Nitori Holdings, Japan's largest furniture and home goods chain, says up to 37.62 million records may have leaked after unauthorized access found on November 6, with signs of access from mid-October. The data covers individual members, people who bought without an account, corporate members and orders placed through its shops on online malls. No passwords or card data. The cause has not been disclosed.
KALDI's newsletter addresses leaked through a marketing service that used another company's mail system. MUJI's curtain orders sat on a contractor's contractor's server. Bond buyers' data went from issuer to NTT Data to Securitize Japan. This autumn's breaches show how far personal data travels from the brand customers know, and how little each company in the chain sees.
After unauthorized access to servers behind ALL.Net and Aime, the network and player card system that connect arcade machines across Japan, SEGA Fave stopped both on November 1. Five days later, cabinets from Initial D to Taiko no Tatsujin and Mario Kart were dark or limited, tournaments were cancelled, and there was no restart date.
Ryohin Keikaku, which runs MUJI, first said only email addresses, birth dates and gender of app users may have leaked. Its second report widened that to online store customers, about 520,000 names and addresses, and full card numbers of about 1.09 million MUJI Card holders, received from Credit Saison for a points scheme that stopped using them in 2021 but never deleted.
Attackers took up to 5.5 million records from the system Prestige International's subsidiary uses to take roadside assistance calls for insurers and car leasing companies: names, addresses, plate and chassis numbers, accident details and some bank account data. Sony Assurance, AXA, ENEOS and Nippon Car Solutions have told their own customers, each with different details.
GMO GlobalSign's single sign-on service GMO Trust Login stored files from administrators' bulk operations in the same public storage area it used to serve logos. Anyone could list and download them from November 2017 to September 2026. Third parties took files covering 45,030 people at 2,492 companies. The storage was outside the scope of its security assessments.
GMO Internet answered the extortion of its Onamae.com Desktop Cloud customers with a public campaign: a request for active cyber defense, a CEO blog, a $1 million bounty with daily tip counts and a stream of social media posts. Its customer advice was good. The spectacle around it was, in our view, the worst way to respond to people who need attention.
With 50 breaches of a million records or more disclosed in Japan this year, many people have now received a notice. Based on the IPA's new guidance, here is what each kind of leaked data means, what to do about it, the scams that follow, and the rights Japanese law gives you.
Times Car is paying ¥3,000 to 1.46 million customers whose ID images were sent out, and GMO is paying ¥5,000 to every user plus ¥10,000 to ¥25,000 per category of data the attackers publish. We compare them with earlier apology payments and with what Japanese courts have awarded.
A member of a Panasonic HR system project uploaded data on about 334,000 current and former employees and their families to an external generative AI service the company had banned. No attack was involved. What leaked, what the AI provider said, and the lessons for shadow AI.
We analyzed every breach of a million records or more disclosed in Japan in 2026. Most came in the last five weeks, one in three hit a vendor or platform rather than the brand, and half the companies have not said how the attackers got in.
Attackers broke into GMO Internet's Onamae.com Desktop Cloud, a VPS service for MT4/MT5 trading, used saved logins to trade in customers' FX accounts, and are extorting GMO. After GMO refused to pay, they began publishing data on October 27. GMO will pay every user ¥5,000, compensate trading losses, pay more to those whose data is published, and has set up a $1 million bounty.
Capcom says attackers got into CAPCOM ID, the account players use for its online games, exposing email addresses and login details for 11,774,247 accounts worldwide, and changing the passwords of 196. Games are unaffected.
Digital Arts, maker of the i-FILTER and m-FILTER security products sold to Japanese companies, government bodies and schools, says stolen operations credentials let attackers into the environment running six of its cloud services. It found the traces with an AI-assisted review on October 9, 2026.
Attackers who hit Trade Works, the vendor that runs Iwai Cosmo Securities' online trading system, placed orders in seven customers' accounts on October 14, 2026 without logging in as them. Japan's top government spokesperson says the FSA has asked for a cause analysis.
NEC says a company it uses for system development and maintenance was hacked in late September 2026, and its legitimate accounts were used to break into NEC customers' systems and encrypt servers. Files in a cloud storage NEC used to share project information also leaked.
