Ransomware attacks, data breaches and other cyber incidents at Japanese organizations, with timelines built from Japanese-language disclosures.
The government compiles an emergency package and police open a nationwide joint investigation; GMO holds its first press conference; Arara Message's breach reaches 81 million addresses and its clients start counting; Nojima, Iris Plaza and @cosme join the list; and SEGA's arcade network goes dark.
After unauthorized access to servers behind ALL.Net and Aime, the network and player card system that connect arcade machines across Japan, SEGA Fave stopped both on November 1. Five days later, cabinets from Initial D to Taiko no Tatsujin and Mario Kart were dark or limited, tournaments were cancelled, and there was no restart date.
Ryohin Keikaku, which runs MUJI, first said only email addresses, birth dates and gender of app users may have leaked. Its second report widened that to online store customers, about 520,000 names and addresses, and full card numbers of about 1.09 million MUJI Card holders, received from Credit Saison for a points scheme that stopped using them in 2021 but never deleted.
IncidentsUpdated
Attackers took up to 5.5 million records from the system Prestige International's subsidiary uses to take roadside assistance calls for insurers and car leasing companies: names, addresses, plate and chassis numbers, accident details and some bank account data. Sony Assurance, AXA, ENEOS and Nippon Car Solutions have told their own customers, each with different details.
GMO GlobalSign's single sign-on service GMO Trust Login stored files from administrators' bulk operations in the same public storage area it used to serve logos. Anyone could list and download them from November 2017 to September 2026. Third parties took files covering 45,030 people at 2,492 companies. The storage was outside the scope of its security assessments.
GMO's attackers publish data and the government asks for site blocking; MUJI discloses up to 27 million app records; Amadeus exposes JAL and ANA bookings; email delivery and other vendors keep falling; and PHP2Shell is used to root firewalls.
Japan Airlines, ANA, Korean Air and Asiana say booking records were viewed through unauthorized access to Amadeus, the passenger service system they all use. JAL says about 92,000 passengers were affected, 2,000 with passport numbers, and that access traces go back to August 2023.
A member of a Panasonic HR system project uploaded data on about 334,000 current and former employees and their families to an external generative AI service the company had banned. No attack was involved. What leaked, what the AI provider said, and the lessons for shadow AI.
IncidentsUpdated
Sagawa Express puts its breach at 53 million records; Japan pauses websites over php2shell; AI attack tools are confirmed on both sides; email delivery services are hit three times in a month; and GMO is extorted over an FX trading VPS breach.
IncidentsUpdated
Attackers broke into GMO Internet's Onamae.com Desktop Cloud, a VPS service for MT4/MT5 trading, used saved logins to trade in customers' FX accounts, and are extorting GMO. After GMO refused to pay, they began publishing data on October 27. GMO will pay every user ¥5,000, compensate trading losses, pay more to those whose data is published, and has set up a $1 million bounty.
IncidentsUpdated
Capcom says attackers got into CAPCOM ID, the account players use for its online games, exposing email addresses and login details for 11,774,247 accounts worldwide, and changing the passwords of 196. Games are unaffected.
Digital Arts, maker of the i-FILTER and m-FILTER security products sold to Japanese companies, government bodies and schools, says stolen operations credentials let attackers into the environment running six of its cloud services. It found the traces with an AI-assisted review on October 9, 2026.
IncidentsUpdated
Attackers who hit Trade Works, the vendor that runs Iwai Cosmo Securities' online trading system, placed orders in seven customers' accounts on October 14, 2026 without logging in as them. Japan's top government spokesperson says the FSA has asked for a cause analysis.
IncidentsUpdated
NEC says a company it uses for system development and maintenance was hacked in late September 2026, and its legitimate accounts were used to break into NEC customers' systems and encrypt servers. Files in a cloud storage NEC used to share project information also leaked.
IncidentsUpdated
Attackers reached the cloud environment of Studio, a Japanese no-code website builder, and the keys that decrypted its customers' form submissions and API keys. Luup, Raksul and Saitama Prefecture are among the customers now disclosing. The PPC now lets them report jointly through Studio.
Qilin claims Keio; SourceNext, Burger King Japan and Yamato disclose millions of records; a disaster alert service for hundreds of municipalities is breached; JPCERT/CC confirms AI use; and the cabinet approves a police phone hacking bill.
IncidentsUpdated
Software maker SourceNext, known abroad for Pocketalk, says a member information API was abused from October 9 to 13, 2026 to take 22.5 million records. Passwords were encrypted, not hashed, and Nikkei reports the decryption program was compromised.
BK Japan says attackers accessed the system behind the Burger King Japan app from October 2 to 7, 2026, and took data on about 11.18 million members. The cause is still under investigation.
IncidentsUpdated
A breach at Arcadia, whose SpeeCAN RAIDEN service sends disaster alert emails for hundreds of Japanese local governments, may have exposed 3.1 million email addresses. Attackers got in through a path traversal flaw and a secret key in a config file, and used a backdoor to send 1.4 million phishing emails.
IncidentsUpdated
Travel booking site skyticket says attackers took 14.6 million customer records in three intrusions. Its third report adds 32,341 refund bank accounts and partial card data on 936,000 payments, taken from old database backups it never deleted.
