Cyber Incident Victim: Shiseido Co.
Date:
Dec 2016
Location:
Japan
Summary
A cybersecurity breach at a Shiseido subsidiary's online cosmetics store exposed personal data of approximately 420,000 customers, including names and addresses. The incident potentially compromised credit card information for roughly 56,000 affected individuals. Unauthorized access prompted the company to suspend the compromised online platform and notify law enforcement as well as relevant industry regulators. No operational details about the attack method or perpetrator were disclosed in the initial announcement.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On December 2, 2016, Japanese cosmetics manufacturer Shiseido Co. disclosed a cybersecurity incident involving unauthorized access to the online store operated by its subsidiary IPSA Co. The breach potentially exposed personal information belonging to approximately 420,000 customers, including names and physical addresses. A subset of approximately 56,000 customers faced additional risk as their credit card information may also have been compromised during the intrusion. Shiseido confirmed the breach resulted from illegal access to IPSA's e-commerce platform, which specialized in cosmetic product sales. Following the discovery of the incident, IPSA immediately suspended operations of its online store to prevent further unauthorized activity. The parent company formally reported the breach to law enforcement authorities and Japan’s Ministry of Economy, Trade and Industry, initiating official investigations.
The incident represented a significant data exposure event affecting nearly half a million consumers, with compromised data categories escalating in severity from basic identifiers to sensitive financial details for over 13% of impacted individuals. While the exact method of intrusion remained unspecified in public disclosures, the breach detection prompted immediate containment through system shutdowns. Shiseido’s transparency in disclosing both the breach scale and distinct data categories—distinguishing between general personal information and credit card exposure—provided affected customers with clear parameters of potential risk. No evidence suggested broader corporate network compromise beyond IPSA’s online retail systems. The operational suspension of IPSA’s store reflected a direct business disruption resulting from the incident, though Shiseido did not disclose restoration timelines or additional technical countermeasures implemented post-breach.