Japanese sex toy maker Tenga recently notified its customers of a data breach, according to an email obtained by TechCrunch. The incident serves as a reminder that even companies outside the traditional tech space are now at the center of cyberattacks, especially when they handle sensitive personal data.
In a world where digital privacy is taken for granted, such breaches take on even greater significance when they involve products of a personal and private nature.
What happened: Employee's business email breach
In the message sent to customers, Tenga explained that “an unauthorized user gained access to the work email account of one of our employees.” This resulted in the attacker being able to view the contents of the employee’s inbox, opening the way for potential information theft.
See also: Database exposes millions of data from old breaches
This access may have allowed the hacker to see and steal:
- customer names
- email addresses
- correspondence history
- order details
- customer service questions
This data is considered particularly sensitive, as it can reveal purchases or communications that many customers would prefer to remain strictly private.
Unwanted emails and possible customer targeting
According to the company, the hacker didn't just access the data. He also sent spam emails to the compromised employee's contacts, including customers.
This creates an increased risk for secondary phishing attacks, where users may receive messages that appear legitimate but are actually aimed at stealing additional information or installing malware.
See also: Advantest Corporation suffered a cyberattack
Approximately 600 affected customers in the US
After the case went public, a Tenga spokesperson told TechCrunch that the breach affected approximately 600 people in the United States, based on a forensic assessment.
The company claimed that it proactively contacted those who may have been affected, providing instructions for their safety.
It is worth noting that Tenga reports that it has shipped over 162 million products worldwide, which shows the size of its customer base and the importance of data protection on such a scale.
Why such violations are more serious in this particular industry
Data breaches at companies related to sexual health or adult products are particularly concerning. Order details or customer service conversations may include information that users would never want to leak, due to social stigma or personal reasons.
This makes such companies attractive targets for blackmail or “doxxing,” as revealing such data can cause severe psychological and social pressure on victims.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: Figure: Data breach affects 1 million accounts
The measures taken by Tenga after the incident
The company said it took several actions following the breach, including:
- resetting employee credentials
- enable multi-factor authentication (MFA) on all systems
MFA is now considered a basic level of defense, as it prevents access to accounts even if the password has been stolen.
However, the company spokesperson did not clarify whether the specific email account had MFA before the attack, which leaves questions about the company's level of preparation.
Tenga and the wider wave of attacks in the adult space
Tenga, founded in 2005 in Tokyo and specializing primarily in products for men, is the latest addition to a long list of sex toy companies and adult platforms that have been hacked.
Similar incidents have been recorded at manufacturers like Lovense, as well as major adult websites like Pornhub and SexPanther in previous years.
The case clearly shows that cybersecurity is not just about banks and tech giants, but about any business that handles personal data — especially when it is linked to users' privacy.
Customers are urged to remain vigilant, avoid suspicious emails and enhance the security of their accounts, as attacks of this type are becoming increasingly common.
