SHINDO3

UNIQLO

FAST RETAILING CO., LTD.

Unauthorized accessSize not disclosed

POSSIBLE LEAKPhone number / Full nameContained

Open in the live monitor ▶
Disclosed
Mar 19, 2025
Detected
Sep 13, 2024
Detection to disclosure
187 days
Leak
Leak possible
Type
Unauthorized access
Status
Contained
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityFull name
ContactPhone number, Email address
Employment & HREmployee number, Department

Who is affected

  • Staff of businesses that traded with the company from January 2018 to May 2021
  • Employees at UNIQLO and GU stores from April 2023 to September 2024
  • Employees at the head office from May 2018 to September 2023

Cause

The system was breached because of a flaw introduced when the contractor running it changed network settings

Timeline

  1. Detected
  2. Date of the Security NEXT report (earliest disclosure seen)

Response

  • Service stopped
  • Forensic investigation

Stopped the system and investigated with outside help

What you should do

  1. Don't open links in emails from this company. The apology email itself may be fake
  2. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  3. Expect targeted phishing posing as HR or interview contacts
  4. Check the company's notice to see if you're affected

Lessons for companies

  1. Put security requirements, audit rights and reporting deadlines in vendor contracts
  2. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  3. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources