# The hash was in the member file

2026-10-09

Bookoff says a subsidiary member system was accessed on 6 October. Up to 6.43 million records may have left, including password hashes. Card numbers were not in that system. The company has not confirmed the file was published.

Canonical: https://www.fabiocti.com/notes/the-hash-was-in-the-member-file/
Author: Fabio Correia

This one is not the cloud outage. It is a secondhand chain’s own member desk.

Bookoff Group Holdings told the exchange, in a notice dated today, that on Tuesday 6 October it confirmed a third party had reached the member-management system of a subsidiary, and that member information had been taken outside the company. Kyodo puts the ceiling at 6.43 million accounts. The notice’s field list is names, dates of birth, gender, email addresses, telephone numbers, postal addresses, password hashes, and point-card numbers. Payment cards are not there, because the company says it does not keep them in that system. It has not confirmed that anyone altered the member records. As of the notice, it also has not confirmed that the leaked set was posted or misused. It is still counting the real number of people.

A hash is not the password printed in clear. It is also not a finding that the password is safe. People reuse the bookstore login. A hash that leaves is a queue for anyone willing to guess the common ones offline. The company’s “not publicly disclosed, as of today” is a clock. It is not a promise about next week.

## What the point card will be asked to cover

The point balance is the part a customer can see. The file is the part with the home address and the hash sitting next to the email. Compensating points, if they do, repairs the ledger. It does not pull the address back. The useful notice is which fields were in the system that was reached, and they have already given that list. The useless notice is “the shops are open,” which was never the question.

If you have a Bookoff login you also use elsewhere, change the elsewhere first. The hash does not tell them your other password unless you reused it. If you reused it, the bookstore is no longer the only door. Wait for their email before you treat every rumor of a dump as this file. Do not wait for a public dump before you treat the address and the email as exposed. They said the information left the company.

Six million is a ceiling. The hash is the part of the ceiling that keeps working after the site looks normal.