Japanese electronics retailer Bic Camera and Nomura Investor Relations, a subsidiary of financial services group Nomura Holdings, have disclosed separate data security incidents involving unauthorized access to customer and investor information systems. The incidents add to a series of data breach disclosures affecting Japanese organizations and highlight how vulnerabilities in external services can expose sensitive information beyond the systems directly operated by an affected company.
Bic Camera announced on November 2nd, 2026, that information associated with approximately 14.9 million customer records across Bic Camera and its subsidiaries, Kojima and Sofmap, may have been exposed. The incident involved Arara, the third-party provider responsible for the group’s email newsletter distribution system. Two days later, Nomura Investor Relations disclosed unauthorized access to Institutional Navi, a service used to provide information to institutional investors and analysts. The company has not yet disclosed how many records may have been affected by its incident.
Although the incidents involve different systems and organizations, both demonstrate the security challenges companies face when they rely on external providers to process information or support customer-facing services. A third party may operate the infrastructure, but the organization that collects the data still faces potential regulatory, financial, and reputational consequences if that information is exposed.
Bic Camera and its subsidiaries, Kojima and Sofmap, announced that customer information may have leaked following unauthorized access to an email distribution system provided by Arara. The affected service was used to distribute email newsletters, and the group reported that approximately 14.9 million records may have been exposed across the three companies.
The potentially affected information includes customer email addresses and other associated information. The companies stated that credit card details and login credentials for their online shopping services were not included because those data types were not handled by the compromised email distribution service. As of the November 2nd announcement, the group had not identified any confirmed secondary harm resulting from the incident. The companies were working with Arara to determine the scope of the exposure and said they would contact affected customers.
The number of potentially affected records is significant, but it should not be interpreted as 14.9 million confirmed individual victims. The company disclosed the approximate number of records that may have been exposed, not a verified count of unique people whose information was accessed. Further investigation is needed to establish the precise scope and composition of the affected data.
The incident also illustrates why email addresses remain valuable targets even when payment information and account passwords are not involved. An email address can help criminals build convincing phishing campaigns, impersonate legitimate businesses, or connect information from different data sources. If exposed addresses are associated with recognizable retailers, attackers may use the relationship to make fraudulent messages appear credible.
For example, a criminal could send a message claiming that a customer's loyalty account needs to be verified, that an order has been delayed, or that a promotional benefit is about to expire. A recipient who regularly receives legitimate messages from the retailer may be more inclined to trust the communication. These are potential misuse scenarios, not confirmed consequences of the Bic Camera incident.
Arara separately reported unauthorized access to part of its email distribution service. In its October 29th announcement, the company said it had detected unauthorized access to a system on October 28th and disconnected the affected server from the network to limit further damage. It identified exploitation of a web server vulnerability as the cause of the intrusion.
Arara subsequently confirmed that approximately 3.01 million email addresses had been taken from one affected environment. This figure refers to the information Arara confirmed was removed from that environment, whereas Bic Camera's approximately 14.9 million figure represents the customer records that may have been affected across its corporate group. The figures describe different scopes and should not be treated as equivalent or added together to calculate the number of people affected.
The difference matters because a service provider can support multiple customers, each maintaining its own subscriber lists and business relationships. A single compromised environment may therefore affect several organizations at once. The provider's confirmed exposure count and each customer's potentially affected records may be calculated differently, depending on the data stored, linked, or processed across the service.
Arara said it would work with external specialists to review vulnerabilities across its services and strengthen its security management practices. It also advised recipients of suspicious messages not to open links or attachments, reply to unexpected emails, or enter credentials or personal information in response to untrusted communications.
A web server vulnerability can create an entry point into an application or its supporting infrastructure. Depending on the weakness and the surrounding security controls, an attacker may be able to access data, execute unauthorized commands, or move into connected systems. However, the public statements do not establish the precise vulnerability, the full sequence of attacker actions, or whether additional weaknesses were exploited. Those details should not be assumed without further technical findings.
