Rohto Pharmaceutical breach leaks data on 2,797,545 people

Rohto Pharmaceutical announced on November 6, 2026 that unauthorized use of an account for the telephony system used in its mail order business gave a third party access to that system and to its customer management system, and that personal information on 2,797,545 people was leaked: names, addresses and phone numbers, with the items varying by person. Call audio from mail order telephone support was also taken, covering calls from September 2025 to September 2026, and for 9,715 people that audio included credit card numbers and expiration dates; security codes were not asked for or stored, so they were not included.

Rohto received a report of suspicious access from the telephony system provider on September 10, 2026, suspended the relevant accounts and changed passwords, and reported the incident to the police on September 14 and to the Personal Information Protection Commission on September 15; its September notices reported possible access only, and the November 6 announcement is the first to confirm the leak and its scale. The company says no secondary damage from misuse has been confirmed so far, affected people are being notified individually, the practice of taking card numbers by phone has been discontinued, and card issuers have been asked to monitor the affected cards and to reissue cards without cost to customers. SecurTek counts the 2,797,545 figure in the records exposed total because Rohto states it as a confirmed leak, not a maximum.

Sources: SmartScope; Jiji Press via AVA Fund