Now Hacked
EN-GB
Data breach

istyle’s @cosme breach exposes personal data of about 3 million members

First reported · Last reported · 19 related reports

On 28 October, unauthorised access by a third party exposed some shared ID membership information on @cosme, the Japanese beauty platform operated by istyle. The exposed data included names, addresses, phone numbers, email addresses, dates of birth, and skin and hair types of about 3 million members, including former members. istyle announced the incident on 2 November, and an external security firm is investigating its cause and scope. Login passwords and card information were not among the exposed data.

Key facts

Affected organisation
istyle
Incident type
Data breach
Occurred / detected
2026-10-28
Scale of damage
Personal information of about 3 million members, including former members
Cause / method
Unauthorised access by a third party
Location
Japan

If your data was exposed

Exposed dataNamePhone numberEmailAddressDate of birth

  1. Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.

Timeline

  1. Unauthorised access by a third party led to the external disclosure of some @cosme shared ID membership information.
  2. istyle announced the exposure of personal information of about 3 million people and conducted an investigation through an external security firm.

19 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.