IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Shiseido reportedly suffers data breach

The Japanese cosmetics company has been accused of failing to notify affected staff of the leak

Shoppers walk past Japanese multinational personal care company Shiseido store seen in Hong Kong

The UK branch of cosmetics giant Shiseido has reportedly fallen victim to a data breach involving personal details belonging to “hundreds” of former and current employees.

The Japanese company has been accused of failing to notify the affected staff that their data, including address information, passport and ID images, and bank details, had been stolen.

Several employees have reported being victims of fraud, with their personal data being used to open fraudulent businesses as well as take out bank loans and insurance, according to testimonies obtained by beauty industry watchdog Estee Laundry.

Shiseido’s management and HR department had reportedly “denied responsibility, refusing to contact ex-employees to alert them”.

“We have had to contact ex-colleagues and staff ourselves,” one anonymous source told Estee Laundry, adding that the company’s HR and legal teams “refused to offer any help”.

This has resulted in some victims of the breach being forced to take on the scammers themselves as well as cover the expenses of having their names cleared. After discovering in March that their personal information had been used to open a fraudulent business, another anonymous employee was forced to “pay court fees to get [themselves] removed from the company”. 

Another former employee said that they had “spent over a month deleting and deactivating accounts” while not knowing how scammers managed to obtain the personal data.

Related Resource

Oracle’s modern data platform strategy

Freedom from manual data management

Oracle’s Modern Data Platform StrategyDownload now

In both cases, the victims were ultimately notified about the data breach by former Shiseido colleagues. The incident is said to be limited to Shiseido’s UK branch.

Shiseido wasn’t immediately available to comment on the allegations. If confirmed, this would be the second mass data breach involving the cosmetics company in six years, following a 2016 case that saw the personal details of 420,000 customers leaked. The data obtained by the hackers included credit card information belonging to 56,000 users who had made purchases through Shiseido’s online store over a time period close to five years, between 14 December 2011 and 4 November 2016. 

Shiseido is known to use single sign-on (SSO) authentication provided by CyberArk Identity for its 30,000 employees worldwide.

Featured Resources

Meeting the future of education with confidence

How the switch to digital learning has created an opportunity to meet the needs of every student, always

Free Download

The Total Economic Impact™ of IBM Cloud Pak® for Watson AIOps with Instana

Cost savings and business benefits

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

Technology reimagined

Why PCaaS is perfect for modern schools

Free Download

Recommended

Best free malware removal tools 2022
Security

Best free malware removal tools 2022

22 Jun 2022
A guide to cyber security certification and training
Careers & training

A guide to cyber security certification and training

16 Jun 2022
What is shoulder surfing?
social engineering

What is shoulder surfing?

10 Jun 2022
CIAM buyer’s guide
Whitepaper

CIAM buyer’s guide

6 Jun 2022

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

7 Jun 2022
The top programming languages you need to learn for 2022
Careers & training

The top programming languages you need to learn for 2022

23 Jun 2022
Swift exit: How the world cut off Russian banks
finance

Swift exit: How the world cut off Russian banks

24 Jun 2022