On 29 September 2026, Seico Mart Co., Ltd. published two notices saying a third party had gained unauthorized access to the server holding Seicomart Club member data, reached through the server behind its smartphone app. The company says about 570,000 user IDs may have been accessed. Passwords and purchase history are not in scope, according to the company.
What is confirmed
These points come from the company's own notices dated 29 September 2026.
- The company identified the problem on Monday 28 September, shortly after 17:00. The trigger was one account whose club card membership had been cancelled without authorization between 22:00 and 23:00 on Thursday 24 September.
- The company says no other unauthorized cancellations were found.
- At 20:00 on 28 September it cut the connection to the affected server. New sign ups, profile changes, card changes, cancellations and My Page login were stopped as a result.
- Fields that may have been viewed: full name, gender, date of birth, address, phone number, email address, and the dates a member joined and left the club card program.
- Not exposed, per the company: password information and purchase history. The company says it does not hold credit card data.
- The second notice says login through the website, official online shop and online reservation site was also paused as a safety check. Points expiring at the end of September were extended by one month.
- The company said it had not seen unauthorized use of its Pecoma electronic money at the time of the first notice.
What is reported
Japanese security news site ScanNetSecurity summarized the notices on 2 October 2026 and linked both company PDFs. Other outlets repeat the figure of about 570,000 accounts. One outlet gives a more precise count of 572,022, which we could not match to the company text we read, so we use the company's "about 570,000".
What is not known
How the third party got in, whether the single cancellation was the first or only action, how long the access lasted, and whether data was actually copied. The company says the cause and prevention measures will be published once known.
What to do now
- If you are a Seicomart member, treat email and calls that mention the incident with suspicion. The company says it will never ask for passwords, Pecoma card PINs, card or bank details by email.
- If you run a loyalty or membership app, check today whether your mobile API can reach the member database directly, and what a single compromised app server could read.
- Alert on bulk or unusual writes such as cancellations, not only on reads. Here a write was the first visible sign.
- Keep a way to cut one data store off quickly without taking the whole service down.
How this could have been avoided
The cause is not public, so no one can say which single control would have stopped it. What the company's account does show: the app server had a path to the member data server, and an abnormal write was the first signal. Limiting what the app tier can query, giving it narrow service credentials, and alerting on unusual account changes are the general controls that apply to that shape of incident. We will not claim more than that until the company publishes its findings.
Quick check
Why does this post say "may be exposed" and not "were stolen"?
Because the company's wording is that a third party accessed the server and member data may have leaked. It has not said data was copied.
