Update, 8 October 2026, 23:30 JST. This review now covers every breach and incident notice we found from 10 August to 8 October 2026, a 60-day window, and absorbs our September review of 29 notices, whose address now forwards here. The 12-month list of disclosures of 100,000 or more grows from 30 to 38, and its total from 131.57 million to 147.20 million. Seicomart moves from "method not disclosed" to "app or API abuse", because its third notice names the route: the app server. Earlier corrections are listed under "Reporting note".
60 days in numbers
From 10 August to 8 October 2026 we found 153 notices from organisations in Japan:
- 92 attacks in which personal data leaked or may have leaked.
- 7 mistakes with no attacker. We list those affecting 1,000 or more people, or covered in our earlier reviews. Smaller mistakes, such as lost papers and misdirected email, are far more numerous and not listed.
- 54 other incidents with no personal-data loss stated: 12 mail accounts or sending keys misused for spam or impersonation, 8 ransomware attacks, 3 tampered ticket lotteries, 3 tech-support scams and 28 website compromises, defacements or other unauthorised access.
Add up every figure the 99 data notices give and you get 71,267,919, or 58% of Japan's 122.65 million people. Three notices make up 60% of it: Gyazo (about 23.62 million user records), the Yakiniku King app (10,788,963 records) and Daiichikosho (about 8.72 million, possible).
The last 45 days, 25 August to 8 October, hold 127 of the 153 notices and 69.44 million of the total, 97%. Part of that is real: Gyazo, Yakiniku King, Daiichikosho, Murauchi.com, Times Car and Lawson all fall in it. Part comes from our sources, which cover August less fully than September and October (see "Reporting note").
The count hides three things:
- 40 of the 92 attack notices give no number.
- 49 of the 92 do not say how the attacker got in.
- 13 notices trace back to a supplier or platform that the organisation did not run.
Figure 1. The 153 notices by what each says about the cause. Original graphic for this article.
147 million in a country of 123 million
Add up the 38 disclosures of 100,000 or more announced between September 2025 and 8 October 2026 and you get 147,202,435, about 1.2 times Japan's population of 122.65 million on 1 September 2026 (Statistics Bureau of Japan). Eight joined since our update of 6 October: Daiichikosho, Lawson ID, Yellow Hat's work-booking system, MrMax, Asahi Kasei Therapeutics, LEAN BODY, the Daiki Suisan app and Citizen Watch. LEAN BODY's notice dates from 15 September and was missing from our earlier list. Twenty-six of the 38 fall inside the 60-day window.
That is a sum of reported figures, not a count of people:
- Fewer than one in five is counted in people. About 25.8 million of the total, 17.5%, comes from notices that count people, members or customers. The rest is database records, accounts, email addresses and cumulative registrations (see "Read the units before the ranking").
- The same people appear again and again. Someone can have a mail address on an ISP that used KDDI's platform, a Lawson ID, a Times Car account and the Seicomart app.
- Not everyone is in Japan. Gyazo is used worldwide, and about 18 million of its 23.62 million user records are anonymous accounts with no email address.
- Many are ceilings. "Up to" and "possible" figures, such as Daiichikosho's 8.72 million, are what could have been reached, not what was confirmed taken.
- Three entries are almost half of it. EPARK, Gyazo and KDDI make up 47% of the total.
Editorial assessment. The comparison is a headline, and it is accurate as far as it goes: in one year, the leak notices of a few dozen organisations reached a scale larger than the country. It cannot tell you who was affected, or how badly. The useful question is per person and per organisation: how many of these services hold data about you, your customers or your staff, and which of the causes below could reach them?
Figure 2. The 38 disclosures of 100,000 or more, by reported size and cause. Updated 8 October 2026. Original graphic for this article.
JPCERT/CC's alert describes the same shapes
On 8 October JPCERT/CC issued alert JPCERT-AT-2026-0030. It says leaks of personal data through unauthorised access to Japanese organisations have come one after another around September 2026, that the technical information shared so far is limited and fragmentary, and that, separately from the ransomware attacks that occur on and off all the time, it is warning about the attack types behind the large leaks (JPCERT/CC). It describes three kinds of case, without naming organisations:
- Case A. Scanning each target for a range of known vulnerabilities, and stealing configuration and backup files left reachable through poor management.
- Case B. Abuse of APIs. Endpoints and keys found by analysing public smartphone apps; internal APIs that the app's screens never call, used to change user privileges, create accounts and compare responses with and without headers or with malformed tokens; NoSQL injection used to search blind for account data; and API keys stolen in other breaches. Some requests to apps' management APIs rewrote data.
- Case C. SQL injection in Metabase, CVE-2026-72898, the subject of a JPCERT/CC alert on 14 August (JPCERT/CC).
It published source addresses and User-Agent strings for cases B and C (see "Hunting"), and notes that victims include systems never meant for public access, such as BI tools and staff admin systems. Its countermeasures: per-time request limits, with separate limits for login, password reset, SMS and search; access control on every endpoint, including unpublished APIs; least-privilege API tokens that expire and can be revoked quickly; geographic restriction where a service is regional; patching; review of lateral movement after a web server is compromised; detection and first response; advice to customers such as multi-factor authentication; taking unneeded admin functions off the internet; and not keeping data past its retention period or purpose.
Editorial assessment. JPCERT/CC does not link its cases to named notices, and we do not either. But many notices in our list describe the same shapes in their own words: a mechanism meant to show users their own data (Lawson), access through the app server (Seicomart), requests that returned user data (Sammy Networks), an analytics tool (LEAN BODY, ApplyNow, VOISING), and results changed in three ticket lotteries. The countermeasure list reads as a checklist against the patterns below.
Ten patterns in the 60 days
1. Apps and APIs that answer anyone who asks the right way
- Lawson ID, 2,155,345 records: Lawson says the data came out through the mechanism meant to show users their own information in the app. Access on 12–14 and 17 September was found on 7 October (our analysis).
- Seicomart app, 572,022 people: the member server was reached through the app server.
- Unni, about 48,000 users in Japan: an API that returns consultation history was abused.
- Nippon Rent-a-Car: two intrusions into the app, by different methods, exposed licence numbers for members who had registered them.
- Sammy Networks, 777CON-PASS: a third party ran requests that returned user and hall data from 25 September.
- nimoca, 521 records: the web service that shows card usage history was attacked; card number, date of birth and email.
- Sagawa Express: its parcel enquiry service was abused; the data at risk covers about 100 days (our analysis).
- StudySapuri: a specification flaw let a third party confirm that 3,687 email addresses were registered.
Four more app notices do not say how: the Yakiniku King app (10,788,963 records), the Daiki Suisan app (up to 174,933 people), Coop Yamaguchi's LINE mini app and the Post Office app. MrMax says "a software function" was misused to enter the server behind its app and online store (up to 1,735,154 members); we count that as a software flaw.
Editorial assessment. An app ships its endpoints, and often its keys, to every phone that installs it. Assume an attacker has read them. The test that matters is simple: log in as one customer and ask for another customer's record. Then limit each function separately, return only the fields a screen shows, and alert on one caller reading many different records, not only on volume. Our Lawson analysis has queries for that pattern.
2. Analytics tools and known vulnerabilities
LEAN BODY names Metabase, a tool for querying and charting database contents: about 440,000 accounts, including withdrawn members, with access from 11 August. ApplyNow, a recruitment platform, names only "a data analysis tool", exploited between 9 August and 7 September; one of its products held applicants' My Number, pension numbers and bank details. VOISING reported a known, unpatched vulnerability in a BI tool on 18 August. JPCERT/CC's case C is Metabase.
Other notices name the flaw:
- Gyazo: an upload-server vulnerability let an attacker run commands and take the database.
- Murauchi.com: a vulnerability in part of a web system, then several other systems (our analysis).
- infoQ: a software vulnerability; every member record the company held was taken, and 611 accounts' points were exchanged for about ¥2.87 million (our analysis).
- Digital Agency (GSS): a VPN vulnerability; a maintenance account opened large numbers of files.
- Shueisha: a CMS misconfiguration led to stolen API credentials and a new privileged account.
- Zurich Insurance: a vulnerability in the system for uploading dashcam footage.
- Plugins and CMSs: Gakken Meds, a Benesse group company, Higashi Sangyo (through the wp2shell tool) and a Tokyo pipe-works cooperative.
Editorial assessment. An analytics tool usually holds a database account that can read every table, and it is often reachable from more places than the database. A flaw in that tool exposes everything the account can read. Treat such tools as part of the database: keep them off the internet, patch them on the same schedule, and give them read access only to what the dashboards need.
