Hana Cupid Breach Exposes Up to 4.24 Million Member Records

Hana Cupid, a Tokyo-based flower delivery network, announced on October 28 that attackers gained unauthorized access to its systems and that member data was leaked. The company says up to 4,238,242 records are affected.

The data comes from two services the company runs: the consumer e-commerce site Internet Hana Cupid and the corporate platform Business Hana Cupid. The exposed fields are login user IDs, hashed passwords, and PC and mobile email addresses. According to the company, names, gender, dates of birth, addresses, phone numbers, company and department names, and recipient details were not leaked.

Who is affected

People who registered an email address on the official e-commerce site may be affected, including former members who have already closed their accounts. Customers who ordered through outside shopping malls, those who ordered by phone without registering an email address, and those who bought at Hana Cupid member shops are not covered.

Timeline and response

The intrusion took place between October 14 and 15, and the company confirmed the leak on October 19. It says it has blocked the route used in the attack and strengthened network access controls and monitoring. It has found no sign so far that the leaked data has been misused.

Affected users are being notified by email in stages starting October 28. The company has reported the incident to Japan's Personal Information Protection Commission and to the police, and is working with an external specialist firm to determine the cause.

Hana Cupid urges users to change their passwords, including on any other services where they reused the same one. Because email addresses were exposed, it also warns of phishing messages impersonating the company or financial institutions. Even hashed passwords can be a risk if they are weak or reused, so changing them promptly is the practical step for anyone with an account.