Nitori Holdings, Japan's largest furniture and home goods chain, says up to 37.62 million records may have leaked after unauthorized access found on November 6, with signs of access from mid-October. The data covers individual members, people who bought without an account, corporate members and orders placed through its shops on online malls. No passwords or card data. The cause has not been disclosed.
KALDI's newsletter addresses leaked through a marketing service that used another company's mail system. MUJI's curtain orders sat on a contractor's contractor's server. Bond buyers' data went from issuer to NTT Data to Securitize Japan. This autumn's breaches show how far personal data travels from the brand customers know, and how little each company in the chain sees.
Japan's government blames this year's breach wave on unpatched flaws, misconfigurations and weak development security, at companies and their contractors. Its emergency package sets November deadlines for new teams, promises a Japanese KEV list and attacker infrastructure disclosures, and moves online identity checks from ID photos to the chip in My Number cards. For companies, it works mostly through requests and support.
The government compiles an emergency package and police open a nationwide joint investigation; GMO holds its first press conference; Arara Message's breach reaches 81 million addresses and its clients start counting; Nojima, Iris Plaza and @cosme join the list; and SEGA's arcade network goes dark.
Ryohin Keikaku, which runs MUJI, first said only email addresses, birth dates and gender of app users may have leaked. Its second report widened that to online store customers, about 520,000 names and addresses, and full card numbers of about 1.09 million MUJI Card holders, received from Credit Saison for a points scheme that stopped using them in 2021 but never deleted.
Attackers took up to 5.5 million records from the system Prestige International's subsidiary uses to take roadside assistance calls for insurers and car leasing companies: names, addresses, plate and chassis numbers, accident details and some bank account data. Sony Assurance, AXA, ENEOS and Nippon Car Solutions have told their own customers, each with different details.
GMO GlobalSign's single sign-on service GMO Trust Login stored files from administrators' bulk operations in the same public storage area it used to serve logos. Anyone could list and download them from November 2017 to September 2026. Third parties took files covering 45,030 people at 2,492 companies. The storage was outside the scope of its security assessments.
With 50 breaches of a million records or more disclosed in Japan this year, many people have now received a notice. Based on the IPA's new guidance, here is what each kind of leaked data means, what to do about it, the scams that follow, and the rights Japanese law gives you.
Japan's Personal Information Protection Commission received 830 breach reports caused by unauthorized access in the first half of October alone, and is bringing forward the first major update of its security measures guideline since 2016: phishing-resistant MFA, zero trust, EDR, log retention and containment. Public comments close November 27.
GMO's attackers publish data and the government asks for site blocking; MUJI discloses up to 27 million app records; Amadeus exposes JAL and ANA bookings; email delivery and other vendors keep falling; and PHP2Shell is used to root firewalls.
Japan's communications ministry asked telecom carriers to block the site where GMO's attackers published customer data. Blocking is rare in Japan because it touches the constitutional secrecy of communications. We explain the precedents, from child abuse images in 2011 to manga piracy in 2018, and what is new this time.
Japan Airlines, ANA, Korean Air and Asiana say booking records were viewed through unauthorized access to Amadeus, the passenger service system they all use. JAL says about 92,000 passengers were affected, 2,000 with passport numbers, and that access traces go back to August 2023.
In October 2026, attackers broke into a no-code website builder, a B2B marketing platform, an SNS campaign tool and several email delivery services used by Japanese companies. Marketing departments often buy these tools outside IT's view, and they hold customer data and keys to other services. Misconfigured CRM settings and apps connected to Salesforce have exposed data the same way.
Times Car is paying ¥3,000 to 1.46 million customers whose ID images were sent out, and GMO is paying ¥5,000 to every user plus ¥10,000 to ¥25,000 per category of data the attackers publish. We compare them with earlier apology payments and with what Japanese courts have awarded.
Arcadia, Yumil Link, Blastmail and Y-mail, four Japanese services that send email for other organizations, were breached in October 2026, after IDCF Cloud's outage stopped others. In each case attackers reached the access the vendor uses to run its customers' environments on its own servers, and phishing went out under real senders' names, where email authentication cannot help.
A member of a Panasonic HR system project uploaded data on about 334,000 current and former employees and their families to an external generative AI service the company had banned. No attack was involved. What leaked, what the AI provider said, and the lessons for shadow AI.
Japan's ruling LDP and the tech-focused Team Mirai both issued emergency cybersecurity proposals in the week of October 20, 2026. We compare them, and test them against what this year's breaches actually show.
We analyzed every breach of a million records or more disclosed in Japan in 2026. Most came in the last five weeks, one in three hit a vendor or platform rather than the brand, and half the companies have not said how the attackers got in.
Sagawa Express puts its breach at 53 million records; Japan pauses websites over php2shell; AI attack tools are confirmed on both sides; email delivery services are hit three times in a month; and GMO is extorted over an FX trading VPS breach.
Capcom says attackers got into CAPCOM ID, the account players use for its online games, exposing email addresses and login details for 11,774,247 accounts worldwide, and changing the passwords of 196. Games are unaffected.
NEC says a company it uses for system development and maintenance was hacked in late September 2026, and its legitimate accounts were used to break into NEC customers' systems and encrypt servers. Files in a cloud storage NEC used to share project information also leaked.
