@cosme Hit by Cyberattack, Exposing Personal Data of ~3 Million Members and Former Members

According to Security NEXT, istyle confirmed on October 28, 2026, that @cosme suffered an intrusion exposing data for some shared-ID members ^[1]. Approximately 3 million individuals were affected, including some former members, with exposed data comprising names, addresses, phone numbers, dates of birth, email addresses, user IDs, nicknames, and skin and hair profile attributes ^[1]. As of November 2, no misuse of personal data or secondary damage had been confirmed; the company has reported the incident to the Personal Information Protection Commission, will notify affected members, and is continuing its investigation ^[1].

Industries mainly affected: Retail

As of November 2, no misuse of personal data or secondary damage had been confirmed; the company has reported the incident to the Personal Information Protection Commission, will notify affected members, and is continuing its investigation ^[1].