3. Follow the supplier
Thirteen notices trace back to a supplier or platform. A breach there reaches the public as several notices, on different dates, with different numbers and sometimes none.
Figure 3. Breaches and faults at one supplier that surfaced as notices from its customers. Original graphic for this article.
- Scala Communications runs enquiry services. Daiwa Securities reported on 5 October (our analysis); Citizen Watch named the same supplier the next day for about 100,000 enquiry-form records.
- 医薬情報ネット (PIN) runs Pharma DIGITAL, Asahi Kasei Therapeutics' site for healthcare professionals: about 514,000 of them, and 700 staff (our analysis).
- Daiichikosho, which runs Big Echo karaoke, says malware infected a device used by a contractor's employee: about 8.72 million records possibly affected, with names, dates of birth and email addresses but no passwords.
- ApplyNow reported on 9 September. Its customers followed with their own notices: Yoshinoya and Hanamaru (5,366 applicants and 418 staff), Izutsu Maisen (no number) and six city governments that used it for staff recruitment exams (about 3,000 records, ASCII.jp).
- Nichirei, attacked on 13 July, reported 53,866 records of its own; Kyusai then reported 484 customers whose data sat at Nichirei Logistics Kyushu, its warehousing contractor.
- Platforms: the Fines booking system (1,536,322 records), the Amadeus platform behind LEGOLAND Japan Hotel's bookings, Smaregi EC, and Weblife's OEM partner.
- IDC Frontier: ransomware caused an outage of IDCF Cloud that affected 495 companies and local governments. On 9 October, after this review's window, JR East, View Card and JR Kyushu said member email addresses held by mail services on the platform may have been seen (our analysis).
- Benefit One: no attacker. A program error, known internally since October 2025, put other client organisations' staff into survey downloads.
Editorial assessment. Under Japan's personal information law (APPI), a business that hands personal data to a contractor must supervise how it is handled (Article 25). The duty to explain a breach to customers stays with the business, even when the attack hit someone else's system. Keep an inventory of who holds your customers', applicants' and staff data, and agree in the contract how fast they must tell you.
4. A valid account did the damage
- Kindal: a phished staff account with no two-step login was used to export customer data twice; 136,464 people.
- Fancrew, a mystery-shopping service: 5,060,270 login attempts with leaked credentials on 20–24 August got into 59,389 accounts; points were exchanged in two cases.
- Rakuten Drive: stolen admin credentials gave access from 29 January to 17 September; files of 15,382 accounts (our analysis).
- Staff and developer access: Mitsui Fudosan (credentials misused to view group systems), Halmek Holdings (an admin panel entered with a stolen ID and password), Innovation (a leaked token opened a development environment holding personal data), IEEJ (six phished Microsoft 365 accounts; 13 passports confirmed leaked) and Abahouse (an unauthorised login to an internal system, then a program run against the member and order database).
- Mail accounts: 12 notices of mail accounts or sending keys misused for spam or impersonation, including three from Nihon University, Rikkyo University, the Japan Science and Technology Agency, PC Depot (about 1,800 suspicious emails) and Nikkei (about 9,000 impersonation emails, our analysis).
Editorial assessment. None of these needed malware on the victim's computers. Detection has to come from identity and data-access logs: an admin account reading or exporting far more than usual, a login from a new place followed by a bulk export, a burst of failed logins across many customer accounts.
5. Ransomware and malware
Ten notices put personal data at risk: Daiichikosho (through a contractor's device), Yellow Hat (a malicious program on its work-booking system, up to 1,801,499 people), Osaka Metropolitan University (our analysis), Hands Holdings, Musashino University, REXT Holdings (part of the data posted online on 11 September), Five Foxes, Washington Hotel, Meitetsu Kyosho (point-card members, including passwords) and a system-development company whose dormant server held personal data.
Eight stated no personal-data loss, or none yet: Keio (group companies' sales systems), IDC Frontier, Saga University (an office NAS), T&K TOKA, Tottori Prefecture's radiation-monitoring system, Ikegami Tsushinki (reported by an outside party), Marutaka Kogyo (through a VPN device) and CEC, whose final report found no leak.
Editorial assessment. JPCERT/CC treats ransomware as a separate, steady threat, and the notices agree: it accounts for 18 of 153, while the largest leaks came through apps, analytics tools and suppliers. IDC Frontier shows the other risk. When a cloud provider is hit, its customers lose service even if their own data is not taken. Our IDC Frontier analysis covers what customers, and anyone running VMware ESXi, should check.
6. The data nobody deleted
Much of what leaked belonged to people who no longer had a reason to be in the database:
- Former applicants at a former supplier. Yoshinoya and Hanamaru had ended their contract with ApplyNow. Applicant data from April 2022 to June 2024 was still there.
- Former staff. About 70,000 of Dai-ichi Life's 120,000 are people who had left. Nichirei's records include staff who left from 2021 onwards.
- Withdrawn members. LEAN BODY's 440,000 accounts and the Daiki Suisan app's 174,933 people both include members who had left. Times Car kept withdrawn members' licence images for seven years (our analysis).
- Old transactions. ePlus refund records went back to June 2022, with bank details. Rakuten Books Network's 33,333 shipping records from 2022 and 2023 sat on PCs that were compromised.
- A dormant server. A system-development company's unused server, still holding personal data, was hit by ransomware.
Editorial assessment. APPI asks businesses to try to delete personal data without delay once it is no longer needed (Article 22), and JPCERT/CC lists the same point as a countermeasure. A record that has been deleted cannot leak. Retention rules need an owner, a deletion job, and a check that suppliers delete too when a contract ends.
7. Payment pages and lotteries: changing the page, not reading the database
- Card skimming. Mushi-taiji.com (15 people, 6 cards), PhotoGoods (card number, expiry date and security code taken between 6 August and 11 September; an outside party raised the alarm) and the Dozle store, whose shoppers were sent to a fake page that asked for card details. Beer no Engawa said 9 cards may have leaked.
- Tampered lotteries. Tsuburaya Productions (15 September), ULTRA MART (1 October) and mogily (2 October) each reported that ticket-lottery results were changed from "won" to "lost". JPCERT/CC's case B includes data rewritten through apps' management APIs; the three notices do not say how it was done.
Editorial assessment. These attacks change what the site does rather than read what it holds. Inventory and lock down the scripts on payment pages, watch them for changes, and log every change to lottery results and admin settings with who made it.
8. Tech-support scams
Four notices began with a fake security warning: a teacher in Naha, who noticed during an in-school training session; a facility worker in Ota City, whose PC held personal data; a student dormitory in Miyazaki Prefecture, where residents' data may have leaked; and a Sakai Holdings subsidiary, where about 4,000 files were deleted. The pattern is a pop-up, a phone number, and remote-access software installed at the caller's request.
9. Mistakes without an attacker
Seven listed notices involve no attacker. TOPPAN's 177,426 came from one drag-and-drop into the wrong ZIP file. Kyoto Sanga emailed a fan-club file of 15,612 members to a business partner. Benefit One's fault ran for over a year, most of it after the company knew. @cosme's sharing link was public for about 20 minutes. Kyoto Prefecture's KYO-iku tv made up to 1,338 users' names visible to others. Chikepla showed other users' details for two days, and the Digital Agency sent 150 people's details to another ministry because a procedure document was ambiguous. These are the cheapest incidents to prevent, and they sit in the same lists as the attacks.
10. Found late, or by someone else
- Months, not days. Rakuten Drive's admin access ran for nearly eight months. Rakuten Books Network's compromised PCs were detected on 5 April and disclosed on 24 August. H.I.S.'s Thai subsidiary saw an alert in December 2025 and published its notice on 7 October (our analysis). White Essence found tampering on 5 August and stopped its systems on 12 August; its notice came on 15 September.
- Weeks. The last access to Lawson ID was on 14 September; Lawson found out on 7 October, 23 days later.
- Someone else noticed. PhotoGoods and Ikegami Tsushinki were told by outside parties, a Chiba Prefecture site by the prefectural police, Tokyo Metro by a fault in its mail delivery service, and Abahouse by customers who received refund emails quoting their real orders. Moonstar found phishing in its name already reaching customers.
- The exceptions. Sammy Networks' weekly access-load monitoring caught its abnormal requests, and Fines detected its anomaly on 22 September, three days before its notice.
Editorial assessment. In many of the cases that describe discovery, the organisation's own security monitoring was not what found the problem. Customer reports of convincing emails that quote real orders are an incident signal; the support team that receives them needs a direct route to security.
