Got a Data Breach Notice From a Japanese Company? What to Do, Item by Item

Key takeaways

• 50 breaches of a million records or more have been disclosed in Japan so far in 2026, and the privacy regulator received 2,094 hacking-related breach reports in six and a half months, covering about 260 million people counted cumulatively. Many people in Japan now have at least one notice in their inbox.
• On October 26, the government-backed IPA published guidance for individuals after its consultation desk was flooded with the question "I was told my data leaked. What should I do?" This article follows its structure and adds what we have seen in this year's cases.
• Start with what leaked. The right response depends on the item: a password needs changing, a card needs a call to the issuer, a leaked ID document image can be flagged with Japan's credit bureaus, and a leaked email or address mostly means more convincing scams.
• The scams that follow a breach are the bigger risk for most people: phishing that uses your real name, fake compensation notices, calls offering to "delete" your leaked data, and fake "victims' groups" like the one reported in the GMO case.
• The habit that protects you most is multi-factor authentication. A leaked password alone should not be enough to get into your accounts. Prefer passkeys, which phishing cannot steal, over codes sent by SMS or email.
• Japanese law gives you rights after a breach: you can ask the company to stop using or delete your data, and you can take a complaint to the Personal Information Protection Commission.

Why this matters now#

Our running list of breaches of a million records or more passed 50 entries on November 1, with Club Tourism's 4.32 million. The Personal Information Protection Commission (PPC) counted 2,094 reports of breaches caused by unauthorized access between April 1 and October 16, covering about 260 million people counted cumulatively, as we explained in our article on its figures. The same person appears in many of those counts.

For the people on the receiving end, the result is a stream of apology emails. The IPA (Information-technology Promotion Agency), which runs a government-backed security consultation desk, says it has received many calls from consumers who were notified and did not know what to do. Its guidance of October 26 is short and practical, and it is the basis of what follows.

Step 1: Check the notice, and what it says leaked#

Make sure the notice is real. A breach notice is a perfect template for phishing. The IPA suggests checking what leaked in three ways: the company's message, the notice on the company's own website, and its support desk. Find the website and phone number yourself, not through a link or number in the email. Most large breaches in Japan are also announced publicly; our explainer on notification rules explains why.

Read the list of items, and the list of what is not included. Japanese notices usually list each category of data and, often, what was not affected: "passwords, card details and bank account numbers are not included". That second list matters as much as the first.

"May have" is not "did". Many notices say data may have been viewed or taken (漏えいした可能性). That is the legal threshold for reporting, not a finding that your data was stolen. Treat it as a leak anyway; the steps are the same and cost little.

Notices change. Companies issue numbered updates (第1報, 第2報), and counts and items are often revised. Check the company's notice page again after a week or two.

Step 2: What to do, item by item#

What leaked	The main risk	What to do
Login ID and password	Someone logs in as you: purchases, transfers, posts	Change the password on that service now, to a long unique one. Change it on every other service where you used the same password. Turn on multi-factor authentication, ideally a passkey, on that service and on your important accounts
Password "hash" or "encrypted" password	Weak passwords can be recovered from hashes	Change it anyway, and anywhere you reused it (see our view below)
Full card number	Fraudulent charges	Call the card issuer to check for misuse and ask about stopping and reissuing the card. Check statements for a while
Partial card data (last four digits, expiry)	Convincing phishing that quotes your card	No reissue usually needed; ask the issuer if unsure. Distrust messages that quote your card details
Bank account details	Phishing and fraud calls that cite your real account	Ask your bank whether any action is needed. Watch your statements
Email, phone number, address, name, birth date	Your details are put on lists, sold and used for scams by email, SMS, phone and post	Treat unexpected messages as fake. Do not tap links, enter information or install apps from them. Refuse unexpected cash-on-delivery parcels
ID document images (driving licence, My Number card, others)	Someone opens a card or loan in your name	File a self-declaration (本人申告) with Japan's credit bureaus: CIC, JICC and the bankers' association's KSC. Lenders that check your record see the flag
My Number (the number itself)	Limited on its own	If it leaked and there is a risk of misuse, your city office can assign a new number
Emergency contact	Scams aimed at your family, using your name	Tell the person you listed
Purchase or investment details	Targeted investment and "recovery" scams	Be wary of anyone who knows what you bought or invested