Organizations operating internet-facing services should maintain an accurate inventory of exposed applications, apply security updates promptly, and test systems for vulnerabilities before attackers discover them. They should also limit the permissions available to web applications and service accounts, isolate sensitive data from public-facing components, and monitor for unexpected access or data transfers. These measures can reduce the likelihood that one application vulnerability will result in a broader data breach.
Nomura Investor Relations, a subsidiary of Nomura Holdings, announced on November 4th that its Institutional Navi service had been subject to unauthorized access. Institutional Navi provides corporate earnings briefing information and supports attendance management for institutional investors and analysts. The company said it detected unauthorized access on November 2ns and confirmed the data breach the following day.
The company has not disclosed the number of records potentially affected. It said the information exposed may include personal data such as names and email addresses. As a precaution, it suspended Institutional Navi and another service for individual investors that uses the same server while investigating whether the second service was also affected.
The decision to suspend a related service is significant because systems can share infrastructure even when they serve different users or business functions. If investigators cannot immediately establish whether an incident is isolated, temporarily disabling a connected service can reduce the possibility of continued exposure while security teams examine the environment. It can also preserve time and resources for investigating access logs, determining which systems were reachable, and identifying the data that may have been accessed.
The disclosure does not establish that the second service was breached. Its suspension was a precautionary measure while the company investigated potential exposure. Similarly, the available information does not confirm whether the attackers exploited a software vulnerability, compromised an account, or used another intrusion method. The incident's technical cause and full impact remain under investigation.
The case nevertheless raises important security considerations for financial services and investor-relations platforms. These services can process names, email addresses, attendance information, and other details about people who participate in corporate briefings or receive financial communications. Depending on the data collected and the attacker's access, exposure could create opportunities for targeted phishing or impersonation. In financial environments, a message that references a real earnings briefing, company relationship, or professional role may be more persuasive than a generic fraudulent email.
The Bic Camera incident demonstrates how a vulnerability at a service provider can affect several businesses that depend on the same platform. The affected retailer did not identify its own online shopping login system or payment processing as the source of the incident. Instead, the exposure involved a separate service used to distribute newsletters. This distinction illustrates why security reviews must account for the full technology ecosystem, including systems that may appear peripheral to core business operations.
Marketing platforms, customer relationship management systems, analytics tools, cloud storage providers, payroll services, and email distribution platforms can all process personal or commercially sensitive information. They may be classified as support services rather than mission-critical infrastructure, but the information they hold can still create substantial risk if exposed. A company does not need to store payment card numbers or passwords in every system for a breach to affect customers or undermine trust.
Third-party risk management should therefore begin with a clear understanding of what information each provider can access, why the provider needs it, and how long the information must be retained. Businesses should also understand whether vendors use subcontractors, where data is stored, how administrative access is controlled, and how quickly the vendor must report a suspected compromise.
Contractual assurances are useful, but they cannot replace technical validation. Security questionnaires and compliance reports can help establish a baseline, yet they may not reveal whether a live application contains exploitable weaknesses or whether access controls are effective in practice. Organizations should combine vendor due diligence with evidence of security testing, vulnerability remediation, incident response readiness, and ongoing monitoring.
Access should be restricted to the minimum information and functionality required to deliver a service. If a newsletter platform needs subscriber email addresses, it should not automatically have access to unrelated customer records, payment systems, or internal business applications. Separating systems and limiting permissions can reduce the impact of a successful intrusion.
Preventing every cyberattack is unrealistic, but organizations can make intrusions more difficult and limit the damage when an attacker succeeds. The Bic Camera and Nomura disclosures reinforce the need for layered controls that address internet-facing vulnerabilities, access privileges, sensitive data, and incident detection.
Organizations should maintain an up-to-date inventory of public-facing applications, APIs, servers, and externally hosted services. Security teams need to know which assets are exposed to the internet, which software versions they use, who is responsible for maintaining them, and whether they handle sensitive information.