Small numbers, heavy data
| Data | Where it appeared in the 60 days |
|---|---|
| National ID and pension numbers | ApplyNow Sign (My Number, basic pension number) |
| Identity documents | Times Car (licence images, about 1.6 million), JAEA (ID documents of 175 people, our analysis), H.I.S. (up to 627 passports), IEEJ (13 passports), Lashinbang (document type and number), Nippon Rent-a-Car (licence numbers) |
| Payment cards | PhotoGoods (number, expiry date and security code), Mushi-taiji.com, Beer no Engawa, Lawson (part of the card number for 26 pre-orders) |
| Bank accounts | ePlus (751 people), Lashinbang (buyback payouts), ApplyNow Sign |
| Passwords | Meitetsu Kyosho (point-card members), a civil-engineering information site |
| Health, body and beauty | Unni (consultation history), Shueisha (height, skin type, marital status, children) |
| Voice recordings | Rohto (customer call recordings) |
| Employment | Nichirei (salary, residence status), Dai-ichi Life (position, manager) |
| Real bookings and orders, usable as lures | LEGOLAND Japan Hotel, Ainokaze Toyama Railway, Seibu's restaurant train, Sagawa Express, Abahouse |
Editorial assessment. Rank incidents by the data they expose, not only by count. A few hundred bank account numbers or card security codes can cause more harm than tens of thousands of email addresses.
The first number moves
At least these figures changed after the first notice:
- KDDI: 12,233,087 people, corrected to 12,231,954.
- 2Rinkan Yellow Hat: up to 3,455,754, narrowed to 3,179,454.
- OZmall: up to 447,610, narrowed to 442,779.
- Academico Navi: up to about 170,000, confirmed at 165,587.
- Aflac: rose by about 20,000 to about 4.4 million.
- E-Store: an intrusion first described as about two hours turned out to have lasted from 21 May to 1 August (act1).
- Charm: about 230,000 at risk, with 239 confirmed unauthorised logins.
- Nippon Rent-a-Car: 41 people, then 55 more from a second intrusion found while the first was investigated.
- Fuso Dentsu: a notice on 13 August, then up to 26,489 people on 29 September.
- IEEJ: traces of 2,798 downloaded files on 11 September; 13 passports confirmed leaked on 2 October.
- Moonstar: suspected unauthorised access on 26 March; a possible leak of online-store customers' details, with phishing already sent, on 2 October.
A first notice is an estimate. Labelling it "up to" or "possible" makes the later correction easier to explain.
Every notice, 10 August to 8 October
The tables list each notice once, under the date it was published; follow-ups are marked. Organisation names link to the organisation's notice where we found one, otherwise to the report we relied on. "Figure given" is in the notice's own unit. The cause is what the notice says; "supplier" marks a notice about a system the organisation did not run.
Attacks with personal data at risk: August (25)
| Notice | Organisation | Figure given | Cause | What the notice says |
|---|---|---|---|---|
| 13 Aug | Charm (online pet store) | about 230,000 (possible); 239 confirmed unauthorised logins | Not disclosed | Unauthorised access to the online store |
| 13 Aug | Fuso Dentsu | 26,489 (possible) | Not disclosed | Cloud storage shared with outside parties was accessed |
| 17 Aug | A lodging facility on Awaji Island | not stated | Not disclosed | Customer data may have leaked |
| 17 Aug | Unko Museum | not stated | Not disclosed | Site defaced; personal data may have leaked |
| 18 Aug | Nice Corporation | not stated | Account | Mail account accessed; personal data may have leaked |
| 18 Aug | VOISING | up to about 170,000 | Software flaw | Known BI-tool vulnerability not patched; about 50,000 records may have been posted |
| 19 Aug | Ichimasa Kamaboko | not stated | Account | Staff mail account accessed; data may have leaked |
| 19 Aug | Innovation Inc. | not stated | Account | Leaked token opened a development environment holding personal data |
| 19 Aug | Sakura Internet | 1,360,563 accounts (possible) | Not disclosed | Rental-server customer environments and the sales-management system; final report 10 Sep. Our analysis |
| 20 Aug | A greenhouse maker | under investigation | Not disclosed | Data may have leaked; scope under investigation |
| 21 Aug | A craft-beer online shop | not stated | Not disclosed | Customer data may have leaked |
| 21 Aug | Central Consultant | not stated | Not disclosed | Corporate site; enquiries may have leaked |
| 24 Aug | A civil-engineering information site | not stated | Not disclosed | Member data, including passwords, may have leaked |
| 24 Aug | A system-development company | not stated | Ransomware or malware | Ransomware on a dormant server holding personal data |
| 24 Aug | Rakuten Books Network | 33,333 orders, 2,101 partner contacts, 339 staff | Not disclosed | PCs compromised (detected 5 April) held Rakuten Books shipping data from 2022–2023 |
| 25 Aug | Japan Association for the 2025 World Exposition | not stated | Not disclosed | Performers’ personal data may have leaked |
| 26 Aug | ANA Trading (e-gift service) | not stated | Not disclosed | Gift system compromised; gifts fraudulently exchanged |
| 28 Aug | Ambition DX Holdings (follow-up) | not stated | Not disclosed | Internal file server; leak of some data confirmed (third notice) |
| 28 Aug | Coop Yamaguchi (LINE mini app) | 217,295 | Not disclosed | Database contents deleted; e-money card numbers and PINs for 143,126 were stored |
| 28 Aug | Hands Holdings | not stated | Ransomware or malware | Ransomware on internal systems; personal data may have leaked |
| 28 Aug | Kindal online store (KIND) | 136,464 people | Account | Phished staff account without two-step login; customer data exported twice |
| 28 Aug | Yellow Hat (work-booking system) | up to 1,801,499 people | Ransomware or malware | Malicious program on the web booking system; name, phone, email, member number |
| 28 Aug | Zurich Insurance (Z-Dash) | up to 1,668 | Software flaw | Dashcam upload system; name, email and case number |
| 29 Aug | Meitetsu Kyosho (MKP point card) (follow-up) | not disclosed | Ransomware or malware | Ransomware; card members’ data, including passwords, may have leaked |
| 31 Aug | Mushi-taiji.com (pest-control shop) | up to 15 people, 6 cards | Not disclosed | Card-skimming code on the payment page |
Attacks with personal data at risk: September (44)
| Notice | Organisation | Figure given | Cause | What the notice says |
|---|---|---|---|---|
| 1 Sep | Mitsui Fudosan | up to 55,000 items | Account | Credentials misused to view group systems |
| 2 Sep | Corona Corporation | not stated | Not disclosed | Customer data in a cloud service may have leaked |
| 3 Sep | REXT Holdings | not stated | Ransomware or malware | Ransomware; part of the data was posted online (11 Sep) |
| 4 Sep | Weblife (OEM website builder) | up to 7,425 | Software flaw · supplier | Access-control flaw at an OEM partner’s customer system, 14–17 Aug |
| 7 Sep | Mandarake | not stated | Not disclosed | Server intrusion; data may have leaked |
| 7 Sep | Musashino University (follow-up) | not stated | Ransomware or malware | Ransomware; several files leaked, some with personal data |
| 7 Sep | Unni (Healingpaper) | 219,665 in total, about 48,000 in Japan | App or API abuse | An API returning consultation history was abused |
| 9 Sep | ApplyNow (Kichiri Holdings) | no total given | Software flaw · supplier | Data-analysis tool vulnerability, 9 Aug – 7 Sep; applicants’ My Number, pension and bank details |
| 9 Sep | Fancrew (mystery shopping) | 59,389 accounts entered | Account | Credential stuffing: 5,060,270 login attempts on 20–24 Aug |
| 11 Sep | Digital Agency (GSS) | about 246,000 (possible) | Software flaw | VPN vulnerability; a maintenance account opened large numbers of files |
| 11 Sep | Institute of Energy Economics, Japan | 13 passports confirmed | Account | Phishing took over six Microsoft 365 accounts; 2,798 files downloaded |
| 11 Sep | Institute of Science Tokyo | not stated | Not disclosed | Students’ and staff data on an information platform may have leaked |
| 14 Sep | Miyazaki Prefecture (student dormitory) | not stated | Support scam | Tech-support scam; residents’ data may have leaked |
