The 2023 Japan Shopping Leak Exposed 476,866 Customer Accounts

HEROIC analysts identified a combolist file tied to Japanese shopping site users, uploaded to Telegram on August 18, 2023. The file contains 476,866 exposed records made up of email addresses, plaintext passwords, and the URLs of the shopping accounts those logins belong to.

Why a Shopping Account Combolist Is Dangerous

Shopping accounts often have saved payment methods, home addresses, and order histories attached to them. A working email and password pair for one of these accounts can let an attacker place fraudulent orders, view stored personal details, or use the account as a stepping stone to reset passwords on other services tied to the same email.

What Was Exposed in This Japan Shopping Leak

• Email addresses linked to shopping accounts
• Plaintext passwords stored with no hashing or encryption
• The URLs of the shopping sites and services each login pair unlocks

Why This Matters for the 476,866 Accounts Involved

Because passwords in this file are stored in plain text and matched to a specific shopping site, attackers can log in immediately without any cracking. Anyone who reused this password on their email, banking, or other accounts faces a much wider risk of credential stuffing, account takeover, identity theft, and financial fraud.

How a Combolist Like This Gets Compiled

Combolists are built by gathering login data from breaches and stealer logs, then sorting it into clean lists that pair each email and password with the exact site it works on. Once compiled, files like this one are shared on Telegram channels and dark web forums where anyone can download and use them for free.

Check If You Are Affected

If you shop online and think your information could be part of this leak or any other breach, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records and shows you exactly what has been exposed.