# The leavers were still in the send

2026-10-14

Bookoff now says 6,427,735 member rows were sent out, 6,383,279 people after email dedupe, including 212,371 who had already left. The take was 4–6 October. The 15 October mail will not carry a password-change link.

Canonical: https://www.fabiocti.com/notes/the-leavers-were-still-in-the-send/
Author: Fabio Correia

Nine days ago it was a ceiling. Yesterday they said the rows left.

Bookoff Group Holdings told the exchange on 13 October, ITmedia reports this morning, that a third party sent 6,427,735 member records out of a subsidiary system. Deduped on email: 6,383,279 people. Of those, 212,371 had already cancelled. The first notice, on the 9th, was “up to about 6.43 million may have left.” This one is a confirmed outbound send. The window they now give is 4 to 6 October. The 6th was the day they said they saw it.

The rooms in the file: BOOKOFF, the official online store, BOOKOFF FASHION, app, web. Card-only members are out. Booklog and Aoyama Book Center are out. ID-document images from buyback sit on another system and are out. The fields have not moved: name, date of birth, gender, email, phone, postal address, password hash, point-card number, member number. Cards were never in that box.

They will write from the 15th. They will ask people to change the online-store and app passwords. ITmedia’s reading of the notice: that mail will not carry a link to the change screen. A mail that does is not theirs.

## What 212,371 cancellations will be asked to cover

It will be briefed as “only current members.” The leavers were still in the table that got copied. Closing the account closed the shop login. It did not delete the row the attacker sent. It will be briefed as “they confirmed 6.38 million,” as if the first ceiling had been a rumor. The first ceiling was their own number before the send was counted.

If you left Bookoff last year, you are still in this letter. If you only ever used a plastic card and never made a login, you are not. Change the password you reused before their mail arrives. When their mail arrives, do not click a reset inside it. They said there would not be one.

The hash is still the part that keeps working. The new fact is that the ceiling was a send, and that leaving was not an exit.