FANCL and subsidiary ATENEA published a joint Oct 16 notice: internal investigation on Oct 15 found unauthorized access to both companies' e-commerce sites from Oct 3–10, with some member data leaked externally. Scope: FANCL 393,785 records / 368,184 people; ATENEA 441,162 records / 417,312 people (~785K people combined). Exposed fields include email, name, address, phone, DOB, gender, customer number, hashed secondary passwords (main passwords excluded), and marketing/point flags. Payment/credit-card data was not in scope. No secondary misuse confirmed yet. Companies stopped the abused function, stood up an emergency HQ, and reported to Japan's Personal Information Protection Commission and police on Oct 16. Parent Kirin Holdings filed an IR disclosure the same day. Treat phishing SMS/email impersonating FANCL/ATENEA as high risk.