Japan's breach wave did not slow down this week. A ransomware group claimed one of Tokyo's major railway groups, three household names disclosed breaches of more than five million records each, and a service that sends disaster alerts for hundreds of municipalities was breached. On the government side, JPCERT/CC said it had confirmed attackers' use of AI, and the cabinet approved a bill letting police remotely access criminals' phones. This is our summary, with links to our full coverage.
The week in numbers
| Disclosure | Records (maximum) | Status |
|---|---|---|
| ShopServe (e-commerce platform), final report | 23.36 million people | Taken |
| SourceNext (software) | 22.52 million | Taken |
| Burger King Japan (restaurant app) | 11.18 million | Taken |
| Rideon Express, Gin no Sara (food delivery) | 6.5 million | Possible |
| Yamato Transport (pay-later service) | 5.26 million | Taken |
| Arcadia (disaster alert service) | 3.14 million emails | Possible |
| Nikkei (newspaper) | 1.83 million, 150,000 with personal details | Taken |
| infoQ (surveys), final count | 894,082 | Taken |
| Aena (cosmetics app) | 817,215 people | Viewed |
| Moonstar (shoes) | 593,000 people | Likely |
These figures overlap and mix records with people, so they cannot simply be added up. Our list of 2026's largest breaches now has 29 entries of a million or more.
Qilin claims Keio#
On October 16, the ransomware group Qilin listed Keio, the Tokyo railway, retail and hotel group, on its leak site, according to ransomware.live, three weeks after Keio confirmed a ransomware attack. Keio said the same day that a group claiming the attack says it has published part of the group's data, and that it is checking whether it is genuine. It is Qilin's fourth Japanese victim this year on our ransomware tracker, two weeks after a man believed to be one of its leaders was handed to Germany from Japan.
Two other tracker entries changed: Saga University, whose administrative file server was encrypted in September, was listed by The Gentlemen, and Eclipse listed The Japan Times again, this time with a data page.
The largest disclosures#
- SourceNext: the software company behind the Pocketalk translator said a member information API was abused for four days to take 22.5 million records, including passwords, employers and job titles. According to Nikkei, the passwords were encrypted rather than hashed, and the program that decrypts them was compromised.
- Burger King Japan: names, phone numbers, emails and birth dates of about 11.18 million app members were taken between October 2 and 7.
- Yamato Transport: its fourth report confirmed that about 5.26 million records from its Kuroneko pay-later service were taken, including what customers bought, going back to 2018.
- ShopServe: E-Store's final report on the e-commerce platform breach, first disclosed in August, puts those affected at about 23.36 million people, including 2.1 million with partial card data, across 7,858 shops. Its first count was 8.85 million records.
- Nikkei: stolen credentials for a cloud service used for system development were used on October 7 to take 1.83 million records, about 150,000 of them with personal details. It is the newspaper's fifth incident in under a year.
Infrastructure: a cloud and a disaster alert service#
- IDCF Cloud: IDC Frontier's fifth report said it found no trace of customer data being taken, and that snapshots survived for 194 of the 495 affected customers. JR Kyushu, JR Central and FutureShop then withdrew their leak warnings. JR East and View Card had not. Nissui expects its logistics unit back to normal next week.
- Arcadia: a breach at the company behind SpeeCAN RAIDEN, used by about 875 municipalities to send disaster alert emails and calls, may have exposed 3.1 million email addresses. It also hit NET119, a text-based emergency call service for deaf users. Phishing reached residents through the service's own sender domain, and Tokyo's Minato ward could not send mobile emergency alerts while the system was down. Services were restored on October 15.
Other disclosures#
We did not cover these separately.
- Rideon Express (Gin no Sara, Kamatora, Sushi Joto): up to 6.5 million website and app registrants' data may have leaked after a server operator was hit by ransomware on October 7. The company did not name the operator. Online ordering remains suspended.
- Aena: the cosmetics retailer said members' My Page data in its shopping app, for up to 817,215 people, was viewed without authorization, including partial card details.
- @link (Medley): the appointment and practice system for obstetrics and gynecology clinics was accessed without authorization after an outside tip-off on October 11. Up to 787 medical institutions are in scope, and services were suspended from October 15.
- Commune: disclosed on October 9, after our last roundup. Attackers exploited flaws in the community platform, using improperly obtained invitation links to join private communities and posing as administrators. Data on an estimated 307,000 members of communities run by its corporate customers leaked, according to the company.
- Moonstar and infoQ published final or near-final counts.
Threat intelligence and the government#
- October 13: NICT named the A2B attack, in which attackers analyze public Android apps to attack the servers behind them.
- October 14: the National Cybersecurity Office collected the month's warnings from nine agencies on one page.
- October 15: JPCERT/CC described what it found on the attackers' servers: Android app files, app reverse engineering tools and an SSRF test script. It said it confirmed attackers used AI to scan for known vulnerabilities and attack APIs, without explaining how. We added this to our analysis of whether AI is behind the breach wave.
- October 16: the Japanese Red Cross Society took its blood donor app offline as a precaution to recheck its safety, citing NICT's warning. No attack or leak has been found.
- October 16: the cabinet approved a bill letting designated police officers remotely access devices used by criminal groups and copy data, with a judge's permit. It does not list the crimes covered, and also extends the power to the Self-Defense Forces in certain operations.
We also published explainers on Japan's 2026 privacy law amendment and the planned change to breach notification rules.
What to watch next week#
- Keio: whether the data Qilin published is genuine, and whether Qilin publishes more when its countdown ends
- JR East and View Card: whether they follow JR Kyushu and JR Central in withdrawing their leak warnings
- SourceNext and Burger King Japan: how the attackers got in, and how SourceNext stored passwords
- Rideon Express: whether it names its server operator
- The remote access bill: committee debate in the House of Representatives
- Rental car industry: its report to the transport ministry on the Times Car breach, due October 30
If you are a customer of any of these services, expect phishing that uses your real details. Change any password you reused, and reach companies through their official websites or apps rather than links in messages.