A record week of data breach disclosures in Japan: skyticket, Yakiniku King, Bookoff, Lawson and the IDCF Cloud ransomware attack, plus warnings from eight government agencies.
IncidentsUpdated
Attackers took names, birth dates, addresses and password hashes for 6.38 million Bookoff members (6.43 million records) from its domestic member system in October 2026.
IncidentsUpdated
Japanese convenience store chain Lawson says attackers took names, birth dates and some addresses tied to 2.15 million Lawson ID accounts in September via its app. It later corrected its notice: email addresses did not leak.
IncidentsUpdated
A ransomware attack on IDC Frontier's IDCF Cloud from October 7, 2026 hit 495 companies and local governments. Its final report says attackers broke into the customer portal's login system through an open-source flaw, took admin rights over the virtualization platform and encrypted virtual servers. It found no customer data taken; backups survive for 206 customers.
IncidentsUpdated
GMO Research & AI says attackers took personal data of 894,082 infoQ members through a software vulnerability and turned 611 members' points into ¥2.87 million in Amazon gift codes.
IncidentsUpdated
Attackers broke into Pharma DIGITAL, Asahi Kasei Therapeutics' vendor-run site for doctors in Japan. Names, workplaces and specialties of 514,000 people.
IncidentsUpdated
Attackers logged in to Scala Communications' i-ask admin site and took inquiries for up to five clients, including Daiwa Securities, Citizen and Sompo Japan.
Rakuten's cloud storage says attackers used stolen admin credentials to view and take files of 15,382 users from January to September 2026.
IncidentsUpdated
Ransomware hit Osaka Metropolitan University's virtualization platform, stopping 500 servers and most backups. The attackers used a legitimate account of a subcontractor of NEC, which runs the university's systems.
IncidentsUpdated
Attackers took member numbers, names, emails and phone numbers of almost every user of the Yakiniku King restaurant app in Japan: 10,788,963 accounts.
IncidentsUpdated
Japan's business daily Nikkei says stolen credentials were used on October 7, 2026 to take 1.83 million records from a cloud service it uses for development, days after disclosing Microsoft 365 and Google Workspace takeovers.
Japanese convenience store chain Lawson says a third party used its real mail server to send about 700,000 English-language scam emails with disguised senders.
IncidentsUpdated
Shoemaker Moonstar announced suspected unauthorized access in March and found no leak. It now says data on up to 593,000 online store customers likely leaked in May, and learned of it from a customer's phishing email.
IncidentsUpdated
The Japan Times confirms a ransomware attack, first detected on September 18, 2026, and says data claimed by the attackers was published on October 15. It came from an administrative file server used until 2022, with HR and business partner data from 2001.
IncidentsUpdated
Japanese fashion retailer ABAHOUSE learned its member and order data had been taken only when customers reported scam refund emails quoting their real orders.
Dai-ichi Life Group and Dai-ichi Life Insurance say attackers broke into their HR system and may have taken data on about 120,000 current and former employees, with records of former office staff going back to 1967. Customer data is not affected so far.
IncidentsUpdated
Yamato Transport says attackers took about 5.26 million records from Kuroneko Daikin Atobarai, its pay-later service for online shopping: names, addresses, contact details and what customers bought, from October 2018 on.
A survey download at Japanese benefits provider Benefit One showed one client data on 13,460 employees of other firms. The bug had been found nine months earlier.
IncidentsUpdated
Japanese parcel carrier Sagawa Express says up to 53.23 million records, mostly names, addresses and phone numbers from 100 days of shipments, may have leaked from its tracking service. The largest count in Japan this year.
Japanese publisher Shueisha says attackers abused a CMS misconfiguration to create an admin account and took data on 2,835 bloggers for its fashion magazines.
TOPPAN, which runs an insurance-certificate service for 14 Japanese insurers, sent data on 177,426 Sompo Japan customers to another insurer by mistake.
IncidentsUpdated
Hokkaido convenience store chain Seicomart says an attacker reached its member database through its app server and viewed data on 574,647 members.
IncidentsUpdated
Park24's final investigation into the Times Car breach in Japan: 6.63 million accounts taken, encrypted ID images sent out for 1.46 million, a ¥3,000 payment to each, and a ¥5.5 billion special loss.
Tokyo Metro says someone, apparently overseas, accessed a server for its Metpo points service, possibly exposing about 59,000 member email addresses.
IncidentsUpdated
Keio, the Tokyo rail and retail group hit by ransomware on September 26, 2026, says a group claiming the attack has published part of its data. Qilin listed Keio on its leak site on October 16. What Keio has confirmed so far.
IncidentsUpdated
Japan Post says the server behind its online service for tracing international mail was breached in September 2026, leaving about 600 senders' and recipients' details viewable, and that the service's email account was used to send spam.
On September 23, 2026, heavy external traffic overloaded J:COM's DNS servers and cut internet for up to 4.08 million households for nine hours. Was it a DDoS?
IncidentsUpdated
Attackers used a VPN flaw to break into GSS, the shared government IT platform run by Japan's Digital Agency, exposing data on 246,000 officials and contractors.