-
A hacker claims to have stolen customer records from Japanese tech giant Rakuten.
-
The sample reportedly shows names, emails, phone numbers, home addresses, membership details, and purchase history.
-
Nobody has verified the claim, although Rakuten has faced other reported security incidents in 2026.
A hacker has posted a listing on an underground forum. The listing claims the hacker stole customer records from Rakuten. Rakuten is one of the biggest online shopping and technology companies in Japan.
The cybersecurity monitoring account ThreatMon shared the post. No one has independently checked the claim so far. Rakuten has also faced other security incidents this year, and this report keeps those apart from the new claim.
Hacker Lists Rakuten Customer Records on Underground Forum
The hacker remains unknown. According to the post, this person got into customer records tied to rakuten.co.jp, Rakuten’s online shopping site. The listing includes one sample entry. The hacker offers it as proof of the break-in.
The sample reportedly holds many kinds of personal details. Experts call this personally identifiable information, or PII. It lists customers’ full names and their Japanese Kana name spellings. It also shows email addresses, phone numbers, and home addresses. Membership details appear too, such as sign-up dates, account status, and membership ranks.
The sample also reportedly includes many shopping records. These cover product ID numbers, prices paid, and payment methods. They also cover delivery times, points balances, and past orders.
Together, these details would give a clear picture of one customer’s life on the platform. The listing shows only a sample, so the full set of records stays out of view.
The hacker says the sample account opened in 2019. The account’s activity reportedly runs into 2026. If this is real, the database may hold customer details gathered over several years. However, the sample alone does not prove the database is real. It also does not show the database’s size or where it came from.
Rakuten Rejected One Leak Claim and Confirmed Two Travel Site Incidents
The new claim arrives during a year of other security news at Rakuten. These earlier cases are separate from the forum post. They also differ from each other, so each one gets its own explanation below.
On October 9, a Japanese tech publication reported that Rakuten Group had rejected an earlier claim. That claim said about 101 million customer records were for sale on a cybercrime forum. Rakuten told the publication it had not confirmed any such leak. The company also said it could not identify the accounts linked to the sample data online.
Rakuten Group then posted an official notice on October 26. The notice confirmed that someone accessed parts of Rakuten Travel without permission. The affected parts were its overseas hotel booking site and its multilingual reservation websites.
According to the company, the hotel booking incident may have affected up to 40,000 customers. Their names, email addresses, phone numbers, and booking details were involved. Payment information for up to 36,000 customers was also affected. Rakuten clarified that this payment information did not include full card numbers or security codes.
The second incident involved the multilingual booking platform. It may have exposed email addresses and internal ID numbers for up to about 860,000 customers. Rakuten lists its company notices on its privacy announcement page.
The two Travel incidents hit different parts of the company’s booking services. The first one touched names, contacts, and payment details. The second one touched far more people but fewer kinds of information. The October 9 denial and the October 26 notice also deal with different matters. One rejects a claim, while the other confirms real access.
Travel-related services have also appeared in other recent data leak claims. In a separate case, a threat actor claimed to be selling 107 million records allegedly stolen from Iranian travel agencies. However, that listing has not been independently verified either. Read more about the alleged Iranian travel agency data sale.
These notices show that Rakuten has dealt with real security problems this year. Still, neither notice proves that attackers reached the wider shopping database described in the new listing.
Experts Cannot Yet Link the Forum Sample to Rakuten Systems
At the time of writing, no independent technical review has tied the ThreatMon sample to Rakuten’s systems. No verified evidence shows how the hacker got the records. Nobody knows how many customers the leak may affect. It is also unclear whether the sample shows real customer data.
The October 9 denial covered a different leak claim. Even so, it adds context to talk about Rakuten customer databases. The confirmed Travel incidents also do not prove the new claim is true. The sample is the only proof the listing offers. A single entry cannot show how large the leak is. It also cannot show whether the hacker truly holds more records.
This difference matters. Threat actors sometimes reuse data that leaked earlier. They also use fake samples or data from unrelated sources. These tricks can make a stolen database claim look more believable.
For now, readers should treat the post as an unverified leak claim, not a confirmed breach. Customers should stay careful with unexpected emails, texts, or calls. Be wary of any message that asks for account logins or personal details. This matters most when the message claims to offer updates about a possible data leak.
