23 Daily — On November 6, 2026, Japan's Rohto Pharmaceutical announced further details regarding an unauthorized access incident to its communication sales system previously disclosed on September 11. Investigations revealed personal information of approximately 2,797,545 customers was leaked, including call recordings and credit card information of 9,715 individuals. Source: according to itmedia.co.jp.
Mass Leakage of Personal Data and Call Recordings
The data breach involved multiple customer management systems containing names, addresses, and phone numbers, varying by individual. Alarmingly, unauthorized parties also obtained call audio data stored in the telephone system, covering certain calls recorded between September 10, 2025 and September 5, 2026. Among these, 9,715 call records contained credit card numbers and expiry dates; however, security codes or passwords were not included.
Incident Response and Remedial Actions
Rohto Pharmaceutical received a report from their telephone system service provider about suspicious access on September 10 and collaborated with external cybersecurity experts to investigate. They confirmed that third parties exploited stolen account credentials to infiltrate the telephone and related customer management systems, extracting the sensitive information. Affected individuals are being notified via mail and email. The company is cooperating with credit card companies to monitor fraudulent use and ensure that affected customers bear no costs for card reissuance. To prevent recurrence, Rohto Pharmaceutical has reset all relevant account passwords and suspended credit card number collection over the phone, shifting to a written payment procedure. No secondary damages related to this leak have been reported so far.
Editor's take: Strengthening multi-layer data security is critical for entrepreneurs
This large-scale data breach highlights vulnerabilities businesses still face in protecting customer information, especially when dealing with complex data types like call recordings combined with payment details. For entrepreneurs, the growing digitization of commerce requires establishing robust, multi-layered security defenses. Pragmatic steps include regular password updates, enforcing multi-factor authentication for system access, applying encryption and monitoring for critical payment processes, and conducting third-party security audits and penetration tests to verify efficacy. Securing customer data is not only foundational for building trust but also crucial to avoid hefty fines and reputational damage.