Japan foreign ministry leak may hit 3,600 records

What the foreign ministry breach may have exposed

About 3,600 records with names and email addresses may be affected, and about 900 of them belong to people outside the ministry. Japan's Ministry of Foreign Affairs announced in a press release on October 30, 2026 that someone had gained unauthorized access to the network it uses to communicate with outside parties.

Some of the email and other data on that network, including personal information, may have leaked. The ministry apologized to the people involved for the trouble and worry this has caused.

Leaks like this have been piling up in Japan this year, as Japan's data leaks hit 260 million since April shows. Japan data breach list: cases by date and cause compares the disclosed counts and causes.

Names and email addresses, including about 900 outsiders

The ministry has named only email addresses and names, and has not said what else is in the data or how many emails were involved. The release describes the data as "email addresses, names and so on" and stops there. It does not say whether job titles, phone numbers or the text of emails are included.

It also does not describe who the roughly 900 outsiders are. The 3,600 figure covers records that may have leaked; it is not a confirmed count.

Classified data and passport records are not included

Confidential information sits on a separate closed network, and passport and Tabi-Regi data sit in a separate consular system, so neither was hit. The ministry runs two networks. One is a closed network that ministry staff use among themselves for highly confidential information, and the other can exchange data with outside parties.

The intruder got into the second one. A precautionary review of the possibly leaked data found no highly confidential information. Passport records and Tabi-Regi, the ministry service that sends safety alerts to travelers who register their trip, are handled in a consular system built separately from the affected network.

How the ministry responded after detecting the access

The ministry blocked the access on the day it found it, investigated with an outside firm, and announced the possible leak about three months later. It spotted the intrusion on July 27, and the press release came out on October 30.

From detection to announcement (per the ministry's release)

Date	What the ministry did
July 27	Detected the unauthorized access, blocked it and invalidated credentials
After July 27	Investigated with an outside specialist firm and found the data may have leaked
October 30	Announced the possible leak and said it will contact affected people

Access cut off and credentials invalidated on July 27

The ministry says invalidating credentials stopped any further access, and it plans to review how staff sign in. Credentials here means the IDs and passwords used to prove who is logging in.

After the intruder was cut off on July 27, no further unauthorized access took place, according to the release. The ministry's plan to prevent a repeat names three steps: a review of access controls and authentication methods, closer monitoring, and renewed security training for staff.

Attacker, method and the three-month gap are not explained

The release confirms only a possible leak and leaves out the attacker, the method and the reason for the three-month gap. After blocking the access, the ministry brought in an outside specialist firm, and the investigation found that personal information may have left the network.

The release itself says nothing about how the intruder got in. According to The Japan Times, a senior ministry official said a third party had taken the login credentials for an email service. Nothing in the release accounts for what happened between July 27 and October 30.

What people who emailed the ministry should watch for

No misuse has been confirmed, but the leaked names and addresses could be used in spoofed emails, so treat messages that claim to be from the ministry with care. As of the announcement, the ministry had not seen any secondary harm such as misuse of the data. It still warns that the information could turn up in spoofed emails and phishing emails, which imitate a real sender to trick people into typing passwords or card numbers on a fake site.

What not to do with messages that claim to be from the ministry (per its release)

Channel	Do not
Email and SMS	Open links or attachments in a message you did not expect
Email, phone and SMS	Give or type in passwords, other credentials or credit card details

The ministry will not ask for passwords or card numbers

An email or call that claims to be from the ministry and asks for a password or card number is fake. The ministry states that it does not request login credentials or credit card details by email or phone.

The warning covers suspicious emails, calls and text messages that pose as the ministry or its staff. People should leave links and attachments in unfamiliar emails unopened and should not type in credentials or card details. A ministry name in the sender field does not change that.

Affected people will be contacted individually

The ministry will contact each affected person, and questions can go to its Information Systems Management Division by email. It will first identify everyone whose personal information may have leaked. It has not said when the contact will happen or by what means.

Fake messages may arrive before the real one does. If you are unsure whether a message is genuine, do not reply to it; write to the address in the press release instead.

Where to send questions (per the ministry's release)

Office	Contact
Information Systems Management Division, Minister's Secretariat, Ministry of Foreign Affairs	contact-ismd@mofa.go.jp (email)

What companies and staff who email government offices can do

Companies can review the sign-in methods and logs of their external services, and staff can delete unexpected emails that name a business partner or agency. In this case, the network that exchanges email with outside parties was the one compromised, and records of about 900 outsiders were caught up in it. Japan's Information-technology Promotion Agency (IPA), the government body that issues security guidance, published a notice for businesses on October 9 and one for individuals on October 26.

Companies: check external services, logs and sign-ins

IPA asks organizations to list every external service, check logs from the last month and then three months, and strengthen sign-in with multi-factor authentication. Looking at recently disclosed cases, IPA says break-ins tend to start with a compromised public-facing service or a compromised account.

List every external service you use

IPA asks organizations to identify all the outside services they rely on, such as cloud storage and VPNs. Some departments sign up for tools on their own, so the list needs to cover the whole company.

Check logs from the last month, then three months

For each service on the list, look through the logs for anything unusual, such as a jump in errors or activity that looks different from usual. IPA suggests starting with the last month and then widening the check to three months.

Turn on multi-factor authentication and remove unused accounts

As follow-up steps, IPA lists stronger authentication and a regular review of which accounts exist. Multi-factor authentication asks for a second proof, such as a code sent to a phone, on top of the password, so stolen credentials alone are not enough to sign in.

Staff: delete unexpected emails without opening them

Leaked names and email addresses can end up on scam mailing lists, so IPA advises treating unexpected emails as scams and deleting them. IPA says leaked email addresses and names are sometimes gathered into lists and sold on dark web sites.

Treat unexpected emails as scams

IPA's advice is to assume that an email or text you were not expecting is a scam, ignore it and delete it. Staff who have exchanged email with the ministry may get messages using its name or the name of someone they dealt with there.

Your name in an email does not prove it is real

Because the data that may have leaked includes names, a fake email can greet you by your real name. IPA warns about exactly this and says not to tap links in such emails.

Check with the sender through its official site

If the leaked address is your work address, the fake emails will land in the same inbox as your everyday business mail. When a message in the name of a partner or agency asks you to sign in or pay, contact that organization using contact details you look up yourself, not the ones in the message.