Eストアー(ショップサーブ)Data breach / unauthorized access incident
- Occurred on
- May 21, 2026
- Announced on
- October 16, 2026
- Severity
- SSLarge-scale compromise of sensitive data such as payment or identity-verification records affecting millions.
- Scale
- 23,356,000 people
- Main impact
- For the EC site building service “ショップサーブ”, personal data for about 2,336万人分 (対象7,858店) — including names, addresses, and phone numbers of purchasers and shop operators — was leaked; of those, about 210万人分 also included cardholder name, part of the card number, and expiration date (10月16日最終報).
- Information involved
- Email addressUser / member IDPasswordAuth tokenCard & payment dataPhone numberHome addressFull name
- Cause / key point
- An application vulnerability on the server was exploited and a malicious program was executed, causing data to be sent from the database to external parties (2026年5月21日〜8月1日).About Exploitation of vulnerabilities
- Industry
- IT & telecom
- Listing / capital
- UnlistedParent company: BASE(東証グロース 4477)
Eストアー is a subsidiary of BASE.
- Last updated
- October 20, 2026
Stock price reaction to the disclosureBASE・親会社 / 東証グロース 4477
Stock information is reference data based on Yahoo Finance and may be delayed. This site does not solicit or advise investment and does not guarantee the accuracy or completeness of this information. We accept no liability for any investment decision based on it.
Is this incident worth paying attention to?
Written & reviewed
Reviewed byYutaro SasaoFounder & CEO, MediaLeap Inc.
CEO of MediaLeap Inc. Working on both sides of web advertising and web media since 2013; founded the company in May 2025.
Review scope: cross-checking against primary sources (official and government announcements), verifying claims stay within the facts, and checking source attribution。Last reviewed:
Written by:Leak Watch editorial team (AI-assisted drafts verified against sources by the editorial team) · Reviewer profile · Request a correction
Related incidents
Browse the database →Incidents sharing the same company, service, attack method or industry (grouped automatically from the disclosures).
Incidents related to "プログラム"
Incidents where the damage spread through the same service or system.
- Bリンクステーション（GETTIIS会員情報）2026.10.19 announced・Affected Unknown
- Aアズマ（hitmart）2026.10.08 announced・Affected Unknown
- A損保ジャパン（SMILING ROAD）2026.10.07 announced・Affected 60,000 records
- Aシチズン時計（問い合わせ管理）2026.10.06 announced・Affected 100,000 people
- Sホワイトエッセンス（予約・基幹システム）2026.10.05 announced・Affected 1,050,000 accounts
- Aアバハウスインターナショナル2026.10.03 announced・Affected Unknown
Same attack method
- SSHelpfeel（Gyazo）2026.09.16 announced・Affected 23,620,000 records
- SSSアドベンチャー（スカイチケット）2026.10.10 announced・Affected 14,640,000 records
- SSSKDDI(ISP事業者向けメール基盤)2026.06.23 announced・Affected 12,231,954 people
- Sムラウチドットコム2026.09.15 announced・Affected 7,710,000 records
- ALEAN BODY2026.09.15 announced・Affected 440,000 accounts
- Aユーザベース（NewsPicks）2026.10.08 announced・Affected 362,000 records
Same industry
- SSソースネクスト2026.10.15 announced・Affected 22,519,960 records
- SSコミューン（Commune・Commune for Work）2026.10.09 announced・Affected 307,000 people
- SSIDCフロンティア（IDCFクラウド）2026.10.07 announced・Affected 48 records
- SS楽天ドライブ2026.10.06 announced・Affected 15,382 accounts
- SPingCAP2026.10.21 announced・Affected 50,000 people
- S日本電気株式会社2026.10.20 announced・Affected Unknown
Attack method classification: Exploitation of vulnerabilities(Breaking in through holes in software and devices)
Read the Exploitation of vulnerabilities guide and national trends →