Japan data breach list: cases by date and cause

Japan data breach cases in date order

These are the main personal data breaches Japanese companies disclosed in 2026, 12 in all. Nine of them involve more than 1 million records.

Main data breaches disclosed by Japanese companies in 2026 (newest first)

Date	Company	Count	Data leaked	Cause
Oct 9	Skyticket	14.64M	Name, address	Three hacks
Oct 9	Bookoff	6.43M	Name, address	Group firm hacked
Oct 8	Lawson ID	2.16M	Email, name	Hacking
Oct 8	Big Echo	8.72M	Guest, staff	Vendor PC malware
Oct 7	IDCF Cloud	1.67M	Email	Ransomware
Oct 6	Asahi Kasei	514K	Medical staff	Vendor hacked
Oct 6	Scala	713K	Client queries	FAQ system hacked
Oct 5	Yakiniku King	10.79M	Name, email	App hacked
Oct 5	infoQ	948K	Name, address	Hacking
Sep 25	Times Car	6.6M	License images	Hacking
Jun 30	Aflac Japan	4.4M	Name, bank details	Hacking
Jun 23	KDDI	12.23M	Email, password	Software flaw

Nine disclosures in five days in October

Nine of the 12 disclosures fell in the five days from October 5 to 9. Yakiniku King and infoQ came on October 5, Asahi Kasei Therapeutics and Scala Communications on October 6, and Skyticket and Bookoff both on October 9.

Times Car confirmed 6.6 million accounts in its second report

Times Car's first report on September 25 said data might have leaked, and its second report on September 28 confirmed about 6.6 million accounts. The affected users are members of Times Car, a car sharing service.

What recent data breaches in Japan have in common

This year's cases share three things: large breaches keep coming, many leaked through contractors, and sensitive data such as passwords got out. On October 7, Tokyo Shoko Research, a Japanese credit research firm, published a count showing that listed companies are leaking personal data at a record pace.

Breaches of 1M+ records: 10 so far in 2026

Tokyo Shoko Research counted 10 breaches of 1 million records or more in 2026 as of October 5. There were 6 in all of 2025, so 2026 has already passed last year's total.

Breaches of 1 million records or more (listed companies and subsidiaries)

Count by Tokyo Shoko Research. The 2026 figure is as of October 5.

Three of this year's breaches topped 10 million people. That matches the total for the 14 years up to 2025.

Breaches of 10 million records or more (listed companies and subsidiaries)

Count by Tokyo Shoko Research. 2012–2025 is the 14-year total; 2026 is as of October 5.

The largest case on record is still Benesse Holdings in July 2014, at about 35.04 million records. A former employee of a contractor working for a group company took the data out. Five of this year's large breaches rank in the all-time top 10 by record count.

Some companies were hit twice. Yellow Hat, a car accessories chain, disclosed 3,179,454 records leaked from a subsidiary's member server in April, then up to 1,801,499 records that may have leaked from its own booking system in August.

Breaches through contractors and cloud providers

Four of the 12 cases leaked because a contractor or an outside service was attacked. Here is what was attacked in each case and who was affected:

• Asahi Kasei Therapeutics: unauthorized access to a member database managed by a contractor
• Daiichikosho: one PC at its contractor, a Nippon Columbia group company, infected with malware
• Scala Communications: unauthorized access to its FAQ system, which led five client firms including Daiwa Securities to disclose as well
• IDCF Cloud: 495 client companies and local governments affected, and JR East said data of its Eki-net members may have leaked

IDCF Cloud was hit by ransomware, an attack that encrypts data so it cannot be used and demands a ransom to restore it. When one cloud service is attacked, the damage can spread to the companies that run on it.

KDDI's case also came through a flaw in third-party software built into its own system. Even if the company you signed up with keeps its own systems in order, your data can leak through the contractors and software it relies on.

Passwords and driver's license images leaked

The data that leaked in this year's cases includes email passwords and driver's license images. KDDI leaked email passwords for 7,616,173 people and is working with the internet providers to reset them, in some cases by force. At Skyticket, about 4.13 million records included hashed passwords, meaning passwords stored in a scrambled form.

At Times Car, ID documents leaked, including images of driver's licenses. Tokyo Shoko Research noted that highly confidential data may have been exposed. You can change a password or an email address, but not your license number or your date of birth.

Some companies say card data stayed safe. Skyticket, Bookoff and Times Car all say no credit card information leaked.

What to do if your personal data was leaked

If a service you use discloses a breach, take the three steps below in order. Change the password on every other service where you use the same one, too.

What to do if you are affected by a data breach

Step	What to do
1	Read the official announcement to see if you are affected and how to contact the company
2	Change the password on the breached service and on any service that uses the same one
3	Do not open links or attachments in emails or texts that claim to be from the company

Check the company's official announcement and contact details

When a service you use discloses a breach, start with the announcement on the company's official website. The announcement shows which members are affected, what data leaked and where to send questions.

Lawson, for example, is emailing each affected customer. Fake breach emails also circulate, so if you get one, go to the official website yourself without clicking its links.

Change passwords you reuse elsewhere

If a password leaked, change it on that service. Someone could use the leaked password to log in to other services, so change it anywhere else you use it too.

Adventure, which runs Skyticket, asked its members to change their password, and to change it on any other service where they use the same one. In KDDI's case, some internet providers reset passwords themselves.

Watch for phishing emails and texts

Leaked email addresses and phone numbers can draw phishing emails and texts that pretend to come from the company. Monogatari Corporation, which runs Yakiniku King, warned its members about fake emails and phishing scams. Lawson also asked affected Lawson ID users to watch for suspicious emails, texts and calls.

Park24 says it never asks for passwords or credit card details by email, text or phone. Do not open links in messages you did not expect, and never enter your password on a page they lead to.