GMO Cybersecurity by Ierae says attackers behind Japan's breach wave used ARTEX, an open-source AI penetration testing tool from China, against about 20 Japanese companies, eight of which have already disclosed breaches. CrowdStrike saw the same tool in attacks on South Korean banks.
Attackers reached the cloud environment of Studio, a Japanese no-code website builder, and the keys that decrypted its customers' form submissions and API keys. Luup, Raksul and Saitama Prefecture are among the customers now disclosing. The PPC now lets them report jointly through Studio.
Japan's 2026 breach wave hit app after app, and ID images kept for years. Why the data that companies never collected, or deleted on time, is the one defense that held.
Qilin claims Keio; SourceNext, Burger King Japan and Yamato disclose millions of records; a disaster alert service for hundreds of municipalities is breached; JPCERT/CC confirms AI use; and the cabinet approves a police phone hacking bill.
Software maker SourceNext, known abroad for Pocketalk, says a member information API was abused from October 9 to 13, 2026 to take 22.5 million records. Passwords were encrypted, not hashed, and Nikkei reports the decryption program was compromised.
BK Japan says attackers accessed the system behind the Burger King Japan app from October 2 to 7, 2026, and took data on about 11.18 million members. The cause is still under investigation.
A breach at Arcadia, whose SpeeCAN RAIDEN service sends disaster alert emails for hundreds of Japanese local governments, may have exposed 3.1 million email addresses. Attackers got in through a path traversal flaw and a secret key in a config file, and used a backdoor to send 1.4 million phishing emails.
Japan's NICT says attackers are analyzing public Android apps to map and attack their backend APIs, one cause of Japan's breach wave. The four flaws targeted, and what to check.
Japan's government warned in May that frontier AI could speed up cyberattacks. Is it behind this autumn's breach wave? What officials, responders and the evidence actually say.
Every data breach disclosed in Japan in 2026 affecting a million or more records, ranked by size, from Sagawa Express and Gyazo to KDDI and Times Car, with what leaked and how.
Ransomware attacks on Japanese companies, hospitals, universities and local governments in 2026, as confirmed by the victims themselves, with what each one disrupted or leaked.
Travel booking site skyticket says attackers took 14.6 million customer records in three intrusions. Its third report adds 32,341 refund bank accounts and partial card data on 936,000 payments, taken from old database backups it never deleted.
A record week of data breach disclosures in Japan: skyticket, Yakiniku King, Bookoff, Lawson and the IDCF Cloud ransomware attack, plus warnings from eight government agencies.
In one week, eight Japanese agencies warned companies after a wave of breaches. What each asks, and why the FSA wants banks to drop ID photo uploads before 2027.
Attackers took names, birth dates, addresses and password hashes for 6.38 million Bookoff members (6.43 million records) from its domestic member system in October 2026.
Japanese convenience store chain Lawson says attackers took names, birth dates and some addresses tied to 2.15 million Lawson ID accounts in September via its app. It later corrected its notice: email addresses did not leak.
Japan's national CERT describes the attacks behind the breach wave: known-flaw scanning, internal API abuse, a Metabase bug, web shells and AI penetration testing tools such as ARTEX and Cairn, with attacker IPs.
GMO Research & AI says attackers took personal data of 894,082 infoQ members through a software vulnerability and turned 611 members' points into ¥2.87 million in Amazon gift codes.
Attackers broke into Pharma DIGITAL, Asahi Kasei Therapeutics' vendor-run site for doctors in Japan. Names, workplaces and specialties of 514,000 people.
Attackers logged in to Scala Communications' i-ask admin site and took inquiries for up to five clients, including Daiwa Securities, Citizen and Sompo Japan.
Shoemaker Moonstar announced suspected unauthorized access in March and found no leak. It now says data on up to 593,000 online store customers likely leaked in May, and learned of it from a customer's phishing email.
Japanese fashion retailer ABAHOUSE learned its member and order data had been taken only when customers reported scam refund emails quoting their real orders.
Dai-ichi Life Group and Dai-ichi Life Insurance say attackers broke into their HR system and may have taken data on about 120,000 current and former employees, with records of former office staff going back to 1967. Customer data is not affected so far.
Yamato Transport says attackers took about 5.26 million records from Kuroneko Daikin Atobarai, its pay-later service for online shopping: names, addresses, contact details and what customers bought, from October 2018 on.
A survey download at Japanese benefits provider Benefit One showed one client data on 13,460 employees of other firms. The bug had been found nine months earlier.
Japanese parcel carrier Sagawa Express says up to 53.23 million records, mostly names, addresses and phone numbers from 100 days of shipments, may have leaked from its tracking service. The largest count in Japan this year.
Japanese publisher Shueisha says attackers abused a CMS misconfiguration to create an admin account and took data on 2,835 bloggers for its fashion magazines.
Park24's final investigation into the Times Car breach in Japan: 6.63 million accounts taken, encrypted ID images sent out for 1.46 million, a ¥3,000 payment to each, and a ¥5.5 billion special loss.
Japan Post says the server behind its online service for tracing international mail was breached in September 2026, leaving about 600 senders' and recipients' details viewable, and that the service's email account was used to send spam.
Attackers used a VPN flaw to break into GSS, the shared government IT platform run by Japan's Digital Agency, exposing data on 246,000 officials and contractors.