A few notes on the table:

• Passwords. The IPA's advice is the same whether a password leaked in plain text or not: change it, make it long and complex, and change any reused copies. Reuse is the real danger, because attackers try leaked passwords on other services, from shopping sites to online banking.
• ID images. This is the item to take most seriously, and this year it has not been rare. Times Car said 1,464,800 ID images were sent out. The KSC, run by the Japanese Bankers Association, says a self-declaration can be filed when ID information, including images, may have leaked; it accepts applications online, for a ¥500 fee, or by post, but not by phone. It also warns that applications have surged and processing is taking much longer than usual. CIC and JICC run their own procedures. The flag does not guarantee anything; it tells lenders to check more carefully.
• My Number. Municipal guidance, such as Minato City's, says the number cannot be changed at will and is not enough on its own to misuse, but a new one is assigned if it leaked and there is a risk of misuse. Ask your city office what proof it needs.
• Emergency contacts. Club Tourism's breach included the emergency contacts members had registered, which are usually another person's name and phone number. A scammer who knows both can call a relative with a convincing story. The person you listed will not get a notice from the company, so tell them yourself.
• Investment details. Kintetsu Group Holdings said the names and purchase amounts of 2,678 people who bought ¥1 million or more of one of its bonds may have leaked, through a platform run by a contractor of NTT Data that handled the bond's buyer perks. How much someone invested is exactly what investment scammers want to know.

Step 3: The scams that follow a breach#

For most people, the stolen data itself does less harm than the scams it feeds. These are the ones to expect:

• Phishing that knows your name. The IPA warns that fake emails may include your real name taken from the leak. A correct name proves nothing.
• Fake apology and compensation notices. Companies now often pay something after a breach, from vouchers to cash, as we described in our article on breach payments. Every real payment invites fake ones that ask for bank details, card numbers or a "processing fee". Club Tourism, like most companies, says it will never ask for card numbers, bank details, PINs, passwords or My Number in connection with the breach.
• "We can delete your leaked data." Japan's National Consumer Affairs Center has warned of callers impersonating it who say your personal data has leaked and offer to have it deleted. It never makes such calls. Nobody can recall data from criminals' hands, and anyone offering to do so, for a fee or not, is running a scam.
• "Victims' groups." Kyodo News reported on November 1 that a "victims' information sharing forum" for the GMO breach had been built in the same way as the attackers' own site, and was being prepared before GMO disclosed the breach. Anything victims post on such a site, from account numbers to screenshots of losses, goes to the people who attacked them. Real group lawsuits exist, like the one planned over Times Car, but they are run by lawyers you can verify independently.
• "We can recover your losses." After financial losses, offers to recover money for a fee follow. The company that lost your data and the police are the places to go.

If you are unsure about a message, check it through the company's official website or phone number. In Japan, the consumer hotline 188 connects to a local consumer affairs center, and the IPA's consultation desk takes questions by phone and email.

Step 4: Your rights under Japanese law#

• Ask the company to stop using or delete your data. Since 2022, Article 35 of the Act on the Protection of Personal Information (APPI) lets you ask a company to stop using or erase your data, or stop passing it to others, when a breach that it must report to the regulator has happened to that data. The company must do so to the extent needed to protect you, unless that is very costly and it takes other measures instead. If you no longer use the service, this is also a good moment to close the account.
• Ask what data they hold. You can ask a company to disclose the data it holds about you, which tells you what could have leaked.
• Take a complaint to the regulator. The PPC's consultation line (03-6457-9849, weekdays 9:30 to 17:30, in Japanese) handles complaints about how companies handle personal data. It can advise, take information it may follow up with the company, and in some cases mediate between you and the company. It does not decide whether a company broke the law.
• Compensation is a separate question. Apology payments are gestures, and Japanese courts have awarded modest sums for leaked basic details. Our article on breach payments sets out what companies have paid and what courts have awarded.

