eBay-Owned Japanese Marketplace Qoo10 Confirms Customer Data Breach
eBay-owned Japanese marketplace Qoo10 has confirmed a data breach potentially exposing customers' personal information, including names, addresses, geographic coordinates, physical characteristics and customer profiling data, but has not disclosed how many accounts were affected or how the unauthorized access occurred.
According to a security notice published November 12, an outside third party gained unauthorized access to Qoo10's systems on November 6 and viewed some customer information. The company says it has blocked the unauthorized access, invalidated authentication tokens that may have been improperly issued or used, forcibly logged out potentially affected accounts to prevent further exposure and is continuing to investigate the incident.
The notice, translated from Japanese, identifies a broad range of personal information that may have been compromised, including names, nicknames, email addresses, phone numbers, birth dates, gender, account identifiers, profile information, home and delivery addresses, geographic coordinates associated with those addresses, customer segmentation data, voluntarily provided physical characteristics, IP addresses, personal notes and Qoo10 points balances.
The company says it has not found evidence that payment information or passwords were leaked, but warned customers about possible impersonation attempts, suspicious phone calls, text messages and phishing emails.
Qoo10 is operated by eBay Japan, which acquired the marketplace from Giosis in 2018. The marketplace has grown significantly under eBay ownership, surpassing 30 million registered members in the first half of 2026, with projected annual gross merchandise volume of approximately ¥350 billion.
The marketplace has also been expanding its personalized beauty-shopping features through a partnership with Perfect Corp., introducing virtual contact lens try-on technology in August that allows customers to use smartphone cameras to see how different colored lenses would look on their eyes. AI skin analysis functionality was added by September, using facial images to evaluate ten skin characteristics, including moisture, oiliness, pores, acne, wrinkles and dark circles, and provide personalized skincare recommendations.
Perfect Corp. publicized the integration in November, but Qoo10 has not explained whether facial images or skin analysis results generated through these features are retained by the marketplace, or whether that information falls within the physical characteristics and customer profiling data identified in the breach disclosure.
パーフェクト株式会社
The company previously faced account security concerns in September 2025, when it acknowledged complaints from customers reporting unfamiliar login activity.
At the time, Qoo10 said it had found no evidence of unauthorized access to its own systems or leakage of customer data, suggesting that third parties may have attempted to access accounts using email addresses and passwords compromised through other websites. The company subsequently introduced two-factor authentication in September 2025.
