Hana Cupid, a Tokyo florist network that delivers bouquets nationwide, said on Oct 28, 2026 that an unauthorized third party accessed its systems and exposed the member records of up to 4,238,242 people, ITmedia News reported.
The data came from the company's two online shops: Internet Hana Cupid, which serves individual customers, and Business Hana Cupid, which serves corporate clients. The exposed fields are login user IDs, hashed passwords and email addresses, including separate addresses registered for PC and mobile.
Hana Cupid said names, gender, dates of birth, postal addresses, phone numbers, company and department names, and recipient delivery details were not exposed. The company is based in Shinagawa Ward, Tokyo.
Who is affected
Anyone who registered an email address on the official online shops may be affected, including people who have since closed their accounts. Customers who ordered through outside shopping malls, who placed orders by phone without registering an email address, or who bought from a Hana Cupid member florist are not affected, the company said.
The intrusion ran from Oct 14 to Oct 15, 2026, and the company confirmed the leak on Oct 19. It has cut off the route the attackers used and tightened network access controls and monitoring.
Hana Cupid said it has found no sign so far that the stolen data has been misused. It began emailing affected users on Oct 28 and has reported the breach to the Personal Information Protection Commission and to police. An outside specialist firm is investigating the cause.
Password reuse in the frame
The company is urging users to change their passwords, and to change the same password anywhere else they have reused it. It also warned customers to watch for phishing emails that pose as messages from Hana Cupid or from financial institutions.
Passwords were stored hashed, meaning they were scrambled rather than kept in plain text. That reduces but does not remove the risk, particularly for short or common passwords that can be guessed from a hash.
The breach follows a run of similar incidents at Japanese companies. Japan Airlines said about 90,000 people had booking data exposed, including passport numbers in some cases, and Yakult's corporate site has been offline since an unauthorized access was detected.