Rohto breach: personal information on 2,797,545 customers leaked, and 9,715 call recordings contained payment card numbers
Rohto Pharmaceutical confirmed on November 6, 2026 that unauthorised access to its mail-order telephone and customer management systems leaked the names, addresses and telephone numbers of 2,797,545 customers, and that call recordings for 9,715 customers contained payment card numbers and expiry dates.
What happened
Rohto Pharmaceutical, the Japanese pharmaceutical and cosmetics company, confirmed on November 6, 2026 that a third party illegally accessed the telephone system and customer management system used for customer service in its mail-order business and illegally obtained customer information held in them. Rohto says the access route was misuse of account information for the telephone system: on September 10, 2026 the provider of that system reported suspicious access, and Rohto suspended the relevant accounts, changed passwords and brought in external experts to investigate. The company published investigation updates on September 11 and 15, reported the incident to the police on September 14 and to Japan’s Personal Information Protection Commission on September 15, and says the external investigation of the telephone system was completed on October 16. The November 6 notice is the first to put confirmed numbers on the incident: 2,797,545 customers in the customer management data, and a separate, smaller group whose recorded calls contained payment card details.
Who is affected
Rohto’s mail-order customers in Japan. From the customer management system, the information illegally obtained was full names, addresses and telephone numbers for 2,797,545 customers — Rohto notes the items vary by person, and for some customers only part of that set was included. Separately, call audio data from the telephone system was obtained: recordings of calls about the mail-order service made in three periods between September 10, 2025 and September 5, 2026, covering product inquiries, order details and other mail-order matters. Some of those recordings contained credit card numbers and expiration dates, because customers read card details aloud when paying by phone; Rohto puts the number of customers in that recording group at 9,715. Rohto says it does not request, acquire or store credit card security codes or passwords, so those were not part of what was taken. The company is sending individual notifications by mail or email based on each customer’s confirmed impact.
How serious
There are two different risks here, and they should not be merged. For the 2,797,545 customers in the management data, the concrete risk is targeted phishing and impersonation: a caller or message that quotes your real name, address and phone number and claims to be Rohto following up on this breach is far more believable than a generic scam, and Rohto itself warns that fraudulent calls, emails, texts and mail exploiting the incident may follow. For the 9,715 customers in the call recordings, the risk is direct payment fraud: a card number and expiration date read aloud on a recording is enough to attempt card-not-present purchases at merchants that do not demand the security code. Rohto says it has confirmed no secondary damage, such as misuse of the leaked information, at this time, and that it is working with card companies to monitor the affected cards — but the recordings cover calls made as long ago as September 2025, so the exposure window is long even though the misuse has not been observed.
What to do now
Wait for Rohto’s individual notice, which states your own impact, and deal with the company only through channels you reach yourself — never through a phone number, link or reply address supplied by an unexpected call, email, text or letter about this breach. Rohto states it will never ask you to enter or provide a PIN or password as part of its response; any message that does is a scam, and you should not call the number it gives, open its attachments or enter information on a page it sends you to. If you are in the smaller group whose card details were in a recording, Rohto’s advice is to check your credit card statements from September 2026 onward for charges you do not recognise and to contact your card company — using the number on the back of your card — if you find any; the company says it has asked card companies not to charge a reissue fee where a replacement card is needed. Everyone else in the larger group mainly needs to treat “Rohto” contact with suspicion from here on.
Sources: Rohto Pharmaceutical, “Apology and Notice Regarding the Leakage of Customer Personal Data Due to Unauthorized Access,” November 6, 2026 · Undercode News, November 6, 2026 (summarising Rohto’s November 6 disclosure)