The week the counting caught up. Our list of 2026's largest breaches grew from 61 to 68, with the furniture chain Nitori, the gig-work app Sharefull and the online broker Monex Securities among the new entries. Yumil Link explained how stolen login sessions were used to take data from 42 of its clients' systems, and the marketing platform KARTE stopped every customer at once. MUJI's app went dark beside its online store, and its president faced the press. GMO put a first price on its breach. And the privacy regulator's half-year figures showed that the rise in breach reports began well before October.

The week in numbers

Disclosure Records (maximum) Status
Yumil Link (Cuenote FC email delivery), third report 47.86 million, revised down from 51.63 million Taken
Nitori (furniture retailer) 37.62 million Possible
Sharefull (Persol group gig-work app) 7.5 million accounts Possible
NetMile (points site, disclosed November 2) 5.49 million people Possible
@cosme (istyle), via Cuenote FC 2.8 million people Taken
SEGA, via Arara Message 2.2 million email addresses Taken
Japan Chamber of Commerce and Industry (online exams) 1.97 million records, about 980,000 people Possible
Monex Securities (account opening) 1.13 million email addresses and 1,592 ID images Possible
Soft99 (car care products, online shop) 136,968 Possible
Matomaru EC Tencho (order management for online shops) 21,873 orders at 373 shops Possible
EDION (electronics retailer) 13,685 people, and 556 card entries skimmed Taken
Shiseido (skin analysis system) 2,515 Taken

These figures overlap and mix records with people, so they cannot simply be added up.

The new names on the list#

  • Nitori: up to 37.62 million records of members, buyers, corporate customers and online orders, including those placed through its shops on online malls, may have been accessed. Access was found on November 6 and may have begun in mid to late October. It is the fourth largest on our list. The cause is not stated.
  • Sharefull: the Persol group's app for short-term jobs says up to about 7.5 million user accounts may have leaked from an internal management system, with bank accounts for wage payments, emergency contacts, residence status information and links to face photos. The cause is not stated.
  • Monex Securities: the outside contractor that runs part of its online account-opening system found attempted unauthorized access on October 18. Up to 1.13 million email addresses entered since 2019 may have leaked, including people who never opened an account, and so may 1,592 images of ID documents: driver's licences, the front of My Number cards and selfies taken for identity checks. Account numbers and passwords were not in that system, and the contractor is not named.
  • Japan Chamber of Commerce and Industry: a malicious file was planted on November 1 on the external server test centres use to run its online exams, including bookkeeping. Up to about 980,000 people's names, birth dates, pass or fail results and exam scores may have leaked.
  • NetMile, a points site, said on November 2 that up to 5.49 million members' details may have leaked; we confirmed it at its operator's notice this week. @cosme and SEGA published their counts from the Cuenote and Arara breaches below.

Vendors and platforms#

  • Yumil Link's third report explains its breach. Attackers planted a program, read databases directly and spread through a maintenance account present on every platform. In 42 more client systems, they used sessions stolen from servers they already held and the admin screen's ordinary CSV export. Our article explains how a session can be stolen from the server, and why multi-factor authentication does not help once it is.
  • KARTE: PLAID, whose KARTE platform tracks visitors on companies' websites and apps and sends them messages, stopped every function for every customer after detecting unauthorized access on November 13. Late that night it said it had identified information that may have leaked and emailed the customers concerned, without saying what or how much. See our marketing SaaS article.
  • Online shops' back offices: OpenLogi, a fulfilment platform used by many online shops, says shipping data for orders from April to November 8, recipients' names, addresses and items, was taken on November 8 and 9; the count is still being checked. Matomaru EC Tencho, an order management service, says 21,873 orders at 373 shops may have leaked, and buyers are receiving refund scams that quote their real orders.
  • Shiseido: its online skin analysis system FCA was accessed; data was altered and 2,515 records were taken, including questionnaire answers and skin measurement results. Skin analysis services of several Shiseido group brands that use the same system are stopped. Shiseido is working with the system's developer.
  • NTT Data disclosed a second incident: a service it builds and runs for Sumitomo Life's Vitality programme was accessed, involving about 80,000 users. It is separate from the bond perks platform case.
  • Raksul, an online printing service, narrowed its incident to files uploaded through its Adobe Express integration: at most 249 files may have been read.