Step 5: Habits that make the next notice matter less#

The IPA's advice for everyone, notified or not:

• Use long, unique passwords for every service.
• Turn on multi-factor authentication, such as SMS codes, an authenticator app or a hardware key, or set up passkeys, wherever a service offers them.
• Treat unexpected emails and SMS as fake by default. If you need to check one, find the official site yourself.
• Register only what a service needs. Do not fill optional fields.
• Delete accounts you no longer use, and check the service's terms to see whether your data is actually deleted.

Our view#

Change a hashed password anyway. Notices often stress that passwords were "hashed" or "encrypted", which sounds reassuring. How well that protects you depends on the method, which notices rarely describe, and on how strong your password was. Short or common passwords can often be recovered. The IPA's advice makes no exception, and neither do we.

Unique passwords and multi-factor authentication matter more than any single notice. With 50 large breaches this year, the same email address and password appear in many leaks. One password per service, kept in a password manager, stops a leak at one service from opening the others. Multi-factor authentication covers the case a password cannot: once a password is out, a second factor is what stands between the attacker and your account. Together, they turn most future notices from an emergency into a formality.

Choose a second factor that phishing cannot steal. Not all multi-factor authentication is equal. A code sent by SMS or email, or typed from an app, can be handed over on a convincing fake login page, and a breach notice is exactly what makes such a page convincing: the attacker already knows your name, email and which service you use. Passkeys and hardware security keys are tied to the real site and do not work on a fake one. Any second factor is far better than none, but where a service offers passkeys, use them, starting with email, banking, securities and shopping accounts with saved cards. The PPC's draft security guideline now gives phishing-resistant multi-factor authentication as an example for companies, including for customers' logins; we hope more Japanese services offer it.

The cost falls on the people affected. Each notice asks people to change passwords, call card issuers, file with credit bureaus and screen their calls, unpaid and in their own time. Companies can reduce that burden by saying item by item what each person should do, as the IPA does, instead of a generic "please be careful".

For people who do not read Japanese, the gap is larger. Notices and helplines are almost always in Japanese only, even when, as with Club Tourism, the leaked data includes nationality and the customers include foreign residents. The Japanese terms below cover most of what a notice says.

What this means for practitioners#

• Write notices item by item. For each category of leaked data, say what it means and what to do. The IPA's guidance is a ready-made structure.
• Offer customers multi-factor authentication, preferably passkeys, and point to it in the notice. Telling people to change their password helps less if a second factor is not available to them.
• Say what you will never ask for, and keep it true through the whole response, including any payment process.
• Name your official channels for notices and payments, and stick to them, so customers can tell real messages from fake ones.
• Remember the people who are not your customers. Emergency contacts, family members and recipients listed in your data are affected too, and they will not get your email.
• Expect fake "victims' groups" and recovery offers, and warn about them early.

Japanese terms at a glance#

Japanese	Reading	Meaning
漏えいした可能性	rōei shita kanōsei	May have leaked
流出	ryūshutsu	Leak, outflow
閲覧・取得	etsuran / shutoku	Viewed / taken
第1報・第1信	dai ippō / dai isshin	First report, first notice
含まれておりません	fukumarete orimasen	Not included
二次被害	niji higai	Secondary harm, such as fraud using leaked data
なりすまし	narisumashi	Impersonation
多要素認証	tayōso ninshō	Multi-factor authentication
パスキー	pasukī	Passkey
本人申告	honnin shinkoku	Self-declaration to credit bureaus
利用停止・消去	riyō teishi / shōkyo	Stopping use / erasure of data
特設窓口	tokusetsu madoguchi	Dedicated helpline for the incident
見舞金	mimaikin	Apology payment
着払い	chakubarai	Cash on delivery