Sex toy maker Tenga says hacker stole customer information

Sex toy maker Tenga notified customers of a data breach on Friday, according to an email obtained by TechCrunch.

In the message, the Japanese company said that “an unauthorized party gained access to the business email account of one of our employees,” which gave the hacker access to the contents of the employee’s inbox. This access potentially allowed the hacker to view and steal customer names, email addresses and historical email correspondence, “which may include order details or customer service inquiries.”

The hacker also sent spam emails to the compromised employee’s contacts, including customers, according to the email sent to customers.

Tenga did not respond to a request for comment and to provide more information, such as the total number of customers affected. The company says on its website that it has shipped over 162 million products worldwide.

Order details and customer service inquiries are likely to include in-depth information that many customers would likely not want to divulge given the nature of the products in question.

The company advised customers to change their passwords, although it did not say that customers’ passwords had been compromised, and to be wary of suspicious emails, especially from a specific employee who appears to be the one whose account was compromised.

Tenga said it took several steps after the breach, including restoring the compromised employee’s credentials and enabling “across all of our systems” a key security feature called multi-factor authentication that prevents access to accounts with stolen passwords. The company did not respond when asked if there was no multi-factor on the email account prior to this breach.

Tenga was founded in 2005 in Japan and is headquartered in Tokyo. Tenga sells a variety of sex toys, mainly for men. It’s unclear if the breach affected customers outside the United States, since the email specifically came from Tenga Store USA.

Tenga is the latest in a long list of sex toy makers, such as Lovense last year, and adult sites such as Pornhub last year and SexPanther in 2020, to be hacked.