Lawson data breach exposes 2.16M Lawson ID users

Japan convenience store Lawson finds unauthorized access

The Lawson data breach hit two of the company's online services, Lawson ID and Lawson App Reservation, and the company disclosed it on October 8, 2026. Lawson runs one of Japan's major convenience store chains. Lawson ID is the account customers use to sign in to the Lawson app and the company's web services.

Days earlier, a Japanese barbecue chain disclosed a similar app member leak. We covered it in Yakiniku King data breach hits 10.79M app members.

October 7 investigation found unauthorized access

Lawson found the intrusion during an internal investigation on October 7, about three and a half weeks after it began. The company says it found no other unauthorized access and no malware infection. The dates in Lawson's notice are below.

From intrusion to disclosure (based on Lawson's notice)

Date (2026)	What happened
September 12–14	Unauthorized access to Lawson ID
September 17	Unauthorized access to Lawson App Reservation
October 7	Lawson's investigation uncovers the access
October 8	Lawson publishes its notice and apology

Some English-language summaries give the period as September 12 to 17 for both services. Lawson's notice lists the two services separately.

Email addresses for 2.16M users, credit card digits for 26

What leaked depends on which service you used. Every one of the 2,155,345 Lawson ID records exposed an email address and a name. The other items were exposed only when a user had entered them.

Lawson gives one example of when users would have entered those extra details: applying for a giveaway with their Lawson ID. Some summaries say home addresses, gender and partial card numbers leaked for all 2.15 million users. Lawson's notice does not support that.

Reservation app leak included partial credit card numbers

Lawson App Reservation lets customers reserve and pay for seasonal event items in the Lawson app ahead of time. Its 26 leaked records held names, phone numbers and part of each card number. These 26 records are the only ones in the incident that contained any card data.

Investigation points to unauthorized access in the app

Lawson believes the leak came from misuse of a system connected to the Lawson app. A third party got into the security mechanism that is supposed to show each user only their own information in the app. Lawson has not said how the attacker pulled the data out.

Reservation app paused and Japan's regulator notified

After finding the access, Lawson blocked the suspicious sources and switched off the reservation feature. It also posted a notice in the app and reported the incident to the authorities. That includes the Personal Information Protection Commission, Japan's privacy regulator.

Lawson plans to tighten security and monitoring on the affected system and to improve how it handles incidents. Lawson App Reservation should come back in mid-October, and the company will post an update on its website when it does.

Separate spam email incident at Lawson Japan on October 1

A week before this disclosure, on October 1, Lawson reported that someone had misused its mail server. About 700,000 suspicious English-language emails went out between roughly 3 p.m. on September 25 and 5:15 p.m. on September 27, Japan time. Most went to overseas addresses.

At that point Lawson said it had found no leak of personal data. The October 8 notice does not mention the mail server incident, and Lawson has not linked the two.

Phishing email and calls to your phone number: what to watch

Lawson has not confirmed any misuse of the leaked data so far. Still, it asks Lawson ID users to be careful with suspicious emails, text messages and phone calls sent to the contact details they registered. Phishing means messages that pose as a real company to lure people to a fake site and get them to type in personal details.

Lawson is emailing affected users one by one. The sender name is "Lawson ID Mail" and the address is lawson_id@mailservice.lawson.jp. Questions about the incident go through a dedicated form at the Lawson Customer Center, which is in Japanese.

For Lawson ID users, the practical step after this Lawson data breach is to treat unexpected messages that claim to come from Lawson with suspicion. Compare the sender with the address above before you click any link.