A Japanese fashion retailer's site let 194,000 stolen logins through in one night

PAL CLOSET, the fashion e-commerce site of Japanese apparel group Pal Corporation, was hit overnight on 15–16 June 2025 by a credential-stuffing attack: automated attempts to log in using ID-password pairs stolen from breaches of other, unrelated services. Attackers made 1,722,379 login attempts, and 194,307 of them succeeded — evidence of how many customers had reused passwords across sites.

Once logged in, an attacker could view a customer's My Page, exposing name, gender, date of birth, postal code, address, phone number and membership barcode number. Credit card details were not stored on the pages and were not exposed, and no fraudulent orders had been confirmed by the time Pal Corporation disclosed the incident on 20 June.

The company's own investigation hit a wall: it could not determine which of the 194,307 compromised accounts actually had their member information pages viewed, because, as it stated, the system was not built to log that. Pal Corporation invalidated all customer passwords on 16 June and told customers to set passwords they had not reused elsewhere.