What happened
On October 8, 2026, Lawson, one of Japan's three largest convenience-store chains, announced that personal data from 2,155,345 records of Lawson ID (the single account used in its app and services) leaked after unauthorized access. Another 26 records from Lawson App Reservations (seasonal pre-orders such as Christmas cakes) were also exposed.
According to the company, the access happened September 12–14 (Lawson ID) and on September 17 (Reservations), but was only found in an investigation on October 7, more than three weeks later.
What leaked
- Lawson ID (2,155,345): name and email. For those who entered details in campaigns and prize draws, also gender, phone number, address and newsletter preferences.
- App Reservations (26): name, phone number and part of the credit card number.
- According to Japanese press coverage, no passwords leaked, and as of the announcement there was no confirmed misuse.
How it happened
Lawson says the cause was misuse of a system tied to the app: the security mechanism meant to show information only to the user themselves was accessed by third parties, letting them obtain other people's data. The company did not detail the technique or vulnerability.
In practice, this resembles a very common app flaw class: broken object-level authorization (BOLA/IDOR), where an API returns data for any ID without checking it belongs to the requester. Note: this is our interpretation, not a confirmation from Lawson.
The company says there was no other access and no malware infection. Separately, in late September, Lawson's internal mail server was abused to send suspicious messages; per the press, no link has been confirmed between the two.
Response
- Blocked suspicious access sources and suspended the app's reservation feature.
- Reported to Japan's Personal Information Protection Commission (PPC).
- Individual notices by email from lawson_id@mailservice.lawson.jp.
What customers should do
- Be wary of emails, texts and calls mentioning Lawson or the leak, especially with links or data requests.
- Check that messages come from the official sender, and prefer going through the app or website.
- If you made reservations, watch your card statement.
Lessons for companies with apps
- Every API that returns personal data must check who owns it, on every request.
- Monitor volume and patterns: millions of records pulled in three days is a visible anomaly.
- Cut detection time: three weeks between attack and discovery is too long.
- Collect less data in campaigns; what doesn't exist can't leak.
Japan has seen a run of breaches in October (skyticket, Yakiniku King, Daiichikosho, Bookoff), which makes reviewing consumer-app APIs more urgent.
Sources
- Lawson, official notice (Oct 8, 2026): https://www.lawson.co.jp/contents/cont07/1533174_3310.html
- ITmedia NEWS: https://www.itmedia.co.jp/news/article/2610/09/2000002148/
- Business+IT: https://www.sbbit.jp/article/cont1/187372
Want to review your app's API security? KGA IT offers a free consultation: kga-it.com.