| 15 Sep | LEAN BODY | about 440,000 accounts, including withdrawn members | Software flaw | Vulnerability in Metabase, an analytics tool; access from 11 Aug |
| 15 Sep | Murauchi.com | 7,716,811 records | Software flaw | Web-system vulnerability, then other systems; data taken in a July intrusion. Our analysis |
| 15 Sep | Rohto Pharmaceutical | under investigation | Not disclosed | Mail-order systems; customer call recordings may have been taken |
| 15 Sep | White Essence (dental clinics) | under investigation | Not disclosed | Booking site and core system tampered with; found 5 Aug |
| 16 Sep | Gyazo (Helpfeel) | about 23.62M user records | Software flaw | Upload-server vulnerability let an attacker run commands; database contents taken |
| mid-Sep | Ainokaze Toyama Railway | 1,409 | Not disclosed | Seat-booking system for a tourist train, accessed 2–8 Sep |
| 18 Sep | Management Service Center | not stated | Not disclosed | Site defaced and admin rights taken; the site held personal data |
| 18 Sep | Nichirei | 53,866 | Not disclosed | July cyberattack; staff, families, applicants, partners and delivery customers |
| 24 Sep | Seibu (“52 Seats of Happiness” restaurant train) | not stated | Not disclosed | Part of the booking data leaked from the reservation site |
| 25 Sep | ApplyNow customers: Izutsu Maisen | not stated | Software flaw · supplier | Applicant data at ApplyNow, its former recruitment contractor |
| 25 Sep | Fines (booking system) | 1,536,322 records | Not disclosed · supplier | A reservation system provided to shops; anomaly detected 22 Sep |
| 25 Sep | Five Foxes | not stated | Ransomware or malware | Ransomware; VIP and GOLD customers’ data may have leaked |
| 25 Sep | Halmek Holdings (HALMEK up) | not stated | Account | Admin panel of a women’s information site entered with stolen ID and password |
| 25 Sep | Kyusai | 484 customers | Not disclosed · supplier | Breach at Nichirei Logistics Kyushu, its warehousing contractor |
| 25 Sep | LEGOLAND Japan Hotel | 1,557 bookings | Not disclosed · supplier | Breach at the Amadeus booking platform behind its site |
| 25 Sep | PhotoGoods (Daiko Printing) | not yet stated | Software flaw | Card-skimming code from 6 Aug to 11 Sep: number, expiry, security code |
| 25 Sep | Tokyo Metro (Metpo) | about 59,000 email addresses (possible) | Not disclosed | Found through a fault in a mail delivery service on 20 Sep |
| 25 Sep | Washington Hotel | not stated | Ransomware or malware | Ransomware; the threatened dark-web publication not seen |
| 26 Sep | Nippon Rent-a-Car app | 41, then 55 | App or API abuse | Two intrusions into the app; licence numbers for members who registered them |
| 27 Sep | OZmall (Starts Publishing) | up to 442,779 email addresses | Not disclosed | Mass access from overseas on 26 Sep |
| 28 Sep | Shueisha (HAPPY PLUS COMMUNITY) | 2,835 bloggers, plus a 10,780-entry partner list | Software flaw | CMS misconfiguration led to stolen API credentials and a new privileged account |
| 28 Sep | Times Car | about 6.6M accounts; ID documents for about 1.6M | Not disclosed | Member data taken from the web system, including licence images. Our analysis |
| 29 Sep | ePlus (Smart Ticket refunds) | 1,463, of which 751 include bank details | Not disclosed | Refund system accessed 11–12 Sep |
| 29 Sep | Montbell global site | up to 15 | Not disclosed | Personal data may have been taken |
| 29 Sep | Post Office app (Japan Post) | 19 people, 69 items | Not disclosed | Addresses, address books and shipping labels |
| 29 Sep | Seicomart app | 572,022 people | App or API abuse | Member server reached through the app server; data viewed |
| 29 Sep | Smaregi EC (Repeat and B2B) | not stated | Not disclosed · supplier | E-commerce platform for shops; some personal data may have been viewed or taken |
| 29 Sep | Yamato Transport (Kuroneko payment service) | not stated | Not disclosed | Payment-on-delivery service accessed 28 Sep and stopped. Our analysis |
| 30 Sep | ApplyNow customers: Yoshinoya and Hanamaru | 5,366 applicants and 418 staff | Software flaw · supplier | Data from April 2022 to June 2024 was still held after the contract ended |
| 30 Sep | G Points | up to about 70,000 member identifiers | Not disclosed | No names, addresses, phone numbers or email; service stopped. Our analysis |
| 30 Sep | Sagawa Express (parcel enquiries) | under investigation (about 100 days of data) | App or API abuse | Parcel-tracking enquiry service abused. Our analysis |
Attacks with personal data at risk: 1–8 October (23)
| Notice | Organisation | Figure given | Cause | What the notice says |
|---|---|---|---|---|
| 1 Oct | JAEA | 175 people (367 of 2,419 downloaded files) | Not disclosed | Contracted cloud service for research-facility users; ID documents. Our analysis |
| 1 Oct | Lashinbang (used anime goods) | not stated | Not disclosed | Buyback data: ID-document type and number, bank accounts |
| 2 Oct | Dai-ichi Life Group and Dai-ichi Life | about 120,000, about 70,000 of them former staff | Not disclosed | HR system shared by two group companies, accessed 24 Sep |
| 2 Oct | Moonstar (follow-up) | not stated | Not disclosed | Online-store customers’ data may have been taken; phishing already sent |
| 2 Oct | Sammy Networks (777CON-PASS) | under investigation | App or API abuse | Requests for user and hall data run by a third party from 25 Sep |
| 3 Oct | Abahouse International | not stated | Account | Login to an internal system, then a program run against the member and order database |
| 3 Oct | StudySapuri (Recruit) | 3,687 email addresses identified as registered | App or API abuse | A specification flaw in a function let a third party confirm registrations |
| 5 Oct | Beer no Engawa (online shop) | 9 cards (possible) | Not disclosed | Card data may have leaked from the shop |
| 5 Oct | Daiwa Securities | about 110,000 customers (about 220,000 records) | Not disclosed · supplier | Servers of Scala Communications, which runs its enquiry service. Our analysis |
| 5 Oct | Dozle store | not stated | Not disclosed | Shoppers redirected to a fake page asking for card details |
| 5 Oct | infoQ (GMO Research & AI) | up to 948,498 records | Software flaw | Software vulnerability; 611 accounts’ points exchanged for about ¥2.87M. Our analysis |
| 5 Oct | Osaka Metropolitan University | at least 130,000 held; leak under investigation | Ransomware or malware | Ransomware on the virtualisation platform; about 500 servers stopped. Our analysis |
| 5 Oct | Yakiniku King app (Monogatari) | 10,788,963 records | Not disclosed | Membership-management system; method not disclosed. Our analysis |
| 6 Oct | Asahi Kasei Therapeutics (Pharma DIGITAL) | about 514,000 healthcare professionals and 700 staff | Not disclosed · supplier | Member database at its site operator, 医薬情報ネット (PIN). Our analysis |
| 6 Oct | Citizen Watch | about 100,000 (possible) | Not disclosed · supplier | Enquiry forms at Scala Communications, the same supplier as Daiwa |
| 6 Oct | Daiki Suisan app (sushi chain) | up to 174,933 people, including withdrawn members | Not disclosed | App compromised; found 15 Sep |
| 6 Oct | MrMax (app and online store) | up to 1,735,154 members | Software flaw | A software function misused to enter the server; ID, name, email, phone |
| 6 Oct | nimoca | 521 | App or API abuse | Usage-history web service attacked; card number, date of birth, email |
| 6 Oct | Rakuten Drive | 15,382 accounts’ files, plus 1,000 accounts’ details | Account | Stolen admin credentials; access from 29 Jan to 17 Sep. Our analysis |
| 7 Oct | Chiba Bank subsidiary | not stated | Not disclosed | Subsidiary site compromised; personal data may have leaked |
| 7 Oct | H.I.S. (Thai subsidiary) | up to 627 passports | Not disclosed | File server alert in Dec 2025; 300 days to the public notice. Our analysis |
| 8 Oct | Daiichikosho (Big Echo and others) | about 8.72M (possible) | Ransomware or malware · supplier | Malware on a device used by a contractor’s employee; no passwords |
| 8 Oct | Lawson ID | 2,155,345, plus 26 app pre-orders | App or API abuse | The app’s mechanism for showing users their own data was misused. Our analysis |
Mistakes without an attacker (7)
Only mistakes affecting 1,000 or more people, or covered in our earlier reviews, are listed.
