The week the government answered. On November 6, ministers compiled an emergency package and the police opened a nationwide joint investigation into this year's large breaches. GMO faced the press for the first time. And the breaches kept coming: Arara Message's count passed 81 million email addresses as its clients began publishing their own numbers, the retailers Nojima and Iris Plaza and the beauty site @cosme joined our list, and SEGA's arcade network went dark.
The week in numbers
| Disclosure | Records (maximum) | Status |
|---|---|---|
| Arara Message (email delivery), third report | 81.33 million email addresses | Taken |
| MUJI, second report | 27.26 million, incl. 1.09 million full card numbers | Possible |
| Asoview, via Arara | 15.82 million | Taken |
| Bic Camera, Kojima and Sofmap, via Arara | 14.9 million | Possible |
| Iris Plaza (Iris Ohyama's online store) | 7.7 million people | Possible |
| Mos Burger (Mos WEB), via Arara | 7.52 million | Taken |
| Nojima (Nojima Online) | 7 million | Taken |
| Prestige International (roadside assistance) | 5.5 million | Taken |
| Club Tourism | 4.32 million | Possible |
| Shochiku Multiplex Theatres, via Arara | 3.32 million | Taken |
| @cosme (istyle) | 3.0 million people | Taken |
| SMBC Consumer Finance (loan guarantee system) | 320,118 people | Taken |
| NTT Docomo (My docomo, online shop) | 300,000 | Taken |
| GMO Trust Login (single sign-on) | 45,030 people at 2,492 companies | Taken |
These figures overlap and mix records with people, so they cannot simply be added up. Our list of 2026's largest breaches now has 61 entries of a million or more, up from 49 a week ago.
The government's emergency package and a joint investigation#
On November 6, the second Cybersecurity Related Ministers' Meeting compiled the emergency countermeasures package Prime Minister Takaichi had ordered on October 26. It has four pillars, from basic measures, including the use of AI, to support for victims, and about ¥10 billion was set aside from reserve funds. Takaichi asked for a study of amending the active cyber defense law, for critical infrastructure attacks to be reported within hours, and at least the same day, and for the National Cybersecurity Office to study how to detect suspicious traffic to private companies. The same day, the National Police Agency set up a nationwide joint investigation of large breaches since January, headquartered at the Kanto Regional Police Bureau's Cyber Special Investigation Department, with a separate headquarters for the GMO case at the Tokyo Metropolitan Police Department.
Details and our view are in our article on the government's response. We have not yet found the package's own text.
Two days earlier, the NPA said it had worked with Google on a takedown of infrastructure behind residential proxies, which turn home internet connections into exit points for other people's traffic. Google's action targeted the XCPE botnet of about 1.3 million Android TV boxes. As with the Microsoft takedown in October, the legal step was the company's action in the US, not the new police power to neutralize attacking servers. We will cover this separately.
GMO: the first press conference#
GMO held its first press conference on November 2. According to Kyodo, the attacker entered a customer's server environment on August 5 and went unnoticed until October 20, and a 2024 warning from its own security subsidiary had been closed with a temporary fix. CEO Masatoshi Kumagai apologized for his social media posts, four executives took pay cuts, and GMO began contacting customers about compensation for trading losses on November 6. It says it cannot yet estimate the total cost and will update at its results briefing on November 13. See the incident article and our analysis of its crisis communication.
Email delivery: Arara's clients start counting#
Arara Message's second and third reports raised its count from 3 million to 81.33 million email addresses, after attackers moved from a shared environment into servers it runs for each client and into a separate cloud environment. Clients then published their own figures: Asoview (15.82 million records, including purchase histories), Bic Camera, Kojima and Sofmap (14.9 million), Mos Burger (7.52 million), Shochiku Multiplex Theatres (3.32 million), TKC (2.23 million), Workman (1.45 million), Chobirich (1.35 million), IIJmio (983,458), Camel Coffee, which runs KALDI's online store (820,420), and Duskin (657,886).
