Seven-Eleven Japan says 7NOW customer data was taken in CBcloud PickGo breach, 169,151 records

Seven-Eleven Japan announced on November 3, 2026 that customer information from its 7NOW delivery service was taken by a third party after unauthorized access to PickGo, the delivery platform run by its contractor CBcloud. CBcloud confirmed the access on November 1, exploiting a system flaw and a compromised account, and published its first report on November 2. The confirmed 7NOW total is 169,151 records by category: 164,180 with kana name only, 4,762 with name and address, and 209 with name, address, phone number and postal code. Some records also included order date, store and product details. No credit card information or passwords were taken, and no misuse has been confirmed so far.

CBcloud blocked the access source, stopped the compromised account and fixed the flaw, and 7NOW is operating normally, with affected customers to be contacted by SMS. The same PickGo access also affected Demaecan, where names on 799 records and smaller overlapping address and phone subsets were taken; those category counts overlap and are not added to the 7NOW total counted here.

Sources: Security Measures Lab (Rocket Boys); TBS News Dig via Docomo Topics