Retail and member services#

  • MUJI: the November 6 notice we had missed also stopped every MUJI app function except the member card barcode, with a restart planned "within one to two days"; both the app and the online store are still down. At a press conference on November 12, the president said "a vulnerability in part of the system" was to blame, and that the company had kept its members' sale running because it believed it faced a single attack. See the MUJI article.
  • EDION: attackers read the online store's log files, which held card numbers with security codes, gift card PINs and passwords. Investigating that, EDION found a skimmer on its PC payment page that had run since the day before.
  • Soft99, a car care products maker, says a file was uploaded through its online shop's inquiry form and used as a web shell to read configuration files; up to 136,968 customers' details may have leaked.
  • Takarakuji, Japan's official lottery site, and its app are stopped after likely credential stuffing. Some members' win and loss history and partial bank details for payouts may have been viewed.
  • Matsuya Foods cut its operating profit forecast for the year from ¥8.2 billion to ¥5.4 billion, partly because its official app stopped after the October breach.

Email delivery#

Blastmail restarted on November 11 on an environment built from scratch, with no data migrated; customers re-upload their lists. Its parent, Rakus, says staff stopped the service within three hours of the first alert, without waiting to confirm a leak. Y-mail has fully restored its customers and returned their DMARC policies, set to reject in the emergency, to "none". More Arara Message clients reported, including SEGA (2.2 million addresses) and TEAC (about 14,000, through two GMO MakeShop tools). See our email delivery article.

GMO: the first figures#

GMO Internet's results on November 13 gave the first numbers: ¥2.99 billion of compensation claimed for unauthorized trades by 2,943 accounts in the first week, against insurance capped at ¥1.1 billion, and about ¥300 million of lost sales a quarter while the service is stopped. The cause analysis will come "later". See the GMO article.

Ransomware and leak-site claims#

  • EICOH, an Osaka IT and office solutions company, confirmed a ransomware attack found on November 9; a group, The Gentlemen, had listed it. Maruki Medical Systems, which supplies hospitals in northern Japan, has had its ordering and warehouse system down since October 15, taking orders by fax. Both are in our ransomware tracker.
  • Leak sites also listed Toyota and the restaurant company Zetton. Neither has said anything, and these are only the groups' claims.

Security companies#

Cyber Security Cloud, a web application firewall vendor, says a GitHub account area it uses for software development saw suspicious access after an employee's credentials leaked; some customers' names, email addresses and "communication-related information" may have been taken, and its logs do not cover the whole period the credentials were valid. It cut its sales forecast, partly for the incident. MOTEX, maker of the LANSCOPE endpoint management products, says a website server was accessed and customer contact details may have leaked; its products are unaffected.

Policy and guidance#

  • JPCERT/CC published checklists for incident investigation reports, for victims and for investigators. They ask reports to say, for every system and every leak, whether it was confirmed, possible, left no trace or cannot be determined. See our explainer.
  • The Personal Information Protection Commission's draft half-year report counts 10,784 mandatory breach reports from businesses from April to September, up about 21% on a year earlier, and 43 demands for reports, against 11. The rise was under way before October's wave. Details are in our notification rules explainer.
  • Police: Tokyo police and the telecom regulator caught a man running a fake mobile base station from a car in Ginza, sending card-phishing SMS to tourists' phones, the first case of its kind in Japan. The National Police Agency worked with Google and Microsoft on takedowns that used the companies' US lawsuits, not the new police power to neutralize servers.
  • A fake police app: SMS posing as the National Police Agency lead to a fake download page for an NTT Town Page anti-fraud app, NTT Town Page warns.

We also looked at how vendor chains spread this year's breaches and what Japan's security rating scheme for suppliers can and cannot do about it.

Missed earlier: Sony Life disclosed on October 28 that about 385,000 records of Medicare Life policies it sold as an agent leaked from its systems.

What to watch next week#

  • KARTE: what data was taken and from whom, and when it restarts
  • Monex: the contractor, the cause, and whether other brokers use it
  • MUJI: the outside assessment and a date for the online store and app
  • OpenLogi: how many shops and recipients
  • Blastmail: its next report on November 16
  • Yumil Link and Blastmail: the final reports, which we will read against JPCERT/CC's checklist