ANA Group's overseas shopping service has been down 12 days, with no word on what leaked

The online shop that Japanese people living abroad use to order food and household goods from home has been down since 23 July. It is "OCS FAMILY LINK SERVICE," run by OCS Co., Ltd., part of the ANA Group. The cause was a cyberattack from outside, and the company has stated that personal information may have been leaked.

Checking on 5 August 2026, the site still does not respond. Twelve days after the shutdown, nothing has been published about what data may have gone, how many people are affected, or how the attackers got in. The company's last statement was its second notice, dated 24 July, and it has not been updated since.

What happened, day by day

Only the published facts.

What stands out is the gap between how 23 and 24 July were worded. The first notice was headed "service suspension due to a system fault." Read that, and you assume a server is misbehaving and will be back shortly.

The second notice changed the substance. The company wrote that "a cyberattack was carried out from outside against servers we manage and operate, and some personal information and data may have been leaked externally." It says system and related networks were cut off in an emergency measure to contain the damage.

The headline, however, still reads "service suspension due to a system fault (second notice)." Anyone reading only the title would not notice that the content had shifted from "fault" to "attack and possible data loss."

Who this actually hurts

OCS FAMILY LINK SERVICE is online shopping for Japanese people living overseas. Order Japanese food, seasonings, household goods or magazines, and they are shipped to your country of residence. OCS is the ANA Group's international logistics arm, and the service is also listed as an ANA Mileage Club partner service.

Expatriate staff and their families, students, long-term residents. People who relied on it for things the local supermarket does not carry — baby food, health products they treat as near-medicine, one particular seasoning. Items with no substitute, ordered on a monthly cycle.

Twelve days with no way to order. What happened to orders already placed, and when ordering resumes, cannot be checked either, because the site does not respond. For a domestic outage the answer is usually "buy it somewhere else" — for someone living abroad, the alternatives are thin.

On top of that, they still do not know whether their own registered details went out the door. Being a shopping site, what is held there is names, addresses in Japan and locally, phone numbers, email addresses and order history. How payment data was stored has not been disclosed.

What has not been said, listed plainly

Here is what remains unpublished as far as we could verify. No speculation.

The second notice says affected parties will be contacted individually, but no follow-up has confirmed that this has started.

Why twelve days and counting

From the operator's side, this duration is not unusual. Three reasons.

First, nothing can be restored until the entry point is identified. Bring the service back with the same hole open and they walk in again. Rebuilding servers achieves nothing if the door is still ajar. That investigation normally involves an outside specialist firm, which alone takes weeks.

Second, establishing what was taken means reconciling logs. Where traffic records are complete, this is quick. Where they are not, the wording cannot move beyond "may have been leaked." Twelve days without fields or counts suggests that point has not been reached.

Third, public statements can only carry what is confirmed. Guessing "names and addresses were taken" causes real harm if it turns out otherwise. Understating and revising upward later damages trust badly. The more careful the organisation, the later and shorter the disclosure.

None of which, from the customer's side, is a reason to wait. For twelve days they have known nothing, while their details may already be circulating. There is a limit to how much silence the phrase "under investigation" can cover.

Cases of this shape keep coming. We have covered roughly 70,000 records exposed at Sagawa Express, where notification emails showed the wrong names, and an intrusion at Nichirei that emptied KFC outlets across Japan. We have also mapped what survives when systems are severed after a breach.

What customers can do now

With the affected fields unpublished, no definitive remedy can be given. These are the steps worth taking anyway.

First, check whether the password you used here is reused anywhere else, and change it there. Since nobody can say whether it leaked, this is not a precaution to consider — it is something to get done.

Second, if a message arrives claiming to be from OCS, do not follow the link in it. After any data exposure, that list gets used for fake messages. "Compensation procedure" and "please reset your password" are the standard subject lines. Navigate to the OCS site yourself to check for official notices.

Third, if a credit card was registered, watch the statement for charges you do not recognise. How payment data was stored has not been disclosed, so whether it is in scope cannot be judged today.

Fourth, for questions about pending orders or refunds, the published enquiry address is the only route. With the site unreachable, there is no other channel.

Summary

OCS FAMILY LINK SERVICE, the ANA Group's shopping service for Japanese residents overseas, has been offline since 23 July 2026 after a cyberattack. On 24 July the operator disclosed that some personal information and data may have been leaked.

As of 5 August, the site does not respond and no third notice has been issued. The affected fields, the number of people, the entry point and any restart date all remain unpublished. That is twelve days.

The people who used this service cannot obtain these goods where they live. The weight of it going down is different from a domestic outage. And they are waiting without knowing what happened to their own data, with little else available to them.

We will update this article as further information is published.

Frequently asked questions

Can I find out whether my data was leaked?

Not as of 5 August. Neither the affected fields nor the number of records has been published. The second notice says affected parties will be contacted individually, but no announcement confirms that this has begun.

Should I change my password?

You cannot change it on this service while the site is unreachable. If the same password is used elsewhere, change it there first.

What happens to orders already placed?

Not disclosed. Contacting the published enquiry address (gaffairs@ocs.co.jp) is the only route.

Is ANA itself or my mileage account at risk?

What was disclosed as attacked are servers managed and operated by OCS Co., Ltd. No announcement states that ANA's own systems were affected. That said, the extent of integration between them has not been detailed, so this cannot be stated as certain.

Why does the headline still say "system fault"?

Presumably because the cause was unknown when the first notice went out. The second notice updated the substance to an attack and a possible leak, but kept the original heading.

References

• ▸OCS Co., Ltd. - Service suspension of "OCS FAMILY LINK SERVICE" (second notice) (24 July 2026, Japanese)
• ▸OCS Co., Ltd. - the same (first notice) (23 July 2026, Japanese)
• ▸Security NEXT - Cyberattack on a shopping site, possible personal data leak at an ANA Group company (28 July 2026, Japanese)
• ▸ANA Mileage Club - OCS Family Link Service
• ▸OCS Co., Ltd. official site (where notices are posted)