| Notice | Organisation | Figure given | Cause | What the notice says |
|---|---|---|---|---|
| 10 Aug | Digital Agency | 150 people | Mistake | Details sent to another ministry; an ambiguous procedure document |
| 31 Aug | Kyoto Prefecture (KYO-iku tv) | up to 1,338 | Mistake | A system flaw made users’ names visible to others |
| early Sep | Kyoto Sanga F.C. | 15,612 fan-club members | Mistake | A file emailed to a business partner by mistake |
| 16 Sep | @cosme (istyle) | 10,997 | Mistake | A file-sharing link was public for about 20 minutes |
| 29 Sep | TOPPAN (for Sompo Japan) | 177,426 people | Mistake | A drag-and-drop mistake put one insurer’s file in a ZIP sent to another |
| 30 Sep | Benefit One | 13,460 people at 2,322 client organisations | Mistake | A program error put other clients’ staff into downloads; known since Oct 2025 |
| 1 Oct | Chikepla | up to 107 | Mistake | Other users’ details shown on screen, 28–29 Sep |
Other incidents, no personal-data loss stated (54)
| Notice | Organisation | Cause | What the notice says |
|---|---|---|---|
| 10 Aug | Saga Bank group company | Account | Mail server used to send spam |
| 10 Aug | Shimane Prefecture (joint research site) | Not disclosed | Site defaced to redirect visitors elsewhere |
| 10 Aug | Yonex | Not disclosed | Unauthorised access at an overseas subsidiary; impact under investigation |
| 12 Aug | Fukuchiyama industry support centre | Account | Mail account compromised and used for spam |
| 13 Aug | Marutaka Kogyo | Ransomware or malware | Ransomware, entered through a VPN device |
| 13 Aug | Tokai University (training facility site) | Not disclosed | Site defaced |
| 18 Aug | A water-server company | Not disclosed | A web system due to go live was attacked |
| 18 Aug | Japan Science and Technology Agency | Account | Several staff mail accounts accessed |
| 18 Aug | Naha City (school) | Support scam | Teacher fell for a tech-support scam |
| 24 Aug | An apparel company | Account | Access key for a mail-sending service misused |
| 25 Aug | Gakken Meds | Software flaw | Several admin sites accessed through a CMS vulnerability |
| 25 Aug | Japan Blind Football Association | Not disclosed | Site defaced to show a fake verification page |
| 26 Aug | NTT Smart Connect | Not disclosed | Rental-server facility compromised; service suspended |
| 27 Aug | An auto-parts maker | Not disclosed | Site defaced with a fake check asking visitors to run a command |
| 28 Aug | Nihon University (law faculty) | Account | Staff mail accounts used to send spam |
| 1 Sep | hololive trading-card game site | Software flaw | Traces of compromise found after a vulnerability was published |
| 2 Sep | Nissan Foundation | Software flaw | Site accessed through a vulnerability |
| 3 Sep | CEC (follow-up) | Ransomware or malware | Final report: ransomware in August, no data leaked |
| 3 Sep | Osaka City (nursery site) | Not disclosed | Site defaced; no personal-data leak |
| 4 Sep | Chiba Prefecture (biodiversity centre site) | Not disclosed | Site defaced |
| 4 Sep | Tottori Prefecture (radiation monitoring) | Ransomware or malware | Ransomware on part of the monitoring system |
| 7 Sep | JCV | Account | Help-desk mail account used for spam; mail was read |
| 9 Sep | Ota City (facility) | Support scam | Staff member fell for a tech-support scam; the PC held personal data |
| 9 Sep | Rikkyo University | Account | Student accounts used to send spam |
| 10 Sep | T&K TOKA (printing ink) | Ransomware or malware | Ransomware; some operations stopped |
| 11 Sep | Sakai Holdings subsidiary | Support scam | Tech-support scam; about 4,000 files deleted |
| 11 Sep | Tokyo Outer Ring Road project site | Not disclosed | Possible compromise; site taken offline |
| 14 Sep | Omachi City (digital archive) | Not disclosed | Site defaced to redirect to an online casino |
| 15 Sep | Tokyo pipe-works cooperative | Software flaw | Site defaced through a CMS vulnerability |
| 15 Sep | Tsuburaya Productions | Not disclosed | Purchase lottery tampered with: winners changed to losers |
| 16 Sep | CINRA JOB | Not disclosed | Unauthorised access to the job service |
| 17 Sep | A hotel operator | Account | Staff account compromised; impersonation emails sent |
| 17 Sep | Kumamoto Prefecture (job and relocation site) | Not disclosed | Site defaced to show fake security alerts |
| 18 Sep | Nihon University (science and engineering) | Account | Phished staff accounts sent suspicious mail |
| 24 Sep | Chiba Prefecture (wildlife survey page) | Not disclosed | Unauthorised access, found after a call from Chiba police |
| 24 Sep | Kaikura service site | Not disclosed | Several malicious programs found; moved to a clean environment |
| 24 Sep | paperlogic | Not disclosed | Unauthorised access; no traces of viewing or copying so far |
| 24 Sep | topia (virtual live app) | Not disclosed | Voice server accessed |
| 25 Sep | Kawasaki City facility site | Not disclosed | Unauthorised access found during a site update |
| 25 Sep | Nippon Trex | Not disclosed | Unauthorised access to information systems; some operations stopped |
| 26 Sep | Keio Corporation | Ransomware or malware | Ransomware hit group companies’ sales systems; no leak confirmed |
| 28 Sep | JA Enshu Yumesaki site | Not disclosed | Unauthorised access; site closed temporarily |
| 28 Sep | Japan Post (enquiry web service) | Not disclosed | Unauthorised access; service suspended |
| 28 Sep | Nihon University (five lecturers) | Account | Accounts used to send spam |
| 28 Sep | PC Depot | Account | Mail-domain credentials misused to send about 1,800 suspicious emails |
| 29 Sep | University of Tokyo (public health site) | Not disclosed | Malicious program planted on the website |
| 30 Sep | Saga University | Ransomware or malware | Ransomware on an office NAS |
| 1 Oct | ULTRA MART | Not disclosed | Ticket lottery tampered with: winners changed to losers |
| 2 Oct | mogily (digital ticket system) | Not disclosed | Lottery results tampered with: winners changed to losers |
| 4 Oct | Nikkei | Account | Staff Microsoft 365 account sent about 9,000 impersonation emails. Our analysis |
| 5 Oct | Benesse group company | Software flaw | Several sites entered through plugin vulnerabilities |
| 5 Oct | Higashi Sangyo | Software flaw | Corporate site entered with the wp2shell tool |
| 5 Oct | Ikegami Tsushinki | Ransomware or malware | Some server files encrypted; reported by an outside party |
| 8 Oct | IDC Frontier (IDCF Cloud) | Ransomware or malware · supplier | Ransomware caused a cloud outage affecting 495 companies and local governments. Our analysis |
The 12-month list: disclosures of 100,000 or more
A tier list of Japanese leak announcements circulated on social media at the end of September, sorting about fifty organisations by size; a revised version on 5 October grades 93 entries from SS to F. A similar Top 10 by security commentator yousukezan covers 29 September 2025 to 29 September 2026 (yousukezan on X). We do not reuse those rankings. We checked every disclosure of 100,000 or more against the organisation's notice, or reliable reporting where we found none, and added large cases they leave out.
