Japan's data leaks hit 260 million since April

Unauthorized access hit data on 260 million people

Reports surged in October, and the 830 filed in its first 16 days make up about 40% of all reports in the period. Japan's Personal Information Protection Commission, the national regulator for privacy law, published the tally at its 374th meeting on October 28, 2026. Between April 1 and October 16, unauthorized access leaked or may have leaked personal data on about 260 million people, counted cumulatively, across 2,094 reports.

October brought 830 reports in 16 days

Counted by the month the Commission received each preliminary report, April and May were flat and the numbers crept up from June. Then October broke the pattern. Monthly reports stayed between 163 and 303 from April to September, but October reached about 2.7 times September's total in half a month.

Reports of data leaks caused by unauthorized access, by month received

October counts reports through the 16th. Bar heights are relative to October's 830 (= 100). Source: Personal Information Protection Commission, Reference Material 2.

166Apr

163May

185Jun

212Jul

235Aug

303Sep

830Oct (to 16th)

0250500750

The second half of October is not in these numbers yet. From April 1 through October 16, the reports add up to 2,094.

Six reports involved more than 10 million people

Six reports in the period each covered more than 10 million people. Four of those six came in during the first half of October, when another 197 reports could not yet say how many people were affected. The other two arrived in August and September.

Reports by number of people affected (April 1 – October 16, 2026)

Source: Personal Information Protection Commission, Reference Material 2.

People affected	Whole period	October (to 16th)
100,000 or fewer	1,681	588
100,001 to 1 million	62	23
1,000,001 to 10 million	35	18
More than 10 million	6	4
Unknown	310	197

Most reports were small: 1,681 of the 2,094 involved 100,000 people or fewer. The two largest size bands together account for 41 reports that each involved more than 1 million people. For a list of the individual Japanese incidents behind numbers like these, see Japan data breach list: cases by date and cause.

The 260 million figure counts some people twice

The total adds up every report, so one person can appear several times, and it counts suspected leaks as well as confirmed ones. It is not a headcount of unique victims, and it does not mean data on 260 million people has been confirmed as leaked. The Commission's notes and the way its monthly counts are built point to three things to keep in mind.

• A report is required when a leak happened or may have happened, so suspected cases are in the total
• When a company outsources data handling, the contractor and the client can both report the same incident
• The months in "Reports of data leaks caused by unauthorized access, by month received" show when the Commission received each preliminary report

Say a membership service hands its customer data to a contractor and the contractor is breached. If both companies file, the same customer is counted twice. The material does not give a figure with duplicates removed.

Banks, telecoms and government bodies are left out

Only reports filed directly with the Commission are counted, so leaks reported through other ministries and by government bodies are missing, and the preliminary figures may still change. In finance and telecommunications, companies report to the ministry that oversees their sector under powers delegated by the Commission, so those cases sit outside the 2,094.

The numbers also reflect the first, preliminary filing. When companies submit their final reports, the number of reports and the number of people affected could change.

What individuals, companies and employees should check

The Consumer Affairs Agency told individuals what to change on October 29, and the Commission told companies what to fix on October 7. The agency, which handles consumer protection in Japan, wrote its alert for people who use online services, and the Commission addressed its alert to businesses that hold personal data. The agency's advice on suspicious messages also applies to staff who get the same kind of email at work.

Individuals: replace reused passwords with passkeys

The agency advises changing any leaked login ID, using a strong password you do not reuse, and switching to passkeys or multi-factor authentication where available. A leaked password does the most damage when the same one opens other accounts. These are its four main recommendations.

• Change your login ID and switch to a password that mixes upper- and lowercase letters, numbers and symbols, and do not use it anywhere else
• Turn on multi-factor authentication, such as a code sent to your phone or a one-time password
• Sign in with a passkey, which uses your fingerprint, face or a PIN stored on your device
• Check card, carrier billing and online banking statements often for charges you do not recognize

Anti-fraud apps endorsed by the National Police Agency add another layer, and some of them block scam calls automatically. Anyone in Japan who is worried can call the consumer hotline at 188 or visit a local consumer affairs center.

Companies: delete unneeded data and review access controls

The Commission wants businesses to delete personal data they no longer need and to tighten access control and the early detection of unauthorized access. It said it had seen leaks become more serious because companies kept data they should have deleted, and asked them to check whether each set of stored data is still needed and on what legal basis.

The Commission is revising its guidelines on technical safeguards, with the final text due in April 2027. Its October 7 alert previewed the planned changes, which cover five safeguards:

• Access control, limiting which staff and systems can reach personal data
• Identifying and authenticating everyone who uses those systems
• Protecting systems from unauthorized access and malicious software
• Preventing leaks that come from using the systems
• Detecting unauthorized access early and stopping it from spreading inside the network

On October 9, Japan's trade ministry (METI) sent its own alert to companies in the industries it oversees, covered in Japan's METI warns firms after a spate of breaches. The first measure it named was having top executives lead the response.

Employees: skip links in emails and texts

Businesses and public bodies do not suddenly ask for card numbers by text or email, the agency says, so sign in only through a bookmark or the official app. The agency wrote this for consumers, but the same habit protects staff when a message claiming to be from a supplier or an internal system lands in a work inbox.

The agency tells people to treat any text or email from a company or public body as possible phishing, even one that looks familiar. Instead of tapping the link, open the site from a bookmark you saved earlier or go through the official app. Do not type an ID, password or card number on a page you reached from a message.