Treasure Factory said its consolidated subsidiary has finished investigating a personal-data leak and confirmed that 136,464 people were affected, 109,311 of them with address information included. The Tokyo Prime-listed retailer reported the findings in the third notice on the incident, dated October 13, 2026.
How the data left
The subsidiary cross-checked the phishing email, the log of the employee PC that received it and the access and operation history held by the operator of its e-commerce platform. It says this traced both the route of the intrusion and how the information was taken out.
The cause, as stated in the first report, was theft of staff-account credentials through a phishing email. The subsidiary lists management weaknesses it recognises: two-step authentication had not been set up, and its choice of authentication method and account protection premised on phishing attacks, its design of the permission to export customer information in bulk, and its monitoring to spot important operations early were all insufficient.
The leaked data items are unchanged from the August 28, 2026 announcement. Credit card information and e-commerce login passwords were not included.
What has been fixed
At the subsidiary, all staff accounts now use two-step authentication based on passkeys, which the notice describes as designed with phishing resistance in mind. The company has also taken stock of accounts, limited who can bulk-export customer information, and revised confirmation and internal escalation for important operations. Security manuals, training including phishing drills, periodic permission reviews and monitoring are being put in place in sequence, so those items are still in progress.
At group level, Treasure Factory has drawn up security guidelines for all group companies. They require multi-factor authentication on external tools that hold personal data, restrict bulk export of customer data and call for targeted-email drills. Each group company has named an information security officer. The group has also revised its CSIRT (cyber incident response team) policy to cover all companies and set up a liaison council of those officers. A first review of accounts, permissions and authentication on external tools across the group took place in September, and items rated high-risk are being corrected.
Regulator and police
The subsidiary filed its final report with the Personal Information Protection Commission on October 6, 2026. It has consulted the police and is working toward filing a damage report. The notice presents the filing as a company step; it records no finding or penalty from the commission.
Treasure Factory says no misuse of the personal information or other concrete secondary harm has been confirmed so far. It reports costs for running a dedicated inquiry line, says the effect on group results is minor, and leaves its forecast for the year ending February 2027 unchanged. The notice gives no figure for those costs.