Read the units before the ranking
| Wording in the notice | What it counts | Example |
|---|---|---|
| Records (レコード, 件) | Rows in a database, which can include duplicates | EPARK: about 33 million records, described by the company as a data count |
| Cumulative (延べ) | Every registration, so one person can appear several times | E-Store: up to 8,853,839, which may include several entries for one customer |
| Accounts | Logins, including anonymous or unfinished ones | Gyazo: about 23.62 million user records, about 18.01 million of them anonymous accounts with no email address |
| People (名, 人) | Unique individuals | KDDI: 12,231,954 people whose email addresses were created on the platform |
| Up to, possible (最大, 可能性, おそれ) | The ceiling of what could have been reached, not what was confirmed taken | Sakura Internet: 1,360,563 accounts possibly affected; the company says it has not confirmed that each was viewed |
One million or more
| Organisation | Reported figure | Announced | What the notices say |
|---|---|---|---|
| EPARK Relax & Esthe (PeakManager) | about 33M records | 31 Jul 2026 | Unauthorised access to part of the database of a booking and customer-management platform used by salons; customer data in it was deleted |
| Gyazo (Helpfeel) | about 23.62M user records, plus about 490M image metadata records | 16 Sep 2026 | A vulnerability in the image upload server let an attacker run commands; database contents were taken |
| KDDI mail platform for ISPs | 12,231,954 people (email addresses); about 7.62M passwords | 23 Jun 2026 | A vulnerability in third-party software inside the platform; mail services of six ISPs affected |
| Kyushu Electric Power T&D | about 10.9M (cumulative) | 8 Jun 2026 | A backup storage device holding customer data went missing |
| Yakiniku King app (Monogatari Corporation) | 10,788,963 records, out of 10,808,784 registrations | 5 Oct 2026 | Unauthorised access to the app's membership-management system; the method is not disclosed. See our full analysis |
| E-Store (Shop Serve) | up to 8,853,839 (cumulative) | 1–2 Aug 2026 | Unauthorised access to a platform that hosts other companies' online shops, from 21 May to 1 August |
| Daiichikosho (Big Echo and others) | about 8.72M (possible) | 8 Oct 2026 | Malware on a device used by a contractor's employee; names, dates of birth and email addresses, no passwords |
| Murauchi.com | 7,716,811 records | 15 Sep 2026 | A vulnerability in part of a web system, then several other systems; forensics confirmed customer data was taken in a July intrusion. See our full analysis |
| Times Car | about 6.6M accounts; ID documents for about 1.6M | 28 Sep 2026 | See our full analysis |
| Aflac Life Insurance | about 4.4M customers and about 40,000 agencies | Jul 2026 | A large volume of data was queried in a short time and noticed through high CPU load; about 220,000 customers' bank account details were included |
| 2Rinkan Yellow Hat | 3,179,454 people | 19 Jun 2026 (final) | Intrusion into a member server; the first estimate was up to 3,455,754 |
| Universal Music (online stores) | 3,105,585 records | 18 May 2026 | Investigation began in October 2025 after social media posts suggested a leak |
| Lawson ID | 2,155,345 records, plus 26 app pre-orders | 8 Oct 2026 | The app's mechanism for showing users their own data was misused. See our full analysis |
| Yellow Hat work-booking system | up to 1,801,499 people | 28 Aug 2026 | A malicious program on the web booking system; name, phone, email and member number. A separate incident from 2Rinkan |
| MrMax (app and online store) | up to 1,735,154 members | 6 Oct 2026 | A software function was misused to enter the server; member ID, name, email and phone |
| Fines (booking system) | 1,536,322 records | 25 Sep 2026 | A reservation system provided to shops; an anomaly was detected on 22 September |
| Sakura Internet | 1,360,563 accounts (possible) | 19 Aug and 10 Sep 2026 | A sales-management system holding member details. See our full analysis |
From 100,000 to one million
| Organisation | Reported figure | Announced | What the notices say |
|---|---|---|---|
| infoQ (GMO Research & AI) | up to 948,498 records, every one the company held | 5 Oct 2026 | A vulnerability in software used on the survey site; 611 accounts had points turned into Amazon gift codes. See our full analysis |
| Seicomart app | 572,022 people | 30 Sep 2026 (third notice) | Unauthorised access through the app server; member information was viewed |
| Asahi Kasei Therapeutics (Pharma DIGITAL) | about 514,000 healthcare professionals and about 700 staff | 6 Oct 2026 | The member database at 医薬情報ネット (PIN), the site's operator. See our full analysis |
| OZmall | up to 447,610 email addresses, later narrowed to 442,779 | 27 Sep 2026 | Mass access from overseas detected on 26 September |
| LEAN BODY | about 440,000 accounts, including withdrawn members | 15 Sep 2026 | A vulnerability in Metabase, an internal analytics tool; access from 11 August |
| Digital Agency (GSS) | about 246,000 | 11 Sep 2026 | VPN vulnerability; a maintenance account was used to open large numbers of files. Government staff and contractors only, no members of the public |
| Charm (online pet store) | about 230,000 (possible) | 13 Aug 2026 | Unauthorised logins confirmed for 239 customers by the third notice |
| CAMPFIRE | 225,846 | 2 Jun 2026 (final) | GitHub credentials, uploaded by mistake to an employee's personal development server, opened the way into the company's cloud environment |
| Coop Yamaguchi (LINE mini app) | 217,295 | 28 Aug and 7 Sep 2026 | For 143,126 e-money cardholders, card numbers and PINs were in the database; leakage not confirmed |
| TOPPAN (for Sompo Japan) | 177,426 | 29 Sep 2026 | A drag-and-drop mistake put one insurer's file inside a ZIP sent to another insurer |
| Daiki Suisan app (sushi chain) | up to 174,933 people, including withdrawn members | 6 Oct 2026 | The app system was compromised; found on 15 September. Name, date of birth, sex, address, phone and email |
| VOISING | up to about 170,000 | 18 Aug 2026 | A known vulnerability in a BI tool was not patched in time; about 50,000 records may later have been made public |
| Academico Navi (Kaga Solnet) | 165,587 (first estimate about 170,000) | 1 Jul 2026 | A site that sells PCs to students on behalf of universities |
| Komatsu | 139,302 users | 16 Jun 2026 | A settings error let users see other users' details, from around 2021 |
| Kindal online store (KIND) | 136,464 | 28 Aug 2026 | A phished staff account without two-step login was used to export customer data in bulk |
| Osaka Metropolitan University | at least 130,000 students and graduates, held on the systems; whether data left is under investigation | 5 Oct 2026 (press conference) | Ransomware on the virtualisation platform; about 500 servers stopped and many backups encrypted. See our full analysis |
| Unimat Life | 126,947 | Jul 2026 | A customer list was left inside an Excel order form emailed to business partners |
| Dai-ichi Life Group and Dai-ichi Life | about 120,000 current and former staff | 2 Oct 2026 | An HR system shared by the two companies, accessed on 24 September. About 70,000 of the people had left; office-staff records go back to 1967. No access to customer data found |
| Daiwa Securities | about 110,000 customers; about 220,000 records in total | 5 Oct 2026 | Servers of Scala Communications, the supplier behind Daiwa's internet inquiry service. See our full analysis |
| COTA | 109,147 (cumulative) | 2026 (detected 27 Mar) | Ransomware; first noticed as malfunctioning office PCs |
| Citizen Watch | about 100,000 (possible) | 6 Oct 2026 | Enquiry-form data at Scala Communications, the same supplier as Daiwa Securities, accessed 2–3 October |
Rank by harm, not count
The 5 October revision of the tier list moved 12 grades, nine up and three down, for reasons about the data rather than the count: card details typed at checkout, bank accounts, allergy information, licence numbers, address books and shipping labels, and My Numbers moved entries up; a recipient's confirmed deletion, or data visible only to other registered users, moved them down. That is the argument of this review. For your own triage, keep the questions apart:
| Question | Lower concern | Higher concern |
|---|---|---|
| Can the person change it? | Password, email address, card number (the card can be reissued) | Licence or passport number, face, date of birth, My Number, health data |
| Can it be used for fraud on its own? | Name and email address | Bank account with name, card details typed at checkout, identity document numbers or images |
| Was it confirmed taken? | Reachable, or "possible" | Confirmed exfiltration, or already used in phishing |
| Who has it now? | A known recipient who confirmed deletion | An unknown attacker, or anyone with a public link |
Which teams should act
| Team | What to check after these 60 days |
|---|---|
| IT operations and app owners | Run the two-account test on every customer app and API: can customer A read customer B's record? Add per-function rate limits, expiring least-privilege tokens and a way to revoke keys fast. Take analytics and BI tools, admin panels and staff systems off the internet; patch Metabase against CVE-2026-72898. |
| Third-party risk | List the platforms that hold customer, applicant, staff or booking data for you: enquiry forms, recruitment, HR, benefits, logistics, reservations, e-commerce, cloud hosting. For each, ask what it holds now, including from ended contracts, how fast it must report an incident, and get evidence of deletion. |
| SIEM / SOC | Search web, WAF and API logs for JPCERT/CC's addresses and User-Agents. Alert on one caller reading many different customer records, on bulk exports by staff and admin accounts, and on credential-stuffing bursts. Treat customer reports of phishing that quotes real orders as an alert. |
| EDR | Inventory servers running Metabase and other analytics tools and check what reaches them from the internet. Keep ransomware detection on office PCs, NAS and VPN devices, and look for credentials and tokens left on developer machines. |
| Email security | Expect lures that name breached brands and quote real bookings, orders and deliveries. Check staff mail accounts for misuse as spam relays, and require phishing-resistant sign-in for admin and support staff. |
| Legal / privacy | Decide who notifies people when a supplier is breached, and how fast. Make deletion at contract end and data-retention schedules enforceable. Publish what is known, label estimates, and plan for revisions. A leak caused by unauthorised access is reportable to the PPC whatever the number of people affected. |
Hunting: JPCERT/CC's indicators and the patterns behind them
Published indicators. JPCERT/CC's alert of 8 October is the only source we found in these 60 days that published attacker infrastructure. It warns that the addresses may now be in legitimate use, so a match is a lead to investigate, not proof. It does not tie them to any named organisation.
