Bookoff Group breach may expose membership data of up to 6.43 million customers

On 9 October 2026, Bookoff Group — one of Japan's largest second-hand retailers, known for its chain of used books, media and goods stores — disclosed that a third party had gained unauthorized access to the member management system of one of its subsidiaries, potentially leaking the personal data of up to about 6.43 million membership records. The company noted that the figure counts member numbers rather than unique individuals, so the number of people affected may be lower.

According to the disclosure, the potentially exposed information includes names, dates of birth, addresses, email addresses, membership numbers and reward-program IDs, along with hashed password values. Bookoff said payment information such as credit-card details is not stored on the affected system and was not part of the potential leak, and that it had not confirmed any fraudulent use of the data.

Response

Bookoff said it detected the intrusion on 6 October, blocked the attacker's access path and tightened security on the affected system. The company is working with the relevant authorities, preparing to notify affected members individually, and warning customers about the risk of phishing. It stressed that it will never request passwords or financial information by email, SMS or telephone, and urged members to be wary of any message that does so. The intrusion window and the attack vector have not been made public.

Context

The breach was disclosed in the same week as a separate incident at karaoke operator Daiichi Kosho, where a malware infection at a contractor put the data of about 8.72 million people at risk — part of a cluster of large-scale data exposures reported by Japanese firms in early October 2026. Although Bookoff's passwords were hashed and no payment data was involved, the combination of names, birth dates, addresses and contact details still gives fraudsters enough verified personal information to craft convincing phishing and impersonation attempts against affected members.