Nojima reports about seven million exposed member records and forces password resets

The full field list is names in kanji/kana, birth dates, gender, postal codes, addresses, phone numbers, login IDs, passwords described by the company as encrypted, and email addresses. The notice counts about seven million records and excludes former members; it does not establish a deduplicated victim count. Nojima says these two sites do not retain credit-card data, not that every financial service or system is unaffected.

The company is investigating cause, scope and subsequent misuse. It identifies no password-protection algorithm, exploited vulnerability or restoration deadline. Its November 2 notice says police were consulted and reports to the Personal Information Protection Commission and other bodies were being prepared, not already submitted. Await an official safety/reopening notice; the reset notice alone does not establish full service restoration. L4 reflects the company-confirmed mass data leakage.

November 4 reset guidance: The notice now directs users to enter the email address that will receive the reset link. This replaces the earlier email-and-phone step; it does not establish that every later authentication check was removed. Users unable to identify their registered details or receive the message should use the official inquiry form. After changing the password, My Page provides registration review and a membership-withdrawal request. Nojima also states that store-only Nojima Mobile Member data was not affected; this does not exclude someone who separately registered for the online services. The notice does not announce complete service restoration or reverse the existing leakage.