Key takeaways
- Japan's Personal Information Protection Commission (PPC) says it received 2,094 preliminary reports of personal data breaches caused by unauthorized access between April 1 and October 16, 2026, covering about 260 million people in total, with heavy double counting. 830 of them came in the first half of October alone, almost three times September's full month.
- The same day, October 28, it published a draft update of its security measures guideline, the appendix that tells companies what "necessary and appropriate" security means under the privacy law. It is the first major revision since 2016, and the PPC is bringing it forward from April 2027 to "as early as possible".
- The draft adds phishing-resistant multi-factor authentication for remote, admin and sensitive access, a ban in principle on reused passwords, zero trust checks, limits on privileged accounts, log retention, EDR and containment, and makes detection of intrusions a heading of its own among the measures companies must take.
- Most of the additions are examples, not obligations, and the PPC stresses that it is not creating new rules. But it uses this appendix to decide whether to take enforcement action, so in our view the examples will become the benchmark.
- Public comments are open until November 27. Practitioners can compare their own controls against the draft now.
The numbers#
The PPC counted reports of breaches caused by unauthorized access, by the month in which the first (preliminary) report arrived and by the number of people involved:
| Month (2026) | Reports | Up to 100,000 people | 100,000 to 1 million | 1 to 10 million | Over 10 million | Not yet known |
|---|---|---|---|---|---|---|
| April | 166 | 151 | 4 | 6 | 0 | 5 |
| May | 163 | 149 | 3 | 0 | 0 | 11 |
| June | 185 | 162 | 7 | 1 | 0 | 15 |
| July | 212 | 197 | 3 | 2 | 0 | 10 |
| August | 235 | 205 | 10 | 4 | 1 | 15 |
| September | 303 | 229 | 12 | 4 | 1 | 57 |
| October 1–16 | 830 | 588 | 23 | 18 | 4 | 197 |
Read the figures with three caveats the PPC itself gives:
- About 260 million is a cumulative count. The same person is counted once for every breach they are in, and when a company outsources data handling, both the contractor and the client may report the same incident.
- Only reports made directly to the PPC are included. Breaches reported through other ministries, such as those for finance and telecommunications, and those at government bodies, are not.
- These are preliminary reports. Numbers may change when final reports arrive.
Even so, the trend is plain. Monthly reports almost doubled between April and September, then the first half of October produced nearly three times September's total, including four reports of more than 10 million people. The jump in reports whose size is not yet known, from 57 in September to 197, suggests many were filed quickly while investigations were still under way. This matches what we have seen on our own list of 2026's largest breaches, which grew from 29 to 49 entries between October 17 and October 30.
What the security measures guideline is#
Japan's Act on the Protection of Personal Information (APPI) requires every business that handles personal data to take "necessary and appropriate measures" to keep it secure (Article 23). The law does not say what those are. The PPC explains it in an appendix to its general guidelines, titled "Content of security control measures to be taken".
The appendix is organized in two columns:
- Measures that must be taken (講じなければならない措置). If a company does not take them, the PPC may judge that it has violated the law.
- Examples of methods (手法の例示). These show how the measures can be met. They are not all required, and other methods can be appropriate. Which to use should depend on the risk: how much harm a leak would cause, the size of the business, and the type and volume of data.
The measures fall into four groups, plus a requirement to set rules for handling data:
| Group | What it covers |
|---|---|
| Organizational | A responsible person or department, operating by the rules, checking how data is handled, incident response, reviewing measures |
| Human | Training and supervising staff |
| Physical | Controlling areas where data is handled, preventing theft of devices and media, deleting data and disposing of equipment |
| Technical | Access control, identifying and authenticating users, preventing unauthorized access from outside, preventing leaks through system use |
There is a simplified column of examples for small businesses with up to 100 employees. They still have the same legal duty; only the suggested methods are lighter. The simplified examples do not apply to a small business whose databases covered more than 5,000 people on any day in the past six months, or to one that handles personal data on behalf of other companies. In practice, that leaves out most online services and vendors.
The appendix has not changed much since 2016, before cloud services, remote work and today's ransomware became normal. The PPC also says it uses the appendix's items when it decides whether and how to use its powers against a company after a breach. So although most of it is "examples", it is also the checklist the regulator brings to an investigation.
