Another week in which Japan's breach wave set new records. Sagawa Express put its breach at up to 53 million records, the largest count this year. A critical PHP flaw led companies, municipalities and even the Prime Minister to back taking websites offline. AI attack tools were confirmed on attackers' servers by a security firm, by JPCERT/CC and by Microsoft, and the government answered with a plan for an AI penetration testing team. Three email delivery services have now been breached in a month. And GMO revealed that attackers who broke into its FX trading VPS service are extorting it. This is our summary, with links to our full coverage.

The week in numbers

Disclosure Records (maximum) Status
Sagawa Express (parcels), first count 53.23 million, with duplicates Possible
Capcom (game accounts, worldwide) 11.77 million Taken
Yumil Link (email delivery service) about 9 million, cumulative Taken
Times Car, final report 6.63 million; ID images of 1.46 million sent out Taken
Furusato Choice (hometown tax donations) 4.45 million Taken
Comic Cmoa (e-books) 4.2 million, mostly from logs Taken
Recruit, Carsensor (used cars) 3.71 million Possible
FutureShop (e-commerce platform), one shop 3.15 million Taken
Hankyu Hanshin Department Stores (H2O ID) 1.26 million Taken
Nifty (internet provider) 542,513 Possible
University of Osaka, via an NEC contractor 77,851 people Leaked

These figures overlap and mix records with people, so they cannot simply be added up. Our list of 2026's largest breaches now has 37 entries of a million or more, up from 29 a week ago.

php2shell: a country that hit pause#

Two critical flaws in PHP leaked before the fix was ready. On October 21, Japanese services from pixiv, DMM.com and BASE to the childcare app Codmon, along with some municipalities, went into emergency maintenance. The National Cybersecurity Office said that temporarily stopping websites was an effective way to cut risk, and Prime Minister Sanae Takaichi repeated it that night. The fix arrived late that evening; attacks followed within a day. Our php2shell article now includes an operator checklist based on JPCERT/CC's and IPA's advisories, and Codmon's detailed account of how it decided to stop in the middle of the day.

The pause had a quieter sequel. On October 23, Future Spirits ended its FormMailer FreePlus contact form service the same day, saying it had run for so long that it could no longer keep it at the security level needed. No attack has been found. Like the travel game that shut down on October 21, it is a reminder that some systems are retired rather than fixed.

AI on both sides#

  • October 20: GMO Cybersecurity by Ierae reported the Chinese open-source AI pentest tool ARTEX on attack infrastructure aimed at about 20 Japanese companies, eight of which had already disclosed breaches.
  • October 21: Microsoft said a China state-aligned group, Storm-0940, has used ARTEX since September, including in a supply chain compromise that reached more than 2,250 Microsoft 365 tenants through ConnectWise cloud backup apps. It did not link the group to Japan.
  • October 23: JPCERT/CC added a fifth pattern to its advisory on the breach wave: attacks run with AI pentest platforms such as ARTEX, Cairn and CyberStrikeAI, including against internet-facing WSUS servers, with nine attacker IP addresses.
  • October 23: Trade minister Ryosei Akazawa announced an AI penetration testing team at IPA, made up of what he called "off-white hackers", from November. The ruling party had called the situation the "eve of a cyber emergency" and asked for a cyber response headquarters led from the Prime Minister's office. We think "off-white" is the wrong word for a government team.

When the vendor is breached#

Many of this week's incidents were breaches at a vendor, which then became every customer's breach.

  • Studio: more customers of the no-code website builder disclosed form submissions, including the government's own Digital Agency, with up to 13,323 inquiries dating from 2021 to 2023.
  • NEC: a development and maintenance contractor was compromised, and legitimate accounts from its PCs were used to encrypt customers' servers. The University of Osaka said 77,851 people's data was involved, and that the data had been shared with a partner company NEC had not reported, outside the contract.
  • Iwai Cosmo Securities: orders were placed in seven customers' accounts through a misconfigured admin function at its trading system vendor, despite customers' multi-factor authentication.
  • Digital Arts: the Japanese web and email filtering vendor found, through an AI-assisted review, that its cloud operations environment had been accessed since July 2025.
  • GMO Internet: see below.

Email delivery services: three in a month#

Companies that send newsletters, alerts and notices hand their mailing lists to specialist services. Three of those services have now been breached:

  • Arcadia, whose SpeeCAN RAIDEN sends disaster alerts for local governments, disclosed on October 13. Up to 3.14 million email addresses may have been exposed, and its system was used to send 1.42 million phishing emails.
  • Yumil Link, which runs the Cuenote email delivery service, said on October 19 that a program vulnerability gave attackers its support staff's credentials. They planted a malicious program and copied data out of five systems, an estimated cumulative 9 million records including email addresses.
  • Blastmail, run by a subsidiary of the listed cloud company Rakus, stopped completely on October 21. Attackers got into two API servers and took the details of every customer from its sales system. For 344 customer contracts, delivery lists and other sending data also leaked, according to its update on October 24. Customers' own notices followed: the newspaper Niigata Nippo (up to about 253,000 members), H.I.S. Hotel Holdings (about 140,000), Tohoku Electric Power Frontier (up to about 100,000 emails), JR Shikoku (up to about 30,000) and the city of Yokohama (6,334 volunteer applicants), according to ITmedia. Blastmail is offering joint reports to the privacy regulator, as Studio, Arcadia and Sagawa have.