Vulnerability scanning can help identify known weaknesses, outdated components, and configuration errors. However, automated scans alone may not reveal business logic flaws, complex authorization failures, or attack paths that depend on multiple weaknesses. Penetration testing can help assess whether vulnerabilities can be chained into meaningful access and whether security controls prevent an attacker from reaching sensitive data.
Testing should be followed by a documented remediation process. Findings need owners, severity ratings, deadlines, and retesting to verify that fixes work. Organizations should prioritize vulnerabilities that are internet-accessible, actively exploited, or capable of exposing large volumes of sensitive information.
Third-party platforms should receive only the permissions necessary to perform their assigned functions. Where possible, organizations should separate marketing databases, customer account systems, payment infrastructure, and internal corporate applications so that a compromise in one environment does not provide a direct route to another.
Access controls should also account for service accounts, administrator accounts, and application programming interfaces. These identities can have extensive permissions and may be overlooked during routine access reviews. Strong authentication, tightly scoped permissions, secure secrets management, and prompt removal of unnecessary access can reduce the opportunities available to an attacker.
Network segmentation and application-level access controls can further restrict movement between systems. If a web server is compromised, the attacker should not automatically be able to access databases or administrative interfaces that are not required for the application to function.
Detection controls are essential because vulnerability management cannot guarantee that every intrusion will be prevented. Organizations should monitor web server activity, authentication events, database access, administrative actions, and outbound data transfers for behavior that differs from normal operations.
Useful indicators may include unusual requests to sensitive application endpoints, unexpected access to large numbers of records, new administrator accounts, suspicious changes to application files, or data transfers to unfamiliar destinations. Logging should be configured so investigators can reconstruct events across the application, identity provider, hosting environment, and connected services.
Alerts are most effective when security teams have a clear process for triage and escalation. Organizations should determine who investigates a suspected incident, who can isolate affected systems, and how decisions are made when a service must be suspended to protect data.
Data minimization reduces the consequences of a breach by limiting the information available to an attacker. Organizations should review what personal data they collect, which systems store it, and whether the information remains necessary for business or legal purposes.
Newsletter services, for example, should not retain unnecessary customer attributes simply because they may be useful for future marketing. Where operational requirements allow, businesses can reduce the number of fields transferred to a provider, remove obsolete records, and establish retention periods for subscriber information.
Data minimization cannot prevent unauthorized access by itself, but it can limit the volume and sensitivity of information exposed during an incident. It also makes it easier to determine the scope of a breach and communicate accurately with affected individuals.
Organizations should establish incident response requirements with vendors before onboarding them. Agreements should specify notification timelines, investigation responsibilities, evidence preservation, cooperation with regulators, and how affected customers will be informed. These requirements are particularly important when a provider serves multiple organizations and may need to coordinate responses across several customers.
Companies should also test their own response plans for scenarios in which a vendor becomes unavailable or confirms that customer information has been accessed. Relevant questions include whether data can be isolated quickly, whether backups or alternative services are available, and who has authority to suspend integrations.
A vendor's incident should trigger an assessment of the relationship, not simply a wait for the provider's final report. Customers should determine what data the vendor held, which connections existed, whether credentials or tokens need to be rotated, and whether similar systems could be exposed to the same weakness.
Bic Camera, Kojima, and Sofmap advised customers to be cautious of suspicious communications that claim to come from the companies or Arara. That warning is appropriate even when payment details and online shopping credentials are not part of the disclosed exposure. An email address can be used to target an individual with a tailored message, and criminals may combine exposed contact information with information from public websites or other breaches.
Customers should avoid clicking unexpected links or opening attachments in messages claiming to confirm a subscription, verify an account, or resolve an order issue. They should access retailer accounts through a known official website or app rather than a link in an unsolicited message. If a communication requests a password, one-time authentication code, payment, or other sensitive information, the request should be independently verified.
Organizations using affected services should follow official incident updates and determine whether their own subscriber lists or customer records were stored in the impacted environment. They should review their logs for suspicious access, assess whether any connected credentials require rotation, and ensure that customer support teams can recognize likely impersonation attempts. Companies should avoid claiming that they are unaffected until they have evidence supporting that conclusion.
