AND ST Holdings says data on about 2.5 million customers may have leaked after unauthorised server access

AND ST Holdings (and ST HD Co., Ltd.; 株式会社アンドエスティHD), the Tokyo-based parent of the fashion and goods retailer Adastria, said on 23 October that personal data belonging to roughly 2.5 million customers and about 10,000 business partners may have leaked after a third party gained unauthorised access to its servers, according to a notice posted on the company's website. The group traded as Adastria Co., Ltd. (株式会社アダストリア) from 2015 until it took its current name in September 2025, according to the company's history.

According to the company, unauthorised access began at around 7:30am on Thursday 22 October, with login attempts, intrusion and data extraction carried out against several of its servers in turn. AND ST Holdings said it detected the unauthorised activity at around 10:00am and isolated the affected servers, and that by 5pm the same day it had cut off the access route, halted its internal business systems and confirmed the route could no longer be reached. On 23 October, the company said, it consulted the police and notified Japan's Personal Information Protection Commission.

The company said the data that may have leaked includes, for about 2.5 million customers, names, dates of birth, gender, addresses, phone numbers, email addresses and membership IDs, and for about 10,000 business partners, company names, ordering and returns addresses, contact names, phone numbers and email addresses. It said the scope of any employee data involved was still being confirmed. Credit-card and other payment information, and passwords customers had set themselves, were not included, according to the company.

AND ST Holdings said its group stores and web store remain open, and that its "and ST" web store itself was not affected by the unauthorised access, but that membership points currently cannot be used at either its stores or its web store.

The company said it has completed emergency measures and identified how the unauthorised access occurred, and that it is beginning to contact affected customers and business partners in turn while also setting up a dedicated enquiry desk; customers can use an online enquiry form, it said. AND ST Holdings said the impact on its financial results is under review and that it will disclose promptly if a material effect is expected.