This is an editorial image representing flower e-commerce and information security. It does not reproduce a real system screen or attack.
Importance: High. Hana-Cupid Co., Ltd. announced on October 28, 2026 that unauthorized access to systems serving Internet Hana-Cupid and Business Hana-Cupid resulted in a leak of some member information. Up to 4,238,242 records may be affected.
Timeline
- October 14–15: A third party gained unauthorized access to the company’s management system.
- October 19: The company confirmed the member-data leak during its investigation.
- October 28: The company published its notice and began contacting affected members.
Data involved and scope
The company lists user IDs, passwords, desktop email addresses, and mobile email addresses as the affected fields. It says the passwords were stored in a form that cannot be restored or decrypted.
According to the notice, names, sex, dates of birth, addresses, telephone numbers, credit-card numbers, company and department names, and delivery-recipient information were not leaked. The scope covers members who registered an email address through the official e-commerce sites. Orders placed through external marketplaces, telephone orders without an email registration, and purchases made at Hana-Cupid member shops are outside the stated scope. Some former members are also being notified.
What users should check
- If you may be affected, change the password through the official site.
- If the same ID and password are used elsewhere, change those credentials too.
- Do not open links or attachments in suspicious messages claiming to be from Hana-Cupid or a financial institution.
- Do not provide passwords, card numbers, PINs, or authentication codes in response to email, SMS, or phone requests.
The company says the affected database did not store credit-card information and that this incident alone does not require immediate card cancellation or reissue. At the time of the announcement, it had not confirmed secondary misuse linked to the incident.
Current response
The company says it blocked the route used for the unauthorized access, strengthened network access controls and monitoring, and had not observed new suspicious behavior at the time of publication. It reported the incident to Japan’s Personal Information Protection Commission and the police, and is continuing its investigation and permanent remediation with external specialists. The reviewed notice does not disclose the detailed intrusion method.
Why this matters to the flower industry
Flower e-commerce supports birthdays, condolences, corporate gifts, and other relationship-sensitive occasions. The company says names, addresses, recipient details, and payment information were outside this leak, but the possible exposure of more than four million login and email records makes phishing and credential reuse an industry-wide concern.
Checks for flower-related businesses
- Map the personal data retained in e-commerce, reservations, customer management, and order systems, including retention periods.
- Review why credentials for inactive accounts are retained and how they are deleted or anonymized.
- Check multi-factor authentication, privileges, access restrictions, monitoring, and backups for administrative systems.
- Prepare incident escalation, customer notice, inquiry handling, and recovery procedures, including those involving vendors.
HANAMUSUME will update this report if a new official announcement changes the stated scope or response status.
