Overview
The access was identified October 27. Data exfiltration and some alteration were confirmed. Fields also included age, gender, member IDs and measurement times. The figure is records, not people. Face images were not among the confirmed exposed data, and the system did not handle card details. Precautionary suspensions of other services do not establish exposure in those services.
Timeline
- Occurred
- Discovered
- Disclosed
Unauthorized FCA access was identified and some skin-analysis services were suspended.
The company disclosed 2,515 exposed records.
Organization response
Shiseido suspended some skin-analysis services, investigated with developers and outside experts, reported to the privacy regulator and police, and planned individual contact where recipients could be identified.
What you can do
Beware of impersonation and do not enter personal or card information through suspicious links.
Sources
- 当社肌測定システムへの不正アクセスによる個人情報漏えいに関するお詫びとお知らせ株式会社資生堂 · 2026-11-09