Cosme Data Breach Exposes 3 Million Users as Skin and Hair Data Leaks

Unauthorized intruders infiltrated the central customer database of @cosme, Japan’s largest cosmetics and beauty review platform, exposing the personal identity records and dermatological profiles of approximately 3 million registered members. In a mandatory incident disclosure filed by parent operator istyle Inc. (Tokyo Stock Exchange: 3660.T), executives confirmed that the breach compromised @cosme Common ID accounts on October 28, 2026. The company reported the intrusion immediately to Japan’s Personal Information Protection Commission (PPC).

While corporate security notices routinely downplay retail leaks that exclude credit card numbers, the @cosme intrusion exposes a uniquely permanent combination of physical coordinates and biological phenotype attributes. Attackers harvested legal names in both Kanji and Kana scripts, postal codes, residential street addresses, telephone numbers, email addresses, exact dates of birth, and registered gender alongside each member’s self-reported skin type and hair type telemetry. Consumers cannot reset their date of birth or biological skin classification.

Investigators retained by istyle Inc. verified that login password hashes and payment card numbers were stored on segregated infrastructure and remained untouched during the intrusion. However, security analysts tracking recent Asia-Pacific third-party platform breaches warn that combining verified residential addresses with granular cosmetic profile data creates an ideal dataset for targeted social engineering. In its official filing, istyle Inc. stated that external forensic specialists are auditing server access logs to determine the exact entry vector while individual warning notices go out to all three million affected account holders.

What Leaked in the @cosme Data Breach: 3 Million Member Profiles and Phenotype Records

The @cosme data breach exposed 11 distinct personal and dermatological data fields belonging to approximately 3 million @cosme Common ID holders, while login passwords and credit card numbers remained isolated in separate vaults.

Operated from Tokyo’s Akasaka district, istyle Inc. runs an integrated e-commerce and retail ecosystem spanning online reviews, `@cosme SHOPPING`, and flagship brick-and-mortar stores across Japan and East Asia. To unify customer loyalty points and personalized product recommendations across those channels, the company links accounts through a centralized identity layer known as the `@cosme Common ID`. When intruders bypassed perimeter access controls in late October 2026, they reached the database tables housing those unified member records.

Unlike standard credential dumps that only pair an email address with an encrypted password, the compromised @cosme tables link digital contact channels directly to physical household locations and personal care attributes. Forensic disclosures confirm that the leaked dataset includes system-generated user identifiers, platform nicknames, full legal names in Kanji and phonetic Kana, postal codes, street addresses, phone numbers, email addresses, gender, birthdates, skin classifications, and hair characteristics. Every exposed field increases impersonation accuracy.

How Attackers Weaponize Leaked Skin, Hair, and Home Address Telemetry

At first glance, stolen information about whether a consumer has dry, oily, combination, or atopic skin—or fine, coarse, or chemically treated hair—appears far less dangerous than a stolen bank routing number. In modern cybercrime ecosystems, however, threat actors prize intimate lifestyle and biological metadata because it defeats human skepticism during secondary extortion and phishing campaigns. Fraud rings weaponize specificity.

When underground brokers combine a victim’s real Kanji name, home postal address, mobile phone number, and exact dermatological profile, automated AI-assisted social engineering toolkits can generate hyper-personalized lures that bypass conventional spam filters. Because @cosme frequently ships promotional skincare samples and beauty subscription boxes to registered members, attackers can impersonate brand fulfillment teams with near-perfect credibility. Security teams advise affected users to defend against four primary exploitation vectors:

• Phenotype-Tailored Delivery Smishing: Scammers dispatch SMS and email alerts referencing a member’s exact skin or hair classification, claiming a customized @cosme sample parcel requires a small customs or redelivery card fee.
• Physical Mail & Cash-on-Delivery (COD) Fraud: With verified Japanese postal codes, street addresses, and legal Kanji names exposed, criminal groups can dispatch unsolicited high-margin cosmetics via Cash-on-Delivery schemes targeting household family members.
• Cross-Platform Identity Verification Bypass: Japanese telecommunications providers and financial help desks still frequently rely on full name, date of birth, registered address, and telephone number to authenticate account recovery requests.
• Credential Stuffing via Nickname and Email Correlation: Even though @cosme passwords did not leak, attackers cross-reference the 3 million exposed email addresses and birthdates against prior third-party credential dumps to hijack accounts on competing retail portals.

Why Consumer Beauty and Health Portals Have Become High-Value Intelligence Targets

The compromise of istyle Inc. reflects a broader shift in adversary targeting toward specialty consumer platforms that accumulate health-adjacent personal telemetry without enforcing defense-grade zero-trust segmentation. Over the past decade, beauty technology companies have encouraged millions of users to log sensitive dermatological conditions, allergy sensitivities, age brackets, and facial attributes to power algorithmic recommendation engines. Yet many retail databases store these permanent biological markers in the same flat relational tables that handle marketing newsletters.

Under Japan’s amended Act on the Protection of Personal Information (APPI), operators that suffer an unauthorized disclosure affecting more than 1,000 individuals—or any incident carrying a risk of secondary financial or personal harm—must file both a preliminary notification within 3 to 5 days and a comprehensive forensic report within 30 days. Warnings issued by the Information-technology Promotion Agency (IPA) and JPCERT/CC emphasize that e-commerce identity repositories remain a top target for automated web-application harvesting.

“Following confirmation of unauthorized third-party access on October 28, istyle Inc. reported the incident to the Personal Information Protection Commission, engaged external cybersecurity investigators to audit affected systems, and initiated direct notifications to approximately 3 million @cosme Common ID members while confirming that login passwords and credit card details were not compromised.”

— istyle Inc. Official Security Disclosure & Regulatory Notice, Tokyo, Late October 2026

Mandatory Verification Steps and Japan’s APPI Enforcement Horizon

While istyle Inc. reported that no confirmed cases of secondary financial fraud had surfaced as of early November 2026, the permanence of leaked residential addresses and birthdates requires long-term vigilance from anyone who registered an `@cosme` account. Members should ignore any email or SMS message requesting credit card verification for beauty sample shipments, verify official notices exclusively inside the authenticated `@cosme` mobile application, and audit other Japanese e-commerce accounts that share the same email address or telephone number. Under the statutory 30-day APPI post-incident reporting mandate overseen by Japan’s Personal Information Protection Commission, istyle Inc. faces a late-November 2026 regulatory deadline to submit its final root-cause forensic audit and permanent database access controls, a filing that will set the compliance benchmark for consumer beauty platforms across Asia heading into the Q1 2027 audit cycle.