eBay-Owned Japanese Marketplace Qoo10 Confirms Customer Data Breach - Value Added Resource

According to a security notice published November 12, an outside third party gained unauthorized access to Qoo10's systems on November 6 and viewed some customer information. The company has blocked the unauthorized access, invalidated authentication tokens, forcibly logged out potentially affected accounts, and is continuing to investigate the incident.

Exposed Information

The notice identifies a broad range of personal information that may have been compromised, including names, nicknames, email addresses, phone numbers, birth dates, gender, account identifiers, profile information, home and delivery addresses, geographic coordinates, customer segmentation data, physical characteristics, IP addresses, personal notes and Qoo10 points balances.

Security Measures

The company says it has not found evidence that payment information or passwords were leaked, but warned customers about possible impersonation attempts, suspicious phone calls, text messages and phishing emails. Qoo10 previously faced account security concerns in September 2025 and introduced two-factor authentication at that time.

Marketplace Background

Qoo10 is operated by eBay Japan, which acquired the marketplace from Giosis in 2018. The marketplace has grown significantly under eBay ownership, surpassing 30 million registered members in the first half of 2026, with projected annual gross merchandise volume of approximately ¥350 billion.

The marketplace has been expanding personalized beauty-shopping features through a partnership with Perfect Corp., introducing virtual contact lens try-on technology in August and AI skin analysis functionality by September. However, Qoo10 has not explained whether facial images or skin analysis results are retained by the marketplace or fall within the breached data categories.