and ST HD Co., Ltd. (the "Company") has identified an incident where business servers of the Company were subjected to unauthorized access by a third party, resulting in the potential breach of certain customer, business partner, and employee information. We sincerely apologize for the significant inconvenience and concern caused to our customers, business partners, and all other stakeholders.
The Company has implemented necessary emergency response measures, including the isolation of affected servers and the blocking of unauthorized access routes. Our Group physical stores and WEB Store remain available for use.
The facts and status confirmed as of this date are reported below.
1. Overview and Background of the Incident
At approximately 7:30 a.m. on Thursday, October 22, 2026, an unauthorized third party attempted sequential logins, gained access, and extracted data across multiple Company servers. The Company detected the unauthorized operation at approximately 10:00 a.m. on the same day and isolated the affected servers.
Subsequently, to prevent further harm, by 5:00 p.m. on the same day, the Company blocked the unauthorized access route, took measures including suspending internal business systems, and confirmed that the route could no longer be used for access.
Furthermore, today, on October 23, the Company reported the incident to the police and the Personal Information Protection Commission.
While the WEB Store "and ST" has not been affected by this unauthorized access, membership point services are currently unavailable at physical stores and the WEB Store.
2. Details of Personal Information Potentially Breached (as of October 23)
As a result of our investigation, the personal information that may have been breached is as follows. Credit card and other payment information, as well as passwords set by customers themselves, were not included in the affected data.
Customers: Approximately 2.5 million accounts
Name, date of birth, gender, address, telephone number, email address, member ID
Business Partners: Approximately 10,000 accounts
Company name, ordering/return address, contact person name, telephone number, email address
Employees: Scope of affected records currently under confirmation
3. Current Response Status
The Company has completed emergency response measures as well as the identification of and response to the method of unauthorized access. We are sequentially beginning to contact the affected customers and business partners, and are establishing a dedicated contact window for inquiries regarding this incident.
4. Impact on Financial Results
The impact of this incident on the Company's financial results for the current fiscal year is currently being assessed. The Company will promptly disclose any material impact identified that requires timely disclosure.
