Japanese electronics retailer Nojima says a hacker broke into the member system behind its online shop and leaked about 7 million member records. The company detected the unauthorised access on Sunday 1 November and confirmed the same day that personal data had left its systems.

The breach covers two sites: the Nojima Online web store and the company's used-smartphone buy-back site. Both have been suspended while Nojima checks they are safe. The leaked records include names, addresses, dates of birth, phone numbers, email addresses, login IDs and encrypted passwords. Nojima says neither site holds payment card data, so no card details were taken.

Nojima disclosed the incident in a notice dated 2 November. The company counts about 7 million records, excluding members who had already closed their accounts, so the number of people affected may differ from the record count. On 3 November, Nojima added that it had forced a password reset for customers it suspects are affected.

The company says it has blocked outside access, stepped up monitoring, consulted the local police, and is preparing a report to Japan's Personal Information Protection Commission and other bodies. It has not said how the attacker got in, and whether the leaked data has been misused is still under investigation.

The Nojima breach is the latest in a heavy run of disclosures in Japan. Government ministers compiled an emergency countermeasures package on 6 November, and the National Police Agency opened a nationwide joint investigation into large breaches this year. Nojima customers who used either site should reset their passwords and watch for phishing messages using their leaked contact details.