ローソン（ローソンID・アプリ予約）Data breach / unauthorized access incident
- Occurred on
- September 12, 2026
- Announced on
- October 8, 2026
- Severity
- SCompromise of deep personal data or usable credentials.
- Scale
- 2,155,345 accounts
- Main impact
- A leak was confirmed of ローソンID personal data including names and emails totaling 215万5,345件, and 26 app reservation records. The reservation feature was suspended and required an app update to use, and it was fully resumed on 10月19日.
- Information involved
- Email addressCard & payment dataPhone numberHome addressFull name
- Cause / key point
- Unauthorized access to a security mechanism in the app that displays users' own information.
- Industry
- IT & telecom
- Listing / capital
- UnlistedParent company: KDDI(東証プライム 9433)
ローソン was delisted in 2024. Jointly funded by KDDI and 三菱商事.
- Last updated
- October 20, 2026
Stock price reaction to the disclosureKDDI・親会社 / 東証プライム 9433
Stock information is reference data based on Yahoo Finance and may be delayed. This site does not solicit or advise investment and does not guarantee the accuracy or completeness of this information. We accept no liability for any investment decision based on it.
Is this incident worth paying attention to?
Written & reviewed
Reviewed byYutaro SasaoFounder & CEO, MediaLeap Inc.
CEO of MediaLeap Inc. Working on both sides of web advertising and web media since 2013; founded the company in May 2025.
Review scope: cross-checking against primary sources (official and government announcements), verifying claims stay within the facts, and checking source attribution。Last reviewed:
Written by:Leak Watch editorial team (AI-assisted drafts verified against sources by the editorial team) · Reviewer profile · Request a correction
Related incidents
Browse the database →Incidents sharing the same company, service, attack method or industry (grouped automatically from the disclosures).
Other incidents at ローソン
Same attack method
- SSソースネクスト2026.10.15 announced・Affected 22,519,960 records
- SSバーガーキング・ジャパン(公式アプリ)2026.10.15 announced・Affected 11,180,000 records
- SS焼肉きんぐ2026.10.05 announced・Affected 10,788,963 records
- Bユミルリンク（メール配信システム）2026.10.19 announced・Affected 9,000,000 records
- SSタイムズカー(タイムズモビリティ)2026.09.25 announced・Affected 6,600,000 accounts
- Sブックオフグループ(ブックオフコーポレーション)2026.10.09 announced・Affected 6,383,279 people
Same industry
- SSEストアー(ショップサーブ)2026.10.16 announced・Affected 23,356,000 people
- SSコミューン（Commune・Commune for Work）2026.10.09 announced・Affected 307,000 people
- SSIDCフロンティア（IDCFクラウド）2026.10.07 announced・Affected 48 records
- SS楽天ドライブ2026.10.06 announced・Affected 15,382 accounts
- SSHelpfeel（Gyazo）2026.09.16 announced・Affected 23,620,000 records
- SPingCAP2026.10.21 announced・Affected 50,000 people
Attack method classification: Unauthorized access (method undisclosed)(Breached, but the technique was not identified or disclosed)
Read the Unauthorized access (method undisclosed) guide and national trends →