Apology and Notice Regarding the Leakage of Customer Personal Data Due to Unauthorized Access

1. Overview and Background

Regarding the unauthorized access by a third party that we confirmed in September 2026, we have been conducting an investigation with the cooperation of external expert organizations and other relevant parties.
On September 10, 2026, we received a report from the service provider of the telephone system we use for mail-order sales regarding suspicious access. After verification, we suspended the use of the relevant accounts, changed passwords, and took other measures to prevent further impact, and initiated an investigation by external expert organizations.
Our investigation has confirmed that unauthorized access by a third party occurred to our telephone system and customer management system used for customer service in our mail-order business, resulting in the unauthorized acquisition of some information that we hold and manage. This information includes customer data.

On September 11th and 15th, 2026, we published the status of our investigation into this matter on our website and have been taking steps to address the individual concerns of those affected.
Since then, we have been working in cooperation with external expert organizations and lawyers to investigate and address the scope of the impact, the information affected, and the impact on individual customers.
As a result, we apologize for the delay in providing you with sufficient information regarding the investigation results and the response status.

2. Information on personal data of customers obtained illegally.

(1) Information from the customer management system

• full name
• address
• telephone number

*The information items included will vary depending on the target individual and the content of the data. For some customers, only a portion of the above items may be included.

Our investigation revealed that, of the information stored in the multiple customer management systems we use, 2,797,545 customers were affected by the data breach.

(2) Information on the telephone system

• Call audio data
  (Inquiries about products, order details, and other matters related to mail order)

*The call audio data pertains to customers who called us regarding our mail-order service between September 10, 2025 (Wednesday) and September 5, 2026 (Saturday).
(The applicable periods are from Wednesday, September 10, 2025 to Sunday, November 16, 2025; from Tuesday, December 9, 2025 to Sunday, March 22, 2026; and from Friday, August 21, 2026 to Saturday, September 5, 2026.)

Our investigation has confirmed that some call audio data contained credit card numbers and expiration dates. The number of customers affected by this call audio data is 9,715.
Our company does not request, acquire, or store authentication information such as credit card security codes and passwords, therefore, this information was not included in the information that was illegally obtained.
Please note that the investigation into the telephone system by an external expert organization was completed on October 16, 2026.

Regarding this matter, our company reported the incident to the relevant police station on September 14, 2026, and reported it to the Personal Information Protection Commission on September 15 of the same year.

3. Cause

Our investigation so far has confirmed that the cause of the incident is that account information for the telephone system we use to handle customer inquiries for mail-order sales was misused by a third party, resulting in unauthorized access to the system. We have also confirmed that information stored in the customer management system was illegally obtained via the telephone system.

4. Customer Service

Based on the information confirmed through our investigation and the impact on individual customers, we have been sending individual notifications to those affected by mail or email. These individual notifications include an apology, information relevant to the affected customers, and necessary actions to take.
If we identify any customers who require further notice or action in the future, we will take appropriate measures based on the individual impact on them.

5. A request to our customers

In connection with this matter, it is possible that phishing scams and other fraudulent activities may occur, and you may receive suspicious phone calls, emails, SMS messages, or mail. Please do not respond to any suspicious communications that request you to enter or provide personal information, PINs, passwords, etc. We will never ask you to enter or provide your PINs, passwords, etc. again for the purpose of addressing this matter. If you receive a suspicious communication, please be careful not to contact the phone number or other information listed in the communication, access any URLs, open any attachments, or enter any information.

For those of you whose credit card information has been leaked and who will be contacted individually by our company, please check your credit card statements from September 2026 onwards for any unfamiliar charges. If you find any unfamiliar charges, please contact your credit card company, whose information is listed on the back of your credit card. We are working with credit card companies to continue monitoring transactions made with the affected credit cards and to prevent fraudulent use.
For those affected, we have requested that your credit card company not charge you any fees associated with reissuing your credit card. If you require a replacement card, please contact your credit card company.

6. Measures to prevent recurrence and future actions

Following the discovery of the incident, we implemented necessary emergency measures, including a mass password change for all related accounts. We also stopped requesting credit card numbers over the phone and revised our procedures to require written payment. Moving forward, we will continue our efforts to prevent recurrence in consultation with external expert organizations and lawyers, and strive to build a safer and more trustworthy environment. We will also continue to report to and cooperate with relevant organizations, including the Personal Information Protection Commission and the police.
If any new facts come to light, we will promptly inform you individually or through a publication on our website.

7. Regarding the risk of secondary damage, etc.

To the best of our knowledge at this time, we have not confirmed any secondary damages, such as the misuse of customers' personal information, that may be related to this incident. If any new facts come to light in the future, we will promptly notify you individually or by making a public announcement on our website.

Contact information regarding this matter

Rohto Pharmaceutical Co., Ltd. Inquiry Hotline
Phone number: 0120-610-654
Reception hours: 9:00 AM to 6:00 PM (including Saturdays, Sundays, and public holidays)

Dedicated inquiry form

https://rohto.my.site.com/dedicatedsupport/inquiry-form

We sincerely apologize again for the great concern and inconvenience we have caused our customers.
We will continue to work on strengthening information security and personal information protection.

​