SHINDO2

AEON Style Online

AEON Retail Co., Ltd.

Software defectSize not disclosed

LEAK CONFIRMEDFull name / Points / member card numberClosed (final report)

Open in the live monitor ▶
Disclosed
Aug 6, 2026
Leak
Leak confirmed
Type
Software defect
Status
Closed (final report)
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityAnother user's name and points balance
Account dataAnother user's name and points balance

Not leaked

  • Credit card information, addresses, phone numbers and the like are not included
  • Credit card information, addresses, phone numbers and the like are not included

Who is affected

  • Users

Cause

A flaw in the system configuration procedure (not unauthorized access or a cyberattack)

Timeline

  1. Exposure began
  2. Exposure ended
  3. First disclosure

Response

  • Config review

Stopped the faulty system process and restored service; the site is operating normally

What you should do

  1. Check the company's notice to see if you're affected

Lessons for companies

  1. Two-person review and pre-release tests for sharing and cache changes; monitor cloud config (CSPM)
  2. Never sit on a known defect. Test every change before production
  3. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  4. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources