Adult toy manufacturer Tenga informs customers of data breach

Japanese sex toy maker Tenga has notified its American customers of a data breach after a hacker managed to gain access to an employee’s mailbox.

In an email to affected customers, Tenga says it identified a “localized security incident” involving an employee’s email account.

According to a press release, the incident concerns a limited number of US customers who have contacted the company’s customer service channel. The firm’s global systems and databases outside of the US remain secure and unaffected.

The attackers managed to lay their hands on customer email addresses and related correspondence history. No sensitive personal data, such as Social Security numbers, billing information, credit card information, or Tenga Store passwords, was compromised in this incident.

In addition, the compromised email account was used to send phishing emails to the company’s American customers, including an attachment. Fortunately, the ‘spam’ window was limited to February 12th, 2026, between 12 a.m. and 1 a.m. Pacific Time.

“We want to state clearly that there is no risk to your device or data if the suspicious attachment was not opened,” Tenga said, adding that its email and ecommerce systems are well protected through strict data siloing.

“Our e-commerce platforms are protected by multifactor authentication (MFA) and rigorous user management to ensure customer data is only accessible to essential personnel. Furthermore, sensitive information such as payment details and passwords are encrypted and hashed by default, making them inaccessible even to TENGA employees.”

Tenga is currently enhancing its security protocols across all systems to prevent any future recurrence.

The sex toy maker is recommending that affected customers update their account passwords regularly, avoid using the same passwords across multiple online platforms, review their security settings, and remain vigilant for any unusual activity.

Tenga hasn’t disclosed how the employee’s email account was hacked, nor how many customers have been affected by the data breach.