Nojima breach: about 7 million member records leaked from its online shop and phone buy-back site, encrypted passwords included
Nojima said in a notice dated November 2, 2026 that unauthorised access to the member system behind Nojima Online and its used-smartphone buy-back site leaked about 7 million member records: names, addresses, dates of birth, phone numbers, login IDs, encrypted passwords and email addresses; no credit card data was held on either site, and on November 3 the company forced a password reset for customers it suspects are affected.
What happened
Nojima, the Japanese electronics retailer, said in a notice dated November 2, 2026 that it detected unauthorised access to the member management system behind its two online sites — Nojima Online, its online shop, and its used-smartphone buy-back site — on Sunday, November 1, and confirmed the same day that registered member information had leaked outside its systems. The company puts the leak at about 7 million member records, not counting members who had already closed their accounts. Both sites have been suspended and will stay offline until Nojima has confirmed they are safe. The company says it has blocked outside access, stepped up monitoring, consulted the local police, and is preparing its report to Japan’s Personal Information Protection Commission and other bodies. It has not said how the attacker got in, and says whether the leaked data has been misused is still under investigation. In an update on November 3, Nojima said it had forced a reset of login passwords for customers it suspects are affected.
Who is affected
Members of Nojima Online and of Nojima’s used-smartphone buy-back site — about 7 million records in total, excluding people who had already withdrawn. For each member, the leaked information is: name (in kanji and kana), date of birth, gender, postcode, home address and phone number, plus login ID, encrypted password and email address. Nojima says neither site retains payment data, so no credit card information was held there or leaked.
How serious
The concrete risks are impersonation fraud and account takeover. A real name, home address, date of birth and phone number are enough to make a fake delivery notice, repair callback or buy-back message sound genuine — Nojima’s own notice warns that the leaked information could be misused in impersonation emails, texts and calls. The passwords were stored encrypted, but Nojima has not said how, and encryption that can be reversed is weaker than strong one-way hashing: if those passwords are recovered and a member used the same one elsewhere, other accounts are exposed. The forced reset protects the Nojima accounts themselves; it does nothing for any other service where the same password was reused.
What to do now
Complete Nojima’s forced password reset through the official Nojima Online notice page — go to the site yourself rather than through a link in an email or text, enter your registered email address and phone number, and set a new password that is hard to guess and not used anywhere else. Then change the password on every other account where you used the old one, starting with email and shopping accounts. Treat unexpected messages about Nojima deliveries, repairs, refunds or buy-back payments with suspicion and do not open unfamiliar links or attachments. If you are unsure whether a message is genuine, contact the Nojima Customer Centre on 0120-574-853 (9:30–19:00 Japan time).
Sources: Nojima, “Apology and notice regarding personal data leak following unauthorised access to Nojima Online” (PDF, Japanese), November 2, 2026 · TSN, “Nojima Data Breach Exposes About 7m Member Records”, November 3, 2026