---
title: Tip: Japan retail/EC breach cluster (BK / Yamato / FANCL / WASABI / Comic Seima) — expect credential-stuffing + order-detail phishing | ctxsec
url: https://ctxsec.com/items/tip-japan-ec-phishing-wave-oct-16
description: ""
status: "tip"
published: 2026-10-16
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-japan-ec-phishing-wave-oct-16.md)

tip

2026-10-16

### Tip: Japan retail/EC breach cluster (BK / Yamato / FANCL / WASABI / Comic Seima) — expect credential-stuffing + order-detail phishing

Multiple Japanese consumer brands confirmed member/order leaks this week. Practical steps for SOC/IR and for users: (1) treat any email/SMS/LINE that cites real order fields (item, amount, address) and pushes refunds, password resets, or "verify account" as hostile until verified via the app/site you already trust; (2) force password resets + MFA for affected tenants and watch for credential stuffing on SSO; (3) for platforms that store merchant API keys (e.g. WASABI SWITCH), rotate those keys and restrict egress; (4) brief helpdesks that callers will know partial PII — knowledge of DOB/phone is not proof of identity.

Sources: [FANCL/ATENEA PDF](https://www.fancl.jp/news/pdf/husei.pdf) · [WASABI SWITCH Oct 16 notice](https://wasabi-inc.biz/help/news/20261016-01/) · [NTT Solmare Comic Seima](https://www.nttsolmare.com/press/2026/1016.html)