---
title: Yellow Hat (Japan) final report: 1,797,124 members' data taken from its web service-booking system | ctxsec
url: https://ctxsec.com/items/yellow-hat-breach-final-2026-10
description: ""
status: "confirmed (company filing)"
published: 2026-10-15
---

> 

[← Cybersecurity News](/news) · [markdown](/items/yellow-hat-breach-final-2026-10.md)

confirmed (company filing)

2026-10-15

### Yellow Hat (Japan) final report: 1,797,124 members' data taken from its web service-booking system

Auto parts chain Yellow Hat (TSE 9882) published its second and final report on Oct 15. A third-party forensic review of its web work-reservation system confirmed that customer data was taken, and log analysis put the count at 1,797,124 members, down from the first report's upper bound of 1,801,499. Leaked fields are name, address, date of birth, gender, phone, email, member number, login ID and password; the company says passwords were stored in a non-recoverable form. Address, date of birth, gender, login ID and password were added to the list since the first report. Card data wasn't held in the system. The intrusion was detected Aug 19, the system was shut down and has been restored after hardening, and the final report has gone to Japan's Personal Information Protection Commission. The company warns members about suspicious emails and SMS.

Sources: [Yellow Hat 2nd report (TDnet PDF, Oct 15)](https://www.nikkei.com/markets/ir/irftp/data/tdnr/tdnetg3/20261015/g6jlr0/140120261015551164.pdf) · [FNN](https://www.fnn.jp/articles/-/1134241)