ENKR

@cosme member data breach

Add to my breach check

Made public · about 3 million people

What leaked7

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data

Permanent

  • Date of birth
  • Full name
  • Gender
  • Mobile numberphone number · type not stated
  • Home or delivery addresswith postcode
  • Full namein kanji and kana
  • Other profile datauser ID assigned at sign-up · not the login ID, nickname, skin type and hair type

To-dos4 · about 50 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls
  3. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  4. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next3 events

  1. UndetectedNone on record
  2. Response 3 eventsNo individual notice on record · Back to latest
  3. RemedyNone on record
  4. PenaltyNone on record
  5. DisputesNone on record

Response: 3 events

Back to latest
  1. Announced unauthorised access to @cosme and a leak of part of about 3 million members' data
  2. No misuse of personal data or secondary harm found as of 2 November
  3. Confirmed that part of the member data registered to the @cosme common ID had leaked
Company
@cosme
Company detected it
Made public
Notice
Leak confirmed
Affected
about 3 million people · @cosme common ID members at the time of the access, including those who have left since; company notice

How the facts developed

  1. Company notice: istyle confirmed on October 28, 2026 that an outside party had accessed @cosme without authorisation and taken part of the member data of about 3 million people

Sources