Yellow Hat has put the number of members affected by the breach of its web service-booking system at 1,797,124, and says more kinds of personal data were taken than it first reported. The Tokyo Prime-listed auto-parts retailer set out the findings in a second report dated 15 October 2026.
Count down, scope wider
The first report, dated 28 August 2026, gave a maximum of 1,801,499 people. Log analysis has now fixed the actual figure at 1,797,124 members of Yellow Hat's membership programme.
The exposed fields grew. The leaked data comprises names, addresses, birth dates, gender, telephone numbers, email addresses, membership numbers, login IDs and passwords held in a form that cannot be restored. Addresses, birth dates, gender, login IDs and the passwords were added after the first report.
The company says the passwords are stored so that they cannot be restored, and that there is therefore no risk of account misuse from that information. The report does not say how the passwords were protected.
Credit card data was not leaked, Yellow Hat says: the booking system does not hold or handle card details, and payments in stores and on its online shop run through external systems.
Forensics and restart
A third-party investigator carried out forensic analysis of the booking system and its access logs and, the company says, completed the work of establishing the cause and the extent of the impact. Forensic analysis examines the logs and data left on devices to reconstruct an incident. The investigation confirmed that an intrusion into the system sent some customer data outside the company.
Yellow Hat detected the unauthorised access on 19 August, then shut down and suspended the system. It resumed operation after security upgrades and system changes. The company says the third-party investigator's verification confirmed those measures work, and that it will keep running regular vulnerability assessments. The report does not name the intrusion route.
Regulator and cost
Yellow Hat says it has finished submitting its final report to the Personal Information Protection Commission and will keep cooperating with the commission and with the police, who are investigating. It does not expect the response and countermeasure costs to have a material effect on its results.
Affected customers have been notified by web, email, post and telephone, and a dedicated helpline (0120-405-092, weekdays 10:00 to 19:00) remains open. The company warns members to avoid links and attachments in suspicious emails or text messages.