Lawson Japan Data Breach Exposes 2.15 Million Customer Records
In short
Lawson disclosed unauthorized access to 2.15 million Lawson ID accounts and a smaller App Reservation incident, with email and name data exposed.
The Lawson Japan data breach involved unauthorized access to 2,155,345 Lawson ID accounts between September 12 and 14, 2026. A separate incident on September 17 affected 26 users of the Lawson App Reservation service. The company discovered the activity during a routine inspection on October 7 and publicly disclosed it the next day.
Lawson Japan Data Breach Timeline and Scope
Lawson operates more than 14,000 convenience stores across Japan. The Lawson ID service supports login for multiple apps and web features. Attackers exploited a display mechanism in the system designed for legitimate users, according to the company's statement. No malware or additional unauthorized access was confirmed.
Exposed fields for Lawson ID accounts included email addresses and names for every affected record. Some accounts also revealed gender, phone numbers, addresses, and newsletter preferences when users had provided them for promotions. The App Reservation incident exposed names, phone numbers, and partial credit card numbers for its 26 users.
Lawson notified Japan's Personal Information Protection Commission and began sending individual email alerts from lawson_id@mailservice.lawson.jp. It also posted in-app notices and blocked suspicious access sources. As of October 24, 2026, no confirmed misuse of the data or secondary harm has been reported by Lawson or major outlets.
Response Actions and Practical Steps for Users
Lawson suspended the App Reservation function immediately after discovery and restored full operation on October 19 after implementing security enhancements. Users must update the Lawson app to the latest version to access all features again.
Key actions Lawson took:
- Blocked suspicious IP sources and strengthened monitoring
- Committed to ongoing security reviews and faster incident response
- Resumed App Reservation only after verification of fixes
Affected users should monitor their email inboxes for phishing attempts and verify any messages claiming to come from Lawson. Checking account activity for unexpected changes remains advisable. This incident forms part of several retail and corporate data exposures reported in Japan during late 2026.
| Service | Accounts Affected | Access Dates | Data Exposed |
|---|---|---|---|
| Lawson ID | 2,155,345 | Sept 12–14, 2026 | Email, name; gender/phone/address for some |
| App Reservation | 26 | Sept 17, 2026 | Name, phone, partial card number |
Frequently asked questions
What data was exposed in the Lawson Japan data breach?
Email addresses and names were exposed for all 2.15 million affected Lawson ID accounts. Some records also included gender, phone numbers, addresses, and newsletter settings. The smaller App Reservation incident exposed names, phone numbers, and partial credit card numbers for 26 users.
When did the unauthorized access occur?
The Lawson ID access took place September 12–14, 2026. The App Reservation incident occurred on September 17. Lawson found the activity during a routine check on October 7 and disclosed it on October 8.
Has Lawson resumed the App Reservation service?
Yes. All functions returned on October 19, 2026, after security updates. Users must install the latest version of the Lawson app to use reservations, history, and cancellations.
What should affected users do now?
Monitor incoming email for suspicious messages and verify any Lawson communications. Watch account activity for unusual logins or changes. No confirmed data misuse has been reported as of October 24, 2026.
TrustScope
Comments 1