For Nomura Investor Relations, the scope of the incident remains unclear. Users of the affected services should rely on official company communications for updates and treat unexpected messages that reference investor briefings or account details with caution. The suspension of a related service does not, by itself, confirm that the service was compromised.
The Bic Camera and Nomura Investor Relations incidents highlight different aspects of a shared cybersecurity challenge: organizations depend on interconnected services that can expose personal information when access controls or application security fail. Bic Camera's disclosure points to a potential exposure of approximately 14.9 million customer records through an email distribution provider, while Nomura Investor Relations is investigating unauthorized access to an investor-information service without yet disclosing the number of affected records.
The immediate priority in both cases is to establish the scope of access, contain the incident, and provide accurate information to affected users. The longer-term lesson is that organizations must assess the security of the services and systems they rely on, not just the infrastructure they operate directly. Strong vendor oversight, timely vulnerability remediation, least-privilege access, continuous monitoring, and practical incident response exercises can help prevent a third-party compromise from becoming a larger business crisis.
Bic Camera and its subsidiaries, Kojima and Sofmap, said customer information may have been exposed after unauthorized access to Arara, the provider of their email newsletter distribution system. The group reported that approximately 14.9 million customer records may have been affected.
The potentially affected information includes email addresses and other associated customer information. The companies said credit card information and login credentials for their online shopping services were not included in the affected email distribution system.
No. The companies reported approximately 14.9 million potentially affected records. That figure is not necessarily equivalent to the number of unique individuals, and the full scope of the incident remains under investigation.
Arara reported that an attacker exploited a web server vulnerability in one of its system environments. The company confirmed that approximately 3.01 million email addresses had been taken from that environment. The technical details of the vulnerability and the complete attack sequence have not been publicly established in the available disclosures.
Nomura Investor Relations disclosed unauthorized access to Institutional Navi, a service used to provide information about corporate earnings briefings and manage attendance. The company said potentially exposed information may include names and email addresses. It suspended the affected service and another service sharing the same server while investigating.
The company suspended a service for individual investors as a precaution because it uses the same server as Institutional Navi. The suspension does not confirm that the second service was compromised. Nomura Investor Relations said it was investigating whether unauthorized access had occurred.
Customers should be cautious of unexpected messages claiming to come from the affected companies or their service providers. Avoid clicking unfamiliar links, opening suspicious attachments, or providing passwords, authentication codes, and payment information in response to unsolicited requests. Access accounts through official websites or apps and independently verify unusual requests.
Companies should assess vendors before and throughout the relationship, limit the data and permissions each provider receives, keep internet-facing systems updated, and monitor for unusual access or data transfers. Security testing, documented incident response procedures, and clear vendor notification requirements can also reduce the likelihood and impact of a breach.
Penetration testing can help identify exploitable vulnerabilities in internet-facing applications, test access controls, and determine whether a weakness could expose sensitive information or allow movement into connected systems. Testing should include relevant vendor-hosted applications and integrations where the organization has authorization to assess them. Findings should be remediated and retested rather than treated as a one-time compliance exercise.
Our Penetration Security Testing methodology is derived from the SANS Pentest Methodology, the MITRE ATT&CK framework, and the NIST SP800-115 to uncover security gaps.
Download our Pentest Sourcing Guide to learn everything you need to know to successfully plan, scope, and execute your penetration testing projects.
Cyberattacks on European supermarket fridges exposed risks in connected industrial systems. Learn how OT security, penetration testing, and network controls can help prevent disruption.
November 05, 2026 - Blog
Bic Camera and Nomura Investor Relations disclosed data breaches in Japan. Learn what information may be exposed and how to reduce third-party security risks.
November 04, 2026 - Blog
Hackers used voice phishing to breach four major Canadian law firms. Learn how vishing bypasses MFA and how organizations can protect client data.
November 02, 2026 - Blog