charm-2026 · Disclosed 2026-08-13
チャーム: unauthorized access and impact
The online store was accessed without authorization; credential acquisition has not been identified. After review, about 370,000 records are confirmed leaked and 20,000 remain uncertain; 239 user accounts were accessed.
Outcome: Confirmed breach
Entry path and evidence
Timeline
Disclosure date established by the reviewed notice. [s1]
Reported response
- Reported fact
Affected people are being notified and password changes requested.
[s1]第3報 9月2日更新 / §§1-3
Cause and mitigation hypotheses
Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.
Evidence relevant to prevention
Insufficient evidence
Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules.
Editorial assessment; not a determination of liability. [s1]
Unknowns and AI involvement
The reviewed disclosures do not establish attacker use of AI.
Retired and duplicate accounts prevent converting record counts to unique people. Initial entry is undisclosed.
Sources
[s1] チャーム · Primary source
チャーム：事故に関する公表資料 ↗Reviewed 2026-10-09