Camel Coffee's case shows how long these chains get. It used an outside marketing service, which in turn sent its mail through Arara: three companies between the customer and the breach.
Elsewhere, Y-mail restarted all customer environments by the early hours of November 7, and Blastmail still aims to restart around November 11. Arcadia's disaster alert service suffered a second wave of phishing on October 22 and 23: the attackers reused a mail API account they had learned in the first intrusion, brute-forcing its password. See our email delivery article.
More vendors, more clients#
- Prestige International: up to 5.5 million records taken from the system its subsidiary uses to take roadside assistance calls for Sony Assurance, AXA, ENEOS and other insurers and leasing companies, including plate numbers, accident details and some bank data.
- GMO Trust Login: the single sign-on service kept customer files in the public storage area it used for logos, open to anyone from 2017 to September 2026.
- Securitize Japan: the digital securities platform behind NTT Data's STdirectServices was entered on October 29 through an authentication flaw that gave the attackers admin rights. Bond issuers using it directly or through NTT Data disclosed: Marui Group (up to 9,086 applicants, 54 with bank account numbers), Kintetsu Group Holdings (2,678 buyers' names and amounts) and PPIH, Don Quijote's parent, which is still investigating.
- MUJI: besides the app breach, a server at Nanotech, the system contractor of MUJI's curtain contractor, was accessed on October 19, exposing 19,933 curtain orders from 2018 to 2022.
- Sukesan Udon: employee and retiree data sat on a contractor's server with a misconfiguration. Its second report says the storage required authentication and no leak was found, but it cannot rule one out.
Retail and member services#
- Nojima: about 7 million records from its online store and smartphone buyback site, taken on November 1 and disclosed the next day, including encrypted passwords. Both sites are closed.
- Iris Plaza: Iris Ohyama's online store found a suspicious file on October 28 in an external cloud service it uses. Data of about 5.8 million members and 1.9 million non-member buyers stored there may have been viewed or taken.
- @cosme: about 3 million members' data, including skin and hair types, leaked; the operator istyle found it on October 28.
- Club Tourism: up to 4.32 million online members, including nationality and emergency contacts; the site reopens on November 7.
- Matsuya: its counts are now clearer. Most of the 2.34 million records were IDs and names only; about 110,000 included phone numbers and delivery addresses. The app is still down.
- Denny's: attackers forged credentials in the process for moving users from its old app to its new one, and could reach some accounts. Email addresses, birth dates and children's birthdays may have leaked; the count is under investigation.
- Bookoff: its third report traced the September breach to an access control problem in part of a function.
Outages: arcades, Docomo and e-Tax#
- SEGA: SEGA Fave stopped its ALL.Net arcade network and Aime player cards on November 1 after unauthorized access. Games from SEGA and Bandai Namco went dark in arcades across Japan, and there is no restart date. No data leak has been found so far.
- NTT Docomo: My docomo and the Docomo Online Shop have been stopped since November 5. Docomo confirmed unauthorized access on November 4 that leaked up to about 300,000 records, including names, addresses, birth dates and phone numbers. The cause is under investigation.
- e-Tax: the National Tax Agency detected suspicious traffic on November 4, took the system down for emergency maintenance and restarted it on November 5. It says no taxpayer data leaked.
- FDMA: the Fire and Disaster Management Agency's safety information system, used to collect information on people's safety in an armed attack, was accessed through its operations contractor Fuji Soft and stopped. Fuji Soft says no personal data leaked.
Finance#
- SMBC Consumer Finance: a system used for its loan guarantee business was accessed, and data of up to 320,118 people was taken, including annual income and guarantee amounts.
What to watch next week#
- The package: its full text, the two expert teams due this month, and the "cyber rescue team"
- GMO: its results briefing on November 13
- SEGA: the update promised for November 8, and a restart date
- Docomo: the restart and the final count
- Blastmail: the restart planned for around November 11
- Arara: more clients' counts, and the service's restart