Rohto mail-order systems breach affects 2,797,545 customers; 9,715 call recordings included card numbers

Rohto Pharmaceutical said on 6 November that after a mail-order phone-system vendor reported suspicious access in September, it confirmed unauthorized access to the phone system and customer-management systems used for mail order, and that some information it holds — including customer data — had been taken ^[1]. The customer-management systems cover 2,797,545 people, with names, addresses and phone numbers varying by person; call recordings from parts of the period 10 September 2025 to 5 September 2026 include credit-card numbers and expiry dates for 9,715 people, though the company said it does not collect security codes or passwords. It said the phone-system account was used without authorization and that CRM data was taken through that system, that it reported the matter to police on 14 September and to the PPC on 15 September, and that it had not confirmed secondary harm ^[1]. It warned that impersonating or phishing contacts may follow, and said people should not respond to unexpected calls, emails, SMS or post that ask for personal data, PINs or passwords, because it will not request those again because of this incident; customers notified that their card data leaked should check statements from September 2026 onward and contact the issuer on the back of the card about unfamiliar charges ^[1].

Industries mainly affected: Healthcare, Manufacturing

1. Do not respond to unexpected calls, emails, SMS or post that ask for personal data, PINs or passwords; the company will not request those again because of this incident ^[1].
2. If you were notified that card data in a call recording leaked, check your statements from September 2026 onward and contact the issuer on the back of the card about unfamiliar charges ^[1].
3. For questions, call the Rohto dedicated line 0120-610-654 (09:00–18:00 daily, including holidays) or use the official form ^[1].