Now Hacked
EN
Data breach

istyle’s @cosme breach exposes personal data of about 3 million members

First reported · Last reported · 19 related reports

On October 28, unauthorized access by a third party exposed some shared ID membership information on @cosme, the Japanese beauty platform operated by istyle. The exposed data included names, addresses, phone numbers, email addresses, dates of birth, and skin and hair types of about 3 million members, including former members. istyle announced the incident on November 2, and an external security firm is investigating its cause and scope. Login passwords and card information were not among the exposed data.

Key facts

Affected organization
istyle
Incident type
Data breach
Occurred / detected
2026-10-28
Scale of damage
Personal information of about 3 million members, including former members
Cause / method
Unauthorized access by a third party
Location
Japan

If your data was exposed

Exposed dataNamePhone numberEmailAddressDate of birth

  1. Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.

Timeline

  1. Unauthorized access by a third party led to the external disclosure of some @cosme shared ID membership information.
  2. istyle announced the exposure of personal information of about 3 million people and conducted an investigation through an external security firm.

19 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.