Key takeaways

  • Many of this autumn's largest breaches in Japan did not happen at the company customers dealt with, or even at its vendor, but further down the chain.
  • Three companies deep: KALDI's online store newsletter went out through a marketing service, which sent it through Arara Message. 820,420 addresses leaked.
  • Two deep: MUJI's curtain orders sat on a server of Nanotech, the system contractor of MUJI's curtain contractor. Digital bond buyers' data went from issuers to NTT Data to Securitize Japan, whose platform was breached.
  • One vendor, many clients: one breach at Arara reached up to 380 client companies; one at Prestige International reached insurers' and leasing firms' customers; one at GMO Trust Login obliged 2,492 customer companies to deal with it, including their own reports to the regulator.
  • Japanese law requires companies to supervise their contractors, but says nothing specific about contractors' contractors. In practice, each company sees one link of the chain.

The chains#

Customer-facing company Through Breached What leaked
Camel Coffee (KALDI online store) An outside marketing service Arara Message, email delivery 820,420 newsletter email addresses
MUJI (Ryohin Keikaku), made-to-order curtains MN Inter-Fashion, curtain contractor Nanotech, MN Inter-Fashion's system contractor Names, addresses, phone numbers and orders, 19,933 records from 2018 to 2022
Kintetsu Group Holdings and two other bond issuers NTT Data, STdirectServices Securitize Japan, NTT Data's contractor Buyers' names, purchase amounts, emails; for 111 people, addresses and birth dates
Marui Group, PPIH (direct) Securitize Japan For Marui, up to 9,086 applicants, 54 with bank account numbers; PPIH still investigating
Sony Assurance, AXA, ENEOS, Nippon Car Solutions and others (direct) Prestige Core Solutions, roadside assistance Up to 5.5 million records: addresses, plate and chassis numbers, accident details
Up to 380 companies, including Asoview, Bic Camera, Mos Burger (direct) Arara Message 81.33 million email addresses and member data
2,492 companies using single sign-on (direct) GMO Trust Login Employees' names, emails, employee numbers, connected apps

Each company in the left column had to tell its own customers about a breach in a system it did not run, and, in the first four rows, often did not choose.

The customer sees only the brand. A KALDI shopper signed up for a newsletter; a MUJI customer ordered curtains; a Kintetsu bond buyer bought a bond with a perk. None of them knew which companies would end up holding their data. A breach notice may come from a company they have never heard of, or from the brand, which itself learned of the breach second- or third-hand.

The brand sees its contractor, not the contractor's contractor. MUJI learned of the curtain breach from MN Inter-Fashion, which learned it from Nanotech. Kintetsu learned of the bond data breach from NTT Data, which learned it from Securitize Japan. Each step adds time and loses detail. Camel Coffee says only that its newsletter went through "an outside marketing service"; it does not name the service, and may not have dealt with Arara at all.

The vendor sees all of its clients. Arara, Prestige and Trust Login each hold many companies' data in shared systems. Their first assessments go to every client at once, and sometimes they are wrong: the cinema chain Shochiku Multiplex Theatres was told on October 30 that its environment was not affected, restarted its mailings, and was told on November 2 that it was.

What the law asks#

Japan's Act on the Protection of Personal Information requires a company that entrusts personal data to a contractor to exercise necessary and appropriate supervision of it (Article 25). If the contractor is breached, both must report, and they may report jointly, as our explainer on notification rules sets out. Several vendors this autumn, including Blastmail, Studio and Y-mail, have offered or organized joint reports to the regulator for their clients, and GMO Trust Login sent its customers guidance on making their own.

The law has no specific rule on sub-contracting. Unlike the My Number Act, which requires the original company's permission before work involving My Numbers is passed on, the general privacy law leaves the second and third links to contracts and to each company's own supervision.

What is coming: the SCS rating#

The government's answer for supply chains is the SCS evaluation system (SCS評価制度), a security rating for suppliers designed by METI and the National Cybersecurity Office and run by IPA. Applications open around March 2027. A supplier can earn a ★3 mark through a checked self-assessment, or a ★4 mark through a third-party assessment that includes vulnerability testing of internet-facing devices. The rating covers the supplier's whole IT environment, including the cloud services it relies on, which it must secure itself or check through the provider's own assurances. Our explainer on the SCS rating sets out the details.

