Unicolle confirms online store intrusion affecting up to 19,468 registered customers
Uniform retailer THS says an attacker exploited a flaw in its Unicolle store and obtained member data. Up to 19,468 registered customers are in scope. Passwords and credit card information are excluded. The company reopened ordering after repairs and an outside security assessment.
- Disclosed
- Nov 5, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Unicolle customers registered on October 18, 2026, excluding customers who had already withdrawn.
- Unicolle · e-commerce · data breach
- In the wild
- Yes
- THS confirms that an attacker exploited a program flaw and obtained member data.
What happened
THS says an attacker exploited a flaw in its online uniform store on October 18 and obtained member data. The 19,468 figure is the maximum number of customers registered at that point. Fields vary by customer and can include name and kana spelling, member ID, email, date of birth, telephone, postal code, address, mailing-list preference, company name and its kana spelling, individual or corporate classification, industry, and employer. THS excludes passwords, credit card information and the data of customers who had already withdrawn.
THS says it reported the incident to Japan’s Personal Information Protection Commission and is notifying affected members. Its reopening notice confirms ordering resumed November 5 after remediation and an external security assessment. The notice gives no public patch version or detailed description of the exploited flaw.
Crime-scene timeline
Oct 18, 2026
Attacker exploits a flaw in the online store
THS confirms that member information was obtained.
Oct 22, 2026
THS disables the affected program and blocks access
The store temporarily closes.
Nov 5, 2026
THS discloses the breach and reopens ordering
THS reports an upper bound of 19,468 registered customers and announces completed repairs and external security assessment.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- THS November 5 data breach noticePrimaryConfirms exploitation and data access, gives the customer upper bound, lists data fields and exclusions, and describes the response.
- THS November 5 reopening noticePrimaryConfirms the November 5 reopening after repairs and assessment by an external specialist.