# Seven million had the hash

2026-11-02

Nojima says about 7 million online-store and used-phone-buyback members left: name, date of birth, gender, address, phone, login ID, encrypted password, email. Cards are not held. Store mobile members are out. Leavers are out. Passwords were reset.

Canonical: https://www.fabiocti.com/notes/seven-million-had-the-hash/
Author: Fabio Correia

Seven million is a shop file with the password still in it.

Nojima said today that the member system behind Nojima Online and the used-phone buyback site was reached and that about 7 million member rows left: name in kanji and kana, date of birth, gender, postcode, address, phone, login ID, an encrypted password, email. Cards are not kept on that box. People who already left are out. The in-store “Nojima mobile member” book, it says, is a different file and was not in this path. Both sites are down. Passwords on the reached accounts were force-reset.

@cosme’s letter the same afternoon is a different shop: about 3 million common-IDs, including skin type and hair type, login password and cards out. Do not add them. Do not add Netmile’s 5.49 million point-exchange names. Different books.

## What 7 million will be asked to cover

It will be briefed as every Nojima customer, including the people who only ever stood at a counter. The counter book is the one they left out. It will be briefed as cards. Those are out. It will be briefed as 7 million clear passwords. The letter says encrypted. Treat reuse as the incident anyway. They reset.

If you had an online or buyback login, the street and the hash are exposed. A mail that already knows the login ID and asks you to “confirm the card on file” is not them. They do not have one.

Seven million had the hash. Keep the mobile-member book in a different sentence.