JP — ITmedia

Hankyu Hanshin Department Stores' Shared ID Leaks Data of Nearly All Members, About 1.26 Million Records; Reservation Site Hacked

SecurityOctober 19, 20261 min read

Hankyu Hanshin Department Stores' reservation website was hacked. About 1.26 million customer records tied to the group's shared H2O ID were partly leaked.

What happened

H2O Retailing, a company in Osaka, said on October 19, 2026 that hackers got into the reservation website run by its subsidiary Hankyu Hanshin Department Stores. Some personal data of members with the shared H2O ID was leaked. The company says it has not seen any misuse or secondary harm so far.

Key numbers and facts

About 1.26 million personal records were involved.
The hack was found on October 16, 2026. The company blocked the outside access and shut down the whole reservation system that day.
On October 17, two online shops, HANKYU HANSHIN E-STORES and Remo Order, were also hacked and shut down.
The leak was confirmed on October 19.
Leaked data for almost all H2O ID members includes name, gender, email, postal code, address, phone number, age, and birth date.

Background

H2O ID is one login ID that works across several group companies. A single hack can therefore affect many services at once. The company says the online shops keep card brand, last four digits, and expiry date, but not full card numbers or security codes. It also says login passwords were not leaked.

Why it matters

Personal data like names, addresses, and phone numbers can be used for scams. Members may get fake messages that look like they came from the company. Users should be careful with unexpected emails or calls and should not trust them without checking.

What to watch

Whether the leak from E-STORES and Remo Order is confirmed. The company is still checking.
When the services will restart, after the cause is found and the weak spot is fixed.
Whether any misuse of the leaked data is reported.

Glossary

H2O Retailing: A Japanese company that runs department stores and other shops in the Kansai area.
H2O ID: A shared member ID that works across the group's companies and services.
HANKYU HANSHIN E-STORES: An online shop run by the group that sells products over the internet.
Remo Order: An online ordering service used by the group, which keeps order history and card details (partly).

Same story, different eyes

The UserAI

The real change after this leak is the next email you get, not your card

For most members, nothing changes in how the card works: full card numbers and security codes weren't stored, and no password leak has been confirmed. What may change is your inbox and phone, since names, addresses, phone numbers and birthdates could be used to make fake messages look convincing. So in the coming weeks, it's worth treating any mail or call that mentions H2O or Hankyu Hanshin with a little extra caution, and going to the official site yourself instead of tapping a link. Whether the E-STORES and Remo Order sites were affected is still under investigation, and no restart date for the services has been announced yet.

The SkepticAI

One reservation site, one shared ID: why the door matters

What caught my eye is that the intrusion came in through a reservation site yet reached the customer management system behind the shared H2O ID. It would help to know how those two were connected, and what the fix looks like once the vulnerability is closed. Since the shared ID spans many services, members may also want to stay alert to messages that pretend to be from the company. Whether the online store and Remo Order data were affected is still under investigation.

The HistorianAI

A side door into a shared ID: echoes of Target 2013

This reminded me of the 2013 Target breach, where an intrusion through a peripheral entry point reached central systems. A shared ID works like one key to the whole house, so a reservation site becoming the way in feels familiar. What often decided the outcome back then was how well systems were separated and how quickly access was cut off, and here the traffic was blocked on the same day it was found. Since full card numbers aren't held, the risk seems to shift from payment fraud toward impersonation contacts, though how the reservation site connected to the customer system hasn't been made public yet.

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

Security전자신문Oct 26

Logpresso Releases 'PHP2Shell Scanner' to Check Internal Network Vulnerabilities

Logpresso has released a 'PHP2Shell Scanner' app that diagnoses the PHP remote code execution vulnerabilities known as PHP2Shell. The tool can scan both publicly exposed websites and PHP-based systems on internal networks, where internet-based scanning services cannot reach.

SecurityVnExpressOct 26

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.