The government's emergency package of November 6 gives the rating a bigger role in exactly this problem. It recommends that large companies use it to manage their contractors, and says the National Cybersecurity Office may ask rated companies that are attacked for information.

Applied to the chains above, the rating could do two things. It gives a client a common question to ask its direct contractors, instead of its own checklist. And because it is designed to be asked of suppliers by their buyers, it could be passed down: a contractor that holds a ★ mark can ask the same of its own sub-contractors. Neither happens automatically. The rating is voluntary, it describes a company rather than the specific service or data a client hands over, and a ★4 assessment is repeated only every three years.

Disclosure gets split#

When one breach is told through many companies, the facts reach customers in pieces:

  • Different facts. In the Prestige case, the only notice that gave a cause came from a client, Nippon Car Solutions, not from Prestige.
  • Different timing. Arara's clients published over several days in early November, each when its own count was ready.
  • Different counts. Each client counts only its own records, in its own units, so no single notice tells a customer which of their details are out across all the companies they deal with.

Our view#

You cannot supervise what you cannot see. The law's duty to supervise contractors is meaningful for the first link. Past it, a company depends on what its contractor tells it, and in these cases that was not much. Contracts should require contractors to name their sub-contractors for anything that handles personal data, tell the client before changing them, and pass on the same security and notification obligations. That will not make the chain short, but it makes it visible.

Passing requirements down the chain matters. Making the ★ the proof would hollow it out. Asking contractors to apply the same standards to their own sub-contractors is the right idea, and the SCS rating is designed to be asked of suppliers by their buyers. But if a ★ mark becomes the evidence that a chain is managed, getting the mark becomes the goal, and the mark stops saying much about how data is actually handled. That is what has happened to ISMS and the Privacy Mark, under which breaches keep happening at certified companies. What should travel down the chain is the substance: who the sub-contractors are, which data reaches them and why, and how fast bad news comes back up. A ★ can be one input to that, not a substitute for it.

Send less down the chain. The most effective control is the data a vendor never receives. A newsletter needs an email address, not a purchase history; a bond perk needs to know who qualifies, not every buyer's details. Asoview has already said it will limit what it hands to vendors. Every company using a mailing, marketing or platform service should check which fields it sends and why.

Agree on how bad news travels. Each link adds a delay. Contracts should set how fast a contractor must report a breach, what it must report about the cause and scope, and whether the client can share that with its customers. A vendor's "you are not affected" should be treated as the result of what it has checked so far, not as a clearance.

Regulators could see what companies cannot. The privacy regulator receives the reports from every link. It is in the best position to notice when one platform appears behind many reports, and to say so, as it did with its warning about Salesforce-connected apps.

What this means for practitioners#

  • Map where personal data goes, including your vendors' vendors, for every service that holds customer data.
  • Require sub-contractor disclosure and approval in contracts, with the same obligations passed down.
  • Don't let the SCS rating stand in for the chain. From 2027 you may ask contractors for ★3 or ★4, but ask the substantive questions too, and ask them of the sub-contractors behind each contractor.
  • Minimize fields sent to mailing, marketing and platform services.
  • Set breach notification terms: how fast, what about cause and scope, and who notifies customers.
  • Plan joint reporting with your main vendors before you need it.
  • Treat a vendor's early "not affected" as provisional until its investigation is finished.

Japanese terms at a glance#

Japanese Reading Meaning
委託先 itakusaki Contractor, vendor
再委託先 sai-itakusaki Sub-contractor
委託先の監督 itakusaki no kantoku Supervision of contractors
外部委託 gaibu itaku Outsourcing
連名報告 renmei hōkoku Joint report (to the regulator)
共通基盤 kyōtsū kiban Shared platform
SCS評価制度 SCS hyōka seido Supply chain security rating (★3, ★4)
影響範囲 eikyō han'i Scope of impact