Lawson discloses breach of 2.15 million Lawson ID accounts

Japanese convenience chain Lawson said attackers accessed personal data tied to 2,155,345 Lawson ID accounts during intrusions September 12-17, discovered October 7. Exposed fields include emails, names, and where provided, gender, phone, address, and newsletter settings. A separate hit on Lawson App Reservation exposed names, phones, and partial credit-card numbers for 26 users. Lawson traced the incident to unauthorized access of an in-app profile-display mechanism.

Sources: breachhistory.com