Qoo10, an online marketplace in Japan, announced on November 12, 2026 that an outside third party gained unauthorized access to its systems on November 6 and viewed some personal information. The data that may have been viewed includes names and contact details, as well as the "geographic coordinates" of addresses and physical characteristics that users entered voluntarily. The company has not disclosed how many people were affected and says its investigation is ongoing.
The Breach Occurred on November 6 and Was Announced on November 12
According to a notice Qoo10 posted on its official Japanese website, titled "Notice Regarding a Security Incident and Personal Information Leak," an outside third party gained unauthorized access to its systems on November 6, 2026. After detecting the unauthorized access, the company blocked it. It also invalidated all authentication tokens that may have been improperly issued or used, and forcibly logged out accounts that may have been affected.
The notice does not say when the company detected the unauthorized access, nor does it disclose the number of affected members. The company says it is continuing a detailed investigation into the incident. Qoo10 is operated by eBay Japan.
Information That May Have Been Viewed
The notice lists the following information as possibly having been viewed:
- Name and nickname
- Contact information (including email address and phone number)
- Date of birth and gender
- Profile information
- Home and shipping addresses, and the geographic coordinates of addresses
- Customer segment information
- Physical characteristics entered voluntarily by users
- Account identifiers and IP addresses
- Personal notes
- On-site point balances
According to the company, this includes both information obtained through normal transactions and information provided by users themselves.
As for payment information and passwords, the company says it has found no evidence at this time that they were leaked. This is a statement that no evidence has been found so far, not a definitive statement that no leak occurred.
Geographic Coordinates and Physical Traits Are Also Affected
The affected data includes not only addresses and shipping addresses written as text, but also the geographic coordinates of those addresses. Geographic coordinates are numerical values, such as latitude and longitude, that indicate a location on a map. Physical characteristics entered voluntarily by users are also listed, but the notice does not specify what items this refers to.
ITmedia NEWS and other Japanese outlets highlighted the inclusion of these items in their headlines.
Users Urged to Watch Out for Suspicious Contact
Qoo10 warns that secondary harm may occur, such as impersonation by third parties and suspicious phone calls, SMS messages, or emails. It asks users not to open links in emails or messages whose senders cannot be verified.
The notice does not ask users to change their passwords. Shoppers can contact Qoo10's customer support center (help center), and a dedicated inquiry form is available for sellers.
Our Take
The information that may have been viewed includes a full set of details usable for contacting people: names, email addresses, phone numbers, and home addresses. Because customer segment information is also included, we believe there is a risk that the data could be misused in convincing scam emails or SMS messages impersonating Qoo10 or delivery companies.
If you receive a message claiming to be from Qoo10, it is safest not to open any links in it and instead check through the app or a bookmarked official site. Although no password leak has been confirmed, changing your password as a precaution is a good idea if you use the same one on other services. The number of affected people and how the breach was detected have not yet been made clear, and further explanation is expected in future updates.
Summary
Qoo10 announced on November 12 that it suffered unauthorized access from an outside party on November 6, 2026, and that some personal information was viewed. The affected data includes contact details and addresses, as well as address geocoordinates and voluntarily entered physical characteristics, while no evidence of leaked payment information or passwords has been found so far. Users should be wary of suspicious calls, emails, and SMS messages claiming to be from Qoo10.