Attackers reached the cloud environment of Studio, a Japanese no-code website builder, and the keys that decrypted its customers' form submissions and API keys. Luup, Raksul and Saitama Prefecture are among the customers now disclosing. The PPC now lets them report jointly through Studio.
Software maker SourceNext, known abroad for Pocketalk, says a member information API was abused from October 9 to 13, 2026 to take 22.5 million records. Passwords were encrypted, not hashed, and Nikkei reports the decryption program was compromised.
BK Japan says attackers accessed the system behind the Burger King Japan app from October 2 to 7, 2026, and took data on about 11.18 million members. The cause is still under investigation.
A breach at Arcadia, whose SpeeCAN RAIDEN service sends disaster alert emails for hundreds of Japanese local governments, may have exposed 3.1 million email addresses. Attackers got in through a path traversal flaw and a secret key in a config file, and used a backdoor to send 1.4 million phishing emails.
Every data breach disclosed in Japan in 2026 affecting a million or more records, ranked by size, from Sagawa Express and Gyazo to KDDI and Times Car, with what leaked and how.
Travel booking site skyticket says attackers took 14.6 million customer records in three intrusions. Its third report adds 32,341 refund bank accounts and partial card data on 936,000 payments, taken from old database backups it never deleted.
Attackers took names, birth dates, addresses and password hashes for 6.38 million Bookoff members (6.43 million records) from its domestic member system in October 2026.
Japanese convenience store chain Lawson says attackers took names, birth dates and some addresses tied to 2.15 million Lawson ID accounts in September via its app. It later corrected its notice: email addresses did not leak.
Japan's national CERT describes the attacks behind the breach wave: known-flaw scanning, internal API abuse, a Metabase bug, web shells and AI penetration testing tools such as ARTEX and Cairn, with attacker IPs.
A ransomware attack on IDC Frontier's IDCF Cloud from October 7, 2026 hit 495 companies and local governments. Its final report says attackers broke into the customer portal's login system through an open-source flaw, took admin rights over the virtualization platform and encrypted virtual servers. It found no customer data taken; backups survive for 206 customers.
GMO Research & AI says attackers took personal data of 894,082 infoQ members through a software vulnerability and turned 611 members' points into ¥2.87 million in Amazon gift codes.
Attackers broke into Pharma DIGITAL, Asahi Kasei Therapeutics' vendor-run site for doctors in Japan. Names, workplaces and specialties of 514,000 people.
Attackers logged in to Scala Communications' i-ask admin site and took inquiries for up to five clients, including Daiwa Securities, Citizen and Sompo Japan.
Ransomware hit Osaka Metropolitan University's virtualization platform, stopping 500 servers and most backups. The attackers used a legitimate account of a subcontractor of NEC, which runs the university's systems.
Japan's business daily Nikkei says stolen credentials were used on October 7, 2026 to take 1.83 million records from a cloud service it uses for development, days after disclosing Microsoft 365 and Google Workspace takeovers.
Japanese convenience store chain Lawson says a third party used its real mail server to send about 700,000 English-language scam emails with disguised senders.
Shoemaker Moonstar announced suspected unauthorized access in March and found no leak. It now says data on up to 593,000 online store customers likely leaked in May, and learned of it from a customer's phishing email.
The Japan Times confirms a ransomware attack, first detected on September 18, 2026, and says data claimed by the attackers was published on October 15. It came from an administrative file server used until 2022, with HR and business partner data from 2001.
Japanese fashion retailer ABAHOUSE learned its member and order data had been taken only when customers reported scam refund emails quoting their real orders.
A survey download at Japanese benefits provider Benefit One showed one client data on 13,460 employees of other firms. The bug had been found nine months earlier.
TOPPAN, which runs an insurance-certificate service for 14 Japanese insurers, sent data on 177,426 Sompo Japan customers to another insurer by mistake.
Park24's final investigation into the Times Car breach in Japan: 6.63 million accounts taken, encrypted ID images sent out for 1.46 million, a ¥3,000 payment to each, and a ¥5.5 billion special loss.
Japan Post says the server behind its online service for tracing international mail was breached in September 2026, leaving about 600 senders' and recipients' details viewable, and that the service's email account was used to send spam.