In our view, these breaches deserve attention beyond their size. An email delivery service holds three things an attacker wants: lists of real, active addresses, the sender reputation that gets mail past spam filters, and the brands its customers send under. Arcadia showed what happens when the last two are used. If your organization sends mail through such a service, it holds your customers' data and your name. Check what it keeps, delete lists you no longer use, and ask how it protects the admin and API access that controls sending.

GMO: extortion and a misplaced appeal#

On October 24, GMO Internet said attackers who broke into Onamae.com Desktop Cloud, a VPS service traders use to run MT4/MT5 around the clock, had used saved logins to trade in customers' FX accounts, and are now demanding money. They threaten to keep placing orders in accounts at more than 70 brokers, and to publish data and use ransomware. GMO refuses to pay. It will give every current user ¥5,000, compensate realized trading losses and rebuild the service on a separate platform. It has also asked the government to treat the case as the "first activation" of active cyber defense. In our view, that request misreads the law: what it allows is not a hack-back, it is not switched on per incident, and GMO is not one of the operators it covers.

The largest disclosures#

  • Sagawa Express: up to 53.23 million records from 100 days of parcel waybills, contract customers and Smart Club members, with many duplicates. Online tracking is back; the cause has not been disclosed.
  • Capcom: email addresses and login records for 11.77 million CAPCOM ID accounts worldwide. Passwords were changed on 196 accounts, and 19 were used to view customers' details on its online store.
  • Times Car: Park24's final report blames a web system vulnerability. Encrypted ID images of 1.46 million members were sent out; each will get ¥3,000, and Park24 expects a ¥5.5 billion special loss.
  • Furusato Choice: Trustbank said on October 20 that data on 4.45 million members of the hometown tax donation platform had been taken, including each donor's estimated tax deduction. A second report on October 23 added details for five donors.
  • Comic Cmoa: NTT Solmare said up to about 4.2 million entries, mostly from system log files, were taken from the e-book store.
  • Carsensor: Recruit said data on up to 3.71 million people who contacted used-car dealers, and on 483,000 dealers, may have leaked.
  • FutureShop: the e-commerce platform said on October 23 that member data of one shop using it, 3.15 million records, was taken on October 18 through a vulnerability in software on its servers. It has not named the shop. A separate intrusion into four of its servers on October 21 kept many shops offline; it says no personal data was found to have been viewed or taken in that one.
  • Hankyu Hanshin Department Stores: data on almost all 1.26 million H2O ID members was accessed through its reservation site.
  • Nifty: up to 542,513 people who applied for its fiber services outside its own website since 2019, in an internal system.

Other disclosures#

We did not cover these separately.

  • Joshin: the electronics retailer said on October 19 that its network had been affected by unauthorized access recognized on October 16, that some services were unavailable, and that it had made a preliminary report to the privacy regulator because a leak could not be ruled out.
  • Fuji TV: its program publicity system was accessed on the night of October 19. Names, companies and emails of up to 730 media contacts may have leaked. No viewer data was in it.
  • M3: disclosed on October 15, after our last review. A system behind MR-kun, its service for pharmaceutical companies, was accessed on October 14. A second report on October 23 put the count at 25,775 m3.com members and doctors and 2,260 pharmaceutical company staff: names, workplaces and, for a few, email addresses.
  • Snapmart: disclosed on October 16. ID document images that creators uploaded to the photo marketplace's app, possibly including My Number cards, could be viewed without authentication by anyone with the direct URL, from about March 2019 until October 8, because of a storage misconfiguration. Snapmart found no bulk access in logs going back to May 2020, and has not given a count.
  • SoftBank: stopped its My SoftBank, My Y!mobile and My Menu websites from October 17 after attempts at unauthorized access, and restored them on October 21 and 22 with stronger security.

Ransomware#

  • The Gentlemen and Qilin: our analysis found The Gentlemen has listed more Japanese organizations on its leak site this year than Qilin, the group most Japanese readers know. We argue ransomware should stay on the management agenda alongside data breaches.
  • The Japan Times confirmed a ransomware attack on an old file server, which moved it to the confirmed side of our ransomware tracker.
  • NEC has not called the attack on its contractor ransomware, although servers were encrypted.

The government and surveys#

  • October 19: a Teikoku Databank survey found that 16.2% of companies say they have had a data leak or a possible one, 30.2% among large companies, and that 14.8% do not know.
  • October 21: the Tokyo Metropolitan Police published booklets for residents and businesses on the crimes that follow data leaks, from fraud calls to burglary, and how to prevent them.
  • October 23: the Prime Minister said the government will build a response structure led from her office, after the ruling party's emergency proposal. See our article on the proposal and the IPA team.

We also corrected our Arcadia article: by the company's own count, its services had 715 contracts with local governments, not the 875 municipalities reported earlier.

What to watch next week#

  • GMO: compensation details, due by October 30 and November 6, and whether the attackers publish anything
  • Blastmail and Yumil Link: how the attackers got in, and more notices from their customers
  • FutureShop: which shop's members were affected
  • Sagawa Express and Capcom: the cause
  • The IPA team and the cyber response headquarters: who runs them, and on what legal basis
  • Rental car industry: its report to the transport ministry on the Times Car breach, due October 30

If you are a customer of any of these services, expect phishing that uses your real details, and fake compensation messages in particular. Change any password you reused, and reach companies through their official websites or apps rather than links in messages.