method, so we do not speculate on it.
Numbers and data
Impress Watch gives about 2,155,345 Lawson ID records. They include email addresses and names. Depending on what a person registered, gender, phone number and address may be in the record too. The second group is small: 26 app reservation records with names, phone numbers and part of a credit card number.
Partial card numbers are not enough to make a purchase. They are enough for a caller to sound credible, so people in that group should treat any card-related call with suspicion.
Response so far
Lawson blocked the suspicious access sources and is contacting affected people, according to Impress Watch. Neither source we opened described a root cause or listed any follow-up security measures.
Why the timing matters
Several large Japanese incidents landed in the same fortnight, including Daiichikosho and skyticket, according to Impress Watch. Fraudsters often send mass “your account was affected” messages after a headline breach, whether or not the recipient was in the data. That makes it hard to tell a real notice from a fake one. Read our guide to phishing messages and the one on toll and delivery text scams, then follow the data breach checklist.
What is still unknown
The attack method, whether the data is being traded, and whether passwords were involved are not stated in the material we read. See the breaches index for other incidents and our editorial policy for standards.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing SMS and email posing as Lawson, Ponta or the Lawson app asking you to re-enter login details.
- Fake prize, coupon or point notices that use your real name.
- Calls using your phone number and address to claim a purchase or delivery problem.
- Anyone in the 26 reservation cases may get card-related phishing that quotes the last digits.
What to do if you are affected
- 01Change your Lawson ID password, and any other account that shared it.
- 02Ignore links in messages about Lawson points or accounts and open the official app yourself.
- 03If you were one of the 26 reservation users, check your card statement and call the card issuer if anything looks unfamiliar.
- 04Report phishing messages to the Council of Anti-Phishing Japan and suspicious calls to #9110.
- 05Consumer problems can go to the national hotline 188.
Frequently asked questions
When did the Lawson unauthorized access happen?
ScanNetSecurity reports the Lawson ID access took place between 12 and 14 September 2026, and the app reservation access took place on 17 September. Lawson found it in an investigation on 7 October.
Were Lawson passwords leaked?
The coverage we reviewed does not list passwords among the exposed fields. Changing your password is still sensible.
How many people were affected?
The reported count is 2,155,345 Lawson ID records and 26 app reservation records.
What did Lawson do?
According to Impress Watch, Lawson blocked the suspicious access sources and is contacting affected individuals.
Sources
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.