Rohto Pharmaceutical said on November 6 that personal information belonging to 2,797,545 customers had leaked after unauthorized access to its mail-order system, which the Osaka-based company first disclosed on September 11. Credit card details for 9,715 of those customers were also obtained unlawfully, the company said.
The leaked data, held across multiple customer management systems, includes names, addresses and phone numbers. Which fields apply varies by customer.
Call audio stored in a telephone system was also taken. The recordings cover calls made during part of the period from September 10, 2025, to September 5, 2026, and 9,715 of them contained credit card numbers and expiry dates. Security codes, passwords and other authentication data were not included, the company said.
How the breach unfolded
On September 10, the service provider operating the phone system used for mail-order sales told Rohto of suspicious access. An investigation with an outside specialist firm found that a third party had used account credentials for the phone system to break in, then reached multiple customer management systems through it to take information.
Rohto is contacting affected customers by mail and email in turn. It is working with card companies to monitor for fraudulent use and has asked them to reissue cards at no cost to the customers.
Countermeasures
The company changed the passwords on all related accounts at once. It has also stopped taking credit card numbers over the phone and moved to written payment procedures.
Rohto said no secondary harm from the leak has been confirmed so far.