What changes#
The PPC groups the changes under four headings: handling data in many more ways (cloud, more capable devices), zero trust alongside perimeter defense, stopping attackers from spreading after they get in, and clearer wording.
| Area | Main additions in the draft |
|---|---|
| Authentication | Multi-factor authentication, including phishing-resistant methods, for access from outside networks, with admin rights, or to important personal data. Fingerprint, vein and face authentication as examples. A ban in principle on reusing the same ID and password, limits on similar passwords, minimum length and lockout. MFA also given as an example for customers and other non-employees |
| Access control | Keep privileged accounts to the minimum people, devices and situations. Change access rights promptly when people move or leave. Evaluate dynamic context, such as location, time and device security state, for each access request (zero trust) |
| Devices | Allow access to personal data only from approved devices that meet security standards |
| Detection and containment | A new heading, "detection of unauthorized access", among the measures that must be taken: put in place, in normal times, ways to detect intrusions early, and run them so that damage within the network can be stopped from spreading. Examples: keep authentication, access, operation and communication logs for a period, protect them from tampering and deletion, analyse them regularly; use IDS/IPS and EDR; isolate affected systems and disable accounts |
| Cloud | When deleting data from cloud services, use the provider's method, crypto-erasure or other means that prevent recovery |
| Organization | A responsible department with clear roles; clearer rules for staff; regular review of measures and training |
The PPC says these changes add examples and clarify the text, and do not create new rules. The detection heading is presented as a reorganization of examples that already existed, such as analysing logs.
The timeline, brought forward#
| Step | Original plan | Now |
|---|---|---|
| Draft reviewed by the Commission | November 2026 | October 28, 2026 |
| Public comments | December 2026 | October 29 – November 27, 2026 |
| Decision and entry into force | February and April 2027 | "As early as possible" |
The PPC had previewed several of these examples in its October 7 warning to companies. Its reason for speeding up: it has recently dealt with cases in which businesses whose services are widely used and that handle large amounts of personal data were hacked from outside and large volumes of data were leaked, or may have been.
The government's wider response#
Two days earlier, on October 26, Prime Minister Takaichi held the first Cybersecurity Related Ministers' Meeting. She told ministers to make sure companies hit by attacks can get support wherever they turn, to collect information from affected companies in every sector, not only critical infrastructure, and centralize it at the National Cybersecurity Office, and to prepare measures including budget. An "emergency countermeasures package" is due within the following week.
Our view#
The detection heading is the real change. For ten years, the guideline has mostly been about keeping attackers out. The draft asks companies to assume someone may get in, to notice quickly, and to stop it spreading. That fits what this month's cases show: a World subsidiary took eleven days to notice an intrusion, Amadeus's airline customers learned of three years of traces from the vendor, and the IDCF Cloud attackers went from a login system to the whole virtualization platform. Logs that are kept, protected and actually reviewed are what make detection and investigation possible.
Examples will work like requirements. The PPC is right that examples are not obligations. But when it investigates a breach, the first questions will be whether the company had phishing-resistant MFA on admin access, whether it kept logs, and whether it could contain the attack. In our view, companies that handle large amounts of personal data should treat the examples as the expected baseline, and document why when they choose something else.
Phishing-resistant MFA is the right line to draw. Several of this year's breaches started with stolen or misused credentials. Naming phishing-resistant methods, rather than any second factor, reflects how attackers now get around SMS and one-time codes.
Vendors are outside this draft. Many of 2026's largest breaches happened at contractors and platforms, from email delivery services to cloud and booking systems. Supervising contractors is covered in a different part of the guidelines, and this revision does not add to it. The security measures in the appendix apply to the vendors themselves when they handle personal data, but the question of what a client must check is left where it was.
The numbers need a better home. A one-page table at a Commission meeting is welcome, but it is the only official view of the breach wave by size. Regular publication, with the cause, sector and whether the breach happened at a contractor, would help companies and the public see where the risk is.
What this means for practitioners#
- Read the draft and compare. Map your controls to the new examples: MFA by access type, password reuse, privileged accounts, device conditions, logs, EDR and containment.
- Check logs first. Which authentication, access, operation and communication logs do you keep, for how long, and could an attacker with admin rights delete them?
- Plan containment. Decide in advance who can isolate a system or disable accounts, and test that it can be done quickly.
- Comment by November 27 if parts of the draft are unclear or unworkable for your business. Comments can be sent through the PPC's public comment page and e-Gov.
- Watch the timing. The changes may take effect well before April 2027.
Japanese terms at a glance#
| Japanese | Reading | Meaning |
|---|---|---|
| 安全管理措置 | anzen kanri sochi | Security control measures |
| 講じなければならない措置 | kōjinakereba naranai sochi | Measures that must be taken |
| 手法の例示 | shuhō no reiji | Examples of methods |
| 通則編 | tsūsoku-hen | General Rules (guidelines) |
| 漏えい等報告 | rōei tō hōkoku | Breach report |
| 速報 / 確報 | sokuhō / kakuhō | Preliminary / final report |
| 多要素認証 | tayōso ninshō | Multi-factor authentication |
| 横展開 | yoko tenkai | Lateral movement |
| 意見募集（パブコメ） | iken boshū (pabukome) | Public comment |