| Indicator (defanged) | Type | JPCERT/CC case | When used | Context |
|---|---|---|---|---|
| 3.112.252[.]14 | IPv4 | B, API abuse | Around September 2026 | Suspicious source address |
| 54.95.112[.]6 | IPv4 | B, API abuse | Around September 2026 | Suspicious source address |
| 69.10.51[.]162 | IPv4 | B, API abuse | Around September 2026 | Suspicious source address |
| 172.86.91[.]7 | IPv4 | B, API abuse | Around September 2026 | Suspicious source address |
| 210.149.87[.]120 | IPv4 | B, API abuse | Around September 2026 | Suspicious source address |
| 213.163.202[.]171 | IPv4 | C, Metabase | Early August to early September 2026 | Suspicious source address |
| 221.216.140[.]49 | IPv4 | C, Metabase | Early August to early September 2026 | Suspicious source address |
| 221.216.140[.]129 | IPv4 | C, Metabase | Early August to early September 2026 | Suspicious source address |
curl/7.88.1 |
User-Agent | B | Example | A common tool string; weak on its own |
python-requests/2.34.2 |
User-Agent | B | Example | A common tool string; weak on its own |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 |
User-Agent | B | Example | Note the short "Chrome/126.0"; real Chrome sends "Chrome/126.0.0.0" |
python-requests/2.33.1 |
User-Agent | C | Example | A common tool string; weak on its own |
Metabase-GHSA-vwf4/2.0 |
User-Agent | C | Example | Distinctive |
All queries below are illustrative and were not run against live data. Table and field names were checked against vendor documentation on 8 October 2026. They start on 1 August 2026 to cover both JPCERT/CC windows; extend the range if your logs go further back.
1. Microsoft Sentinel: the published addresses and User-Agents in WAF, proxy and server telemetry. CommonSecurityLog holds CEF events from WAFs, load balancers and proxies (SourceIP, RequestClientApplication for the User-Agent, RequestURL). DeviceNetworkEvents covers servers with Defender for Endpoint, such as a self-hosted Metabase. The common tool User-Agents only add weight to an address match.
// Illustrative; not run against live data. Microsoft Sentinel (Log Analytics workspace).
// Indicators from JPCERT/CC alert JPCERT-AT-2026-0030 (8 Oct 2026). Case B: app and API abuse, addresses used around September.
// Case C: Metabase SQL injection (CVE-2026-72898), addresses used early August to early September.
// JPCERT/CC notes the addresses may now be in legitimate use. A match is a lead to investigate, not proof of compromise.
// CommonSecurityLog: web application firewalls, load balancers and proxies sending CEF. DeviceNetworkEvents: servers with Defender for Endpoint.
let Since = datetime(2026-08-01T00:00:00Z);
let CaseB_IP = dynamic(["3.112.252.14", "54.95.112.6", "69.10.51.162", "172.86.91.7", "210.149.87.120"]);
let CaseC_IP = dynamic(["213.163.202.171", "221.216.140.49", "221.216.140.129"]);
// Distinctive User-Agents are searched on their own; common tool strings only add weight to an address match.
let DistinctUA = dynamic(["Metabase-GHSA-vwf4/2.0", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36"]);
let CommonUA = dynamic(["curl/7.88.1", "python-requests/2.34.2", "python-requests/2.33.1"]);
union isfuzzy=true
(CommonSecurityLog
| where TimeGenerated >= Since
| where SourceIP in (CaseB_IP) or SourceIP in (CaseC_IP) or RequestClientApplication in (DistinctUA)
| project TimeGenerated, Telemetry = strcat(DeviceVendor, " ", DeviceProduct), SourceIP, UserAgent = RequestClientApplication,
Target = coalesce(RequestURL, DestinationHostName), Action = DeviceAction),
(DeviceNetworkEvents
| where TimeGenerated >= Since
| where ActionType == "InboundConnectionAccepted"
| where RemoteIP in (CaseB_IP) or RemoteIP in (CaseC_IP)
| project TimeGenerated, Telemetry = "Defender for Endpoint", SourceIP = RemoteIP, UserAgent = "",
Target = strcat(DeviceName, ":", tostring(LocalPort)), Action = ActionType)
| extend Case = case(SourceIP in (CaseC_IP) or UserAgent == "Metabase-GHSA-vwf4/2.0", "C (Metabase)",
SourceIP in (CaseB_IP), "B (app or API)", "User-Agent only")
| extend ToolUA = UserAgent in (CommonUA)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Events = count(),
Targets = make_set(Target, 20), UserAgents = make_set(UserAgent, 5), Actions = make_set(Action, 5), WithToolUA = countif(ToolUA)
by Case, Telemetry, SourceIP
| order by Case asc, Events desc
| take 200
2. Splunk: the same search in web or WAF logs with CIM-style fields (src, http_user_agent, url, status, dest). Replace the index.
index="REPLACE_WITH_WEB_INDEX" earliest="08/01/2026:00:00:00" latest=now
(src IN ("3.112.252.14", "54.95.112.6", "69.10.51.162", "172.86.91.7", "210.149.87.120", "213.163.202.171", "221.216.140.49", "221.216.140.129")
OR http_user_agent IN ("Metabase-GHSA-vwf4/2.0", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36"))
| eval case=case(in(src, "213.163.202.171", "221.216.140.49", "221.216.140.129") OR http_user_agent=="Metabase-GHSA-vwf4/2.0", "C (Metabase)",
in(src, "3.112.252.14", "54.95.112.6", "69.10.51.162", "172.86.91.7", "210.149.87.120"), "B (app or API)", true(), "User-Agent only")
| eval tool_ua=if(in(http_user_agent, "curl/7.88.1", "python-requests/2.34.2", "python-requests/2.33.1"), 1, 0)
| stats min(_time) AS first_seen max(_time) AS last_seen count AS events sum(tool_ua) AS with_tool_ua
values(http_user_agent) AS user_agents values(status) AS statuses dc(url) AS distinct_urls values(dest) AS targets BY case src
| convert ctime(first_seen) ctime(last_seen)
| sort 0 case -events
| head 200
3. Sumo Logic. Set the time range from 1 August 2026. The query assumes your field extraction names the client address src_ip and the User-Agent user_agent; rename them to match yours.
// Illustrative; not run against live data. Sumo Logic log search over web, WAF or load-balancer access logs.
_sourceCategory=REPLACE_WITH_WEB_ACCESS_LOGS
| where src_ip in ("3.112.252.14", "54.95.112.6", "69.10.51.162", "172.86.91.7", "210.149.87.120", "213.163.202.171", "221.216.140.49", "221.216.140.129")
or user_agent in ("Metabase-GHSA-vwf4/2.0", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36")
| if(src_ip in ("213.163.202.171", "221.216.140.49", "221.216.140.129") or user_agent = "Metabase-GHSA-vwf4/2.0", "C (Metabase)",
if(src_ip in ("3.112.252.14", "54.95.112.6", "69.10.51.162", "172.86.91.7", "210.149.87.120"), "B (app or API)", "User-Agent only")) as case
| min(_messagetime) as first_seen, max(_messagetime) as last_seen, count as events by case, src_ip, user_agent
| formatDate(toLong(first_seen), "yyyy-MM-dd HH:mm") as first_seen
| formatDate(toLong(last_seen), "yyyy-MM-dd HH:mm") as last_seen
| sort by events
| limit 200
4. CrowdStrike Falcon LogScale (Next-Gen SIEM): inbound connections from the published addresses to hosts with the Falcon sensor, such as a Metabase server. Set the time range from 1 August 2026.
// Illustrative; not run against live data. Falcon sensor events for accepted inbound IPv4 connections.
#event_simpleName=NetworkReceiveAcceptIP4
| in(field="RemoteAddressIP4", values=["3.112.252.14", "54.95.112.6", "69.10.51.162", "172.86.91.7", "210.149.87.120", "213.163.202.171", "221.216.140.49", "221.216.140.129"])
| case {
in(field="RemoteAddressIP4", values=["213.163.202.171", "221.216.140.49", "221.216.140.129"]) | Case := "C (Metabase)" ;
* | Case := "B (app or API)" ;
}
| groupBy([Case, RemoteAddressIP4, aid, LocalPort], function=[count(as=Connections), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])
| sort(Connections, order=desc, limit=200)
5. Self-hosted analytics servers, and whether the internet reaches them. Microsoft Defender XDR advanced hunting, DeviceProcessEvents and DeviceNetworkEvents. A non-zero PublicSources count means the host accepted connections straight from the internet. Zero does not prove the tool is private: behind a reverse proxy or load balancer, connections arrive from a private address.
// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Hosts that ran a self-hosted analytics or BI server in the last 30 days,
// and how many public IP addresses connected to them in the last 7 days.
let AnalyticsHosts = DeviceProcessEvents
| where Timestamp > ago(30d)
| where ProcessCommandLine has_any ("metabase.jar", "superset", "redash", "grafana-server")
| summarize Commands = make_set(ProcessCommandLine, 3), LastSeen = max(Timestamp)
by DeviceId, DeviceName;
let Exposure = DeviceNetworkEvents
| where Timestamp > ago(7d)
| where DeviceId in (AnalyticsHosts | project DeviceId)
| where ActionType == "InboundConnectionAccepted" and RemoteIPType == "Public"
| summarize PublicSources = dcount(RemoteIP), Ports = make_set(LocalPort, 10) by DeviceId;
AnalyticsHosts
| join kind=leftouter Exposure on DeviceId
| project DeviceName, LastSeen, PublicSources = coalesce(PublicSources, 0), Ports, Commands
| order by PublicSources desc
6. One account downloading far more than usual. Defender XDR, CloudAppEvents. In IEEJ's case, six phished accounts left traces of 2,798 downloaded files; the bulk exports at Kindal and Rakuten Drive followed the same shape in other systems. Tune the threshold to your normal activity.
// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting, CloudAppEvents table.
// Accounts that downloaded more than 200 distinct files from SharePoint or OneDrive in one hour.
CloudAppEvents
| where Timestamp > ago(7d)
| where ActionType == "FileDownloaded"
| summarize Files = dcount(ObjectName) by AccountDisplayName, IPAddress, bin(Timestamp, 1h)
| where Files > 200
| order by Files desc
Download the examples: IOC KQL · IOC SPL · analytics exposure KQL · bulk download KQL. For pattern 1, our Lawson analysis has KQL and SPL that look for one caller reading many customer records through your own API.
Read the results with three limits in mind. No match does not prove you were not targeted: attackers change addresses, and logs may be missing or past retention. A match on a common tool User-Agent alone means little. And none of this sees inside a supplier's platform: for pattern 3, the control is the contract and the inventory.
What remains unknown
- How most attackers got in. 49 of the 92 attack notices do not describe the method, including Times Car, Yakiniku King, Fines, Sakura Internet, OZmall and Daiichikosho's contractor.
- Who is behind the wave. JPCERT/CC describes shared techniques, not a single actor, and says its information is limited and fragmentary.
- Missing numbers. 40 attack notices give no figure, including ApplyNow, Sagawa Express, Rohto, Yamato Transport, Sammy Networks, Smaregi EC and PhotoGoods.
- Possible becoming confirmed. Many notices describe a possible leak. Follow-ups may confirm, narrow or withdraw those findings.
- Unique people. Overlapping customers and mixed units make a count of individuals impossible from public notices.
Reporting note
Scope. Notices published from 10 August to 8 October 2026 by organisations in Japan, or by their Japanese operations. Pokémon Center's notice of 19 August, about European customers affected through an attack on a logistics company, is left out. Each notice is counted once, under its first date in the window; five follow-ups to incidents first reported earlier are marked.
Sources. We read Security NEXT's unauthorised-access news for the whole window, ScanNetSecurity's incident feed from 18 September to 5 October, the TT Incidents Log for August, Mynavi TECH+ roundups of 30 September and 6 and 7 October, and Security Taisaku Lab's ransomware roundup. Our September review traced 29 notices to the organisations' own statements. For the 38 large disclosures and many others, we checked the organisation's notice. Entries taken from a headline alone link to that report, and unnamed organisations are described as the report describes them. Our sources cover August less fully, so the monthly counts should not be read as a trend.
Counting. Figures are added as reported, in their own units. For Unni we count the 48,000 users in Japan, not its 219,665 total. Lawson counts 2,155,345 without the 26 pre-orders; Rakuten Books Network adds its three groups (35,773); Nippon Rent-a-Car adds both intrusions (96); Shueisha adds bloggers and the partner list (13,615); Yoshinoya and Hanamaru add applicants and staff (5,784). Osaka Metropolitan University's 130,000 is what its systems held; whether data left is under investigation. In the 12-month list, "counted in people" includes notices that count people, members or customers; CAMPFIRE and VOISING are left out because their units are not clear in both languages. The population is the Statistics Bureau's provisional estimate for 1 September 2026, published on 24 September.
Classification. The cause in each table is what the notice says. Grey in Figure 2 and "not disclosed" in the tables mean the notices we reviewed do not describe the method. Where a notice describes an attack on a system the organisation used but did not run, it is marked as a supplier case.
This is independent editorial analysis of public statements, not an investigation of any of these incidents. piyolog, ITmedia, ASCII.jp and act1 were also used to find and cross-check notices.
Update history.
- 8 October 2026, 23:30 JST. Rebuilt as a 60-day review and merged with our September review. Eight disclosures added to the 12-month list; Seicomart reclassified; JPCERT/CC alert, hunting queries and new figures added.
- 6 October 2026, 11:55 JST (correction). Murauchi.com's second notice describes the way in, a vulnerability in part of a web system; we had listed its method as undisclosed. The same correction was made to the September review.
- 6 October 2026, 11:45 JST. Added the comparison with Japan's population.
- 6 October 2026, 11:15 JST. Checked the 12 entries added in the tier list's 5 October revision and added infoQ and Osaka Metropolitan University.
- 2 October 2026. First published; our September review of 29 notices was published the same day.
Sources
Alerts and roundups
- JPCERT/CC, JPCERT-AT-2026-0030, alert on the recent wave of unauthorised access to Japanese organisations, 8 October 2026
- JPCERT/CC, alert on Metabase SQL injection (CVE-2026-72898), 14 August 2026
- Macnica Security Research Center, on the series of leaks from web systems, October 2026
- Mynavi TECH+, roundup of 30 September 2026, 6 October and 7 October
- Mynavi TECH+, IDC Frontier ransomware and IDCF Cloud outage, 8 October 2026
- ScanNetSecurity, incident category
- TT Incidents Log, August 2026
- Security Taisaku Lab, ransomware case studies and 2026 roundup of major incidents in Japan
- yousukezan, Top 10 large disclosures in Japan, 29 September 2026
- Statistics Bureau of Japan, population estimates, published 24 September 2026
Notices and reports cited in the text (every notice in the 60 days is linked in the tables)
- Lawson, 8 October 2026
- Sanspo (Kyodo News), Daiichikosho, 8 October 2026
- MrMax, 6 October 2026
- Citizen Watch, 6 October 2026
- Asahi Kasei Therapeutics, Pharma DIGITAL notice, 6 October 2026
- nimoca, 6 October 2026 (PDF)
- LEAN BODY, 15 September 2026
- Security NEXT, ApplyNow (Kichiri Holdings), 10 September 2026
- Security NEXT, Fancrew, 9 September 2026
- Security NEXT, PhotoGoods, 1 October 2026
- Security NEXT, Rakuten Books Network, 24 August 2026
- Security NEXT, Yellow Hat work-booking system, 31 August 2026
- Security NEXT, Daiki Suisan app, 6 October 2026
- Security NEXT, Tsuburaya Productions lottery, 15 September 2026
- Yoshinoya Holdings, ApplyNow notice, 30 September 2026
- ASCII.jp, city recruitment exam systems, 18 September 2026
- Kyusai, 25 September 2026
- ITmedia, LEGOLAND Japan Hotel, 29 September 2026
- ITmedia, Benefit One, 30 September 2026
- Sammy Networks, 777CON-PASS follow-up, 2 October 2026
- Seicomart, third notice, 30 September 2026 (PDF)
- piyolog, Unni, 24 September 2026
- IEEJ, first notice, 11 September 2026 (PDF) and follow-up, 2 October 2026 (PDF)
- Abahouse International, 3 October 2026
- Moonstar, follow-up notice, 2 October 2026
- Lashinbang, 1 October 2026
- ITmedia, e+ Smart-ticket refund system, 29 September 2026
- ITmedia, Times Car licence image retention, 30 September 2026
- Dai-ichi Life, notice to former staff on the HR system, October 2026 (PDF)
- Helpfeel, Gyazo first notice, 16 September 2026 and second notice, 25 September 2026
- Monogatari Corporation, Yakiniku King app, 5 October 2026
- GMO Research & AI, infoQ, 5 October 2026
- Daiwa Securities, notice on the supplier incident, 5 October 2026 (PDF)
- MBS News, Osaka Metropolitan University press conference, 5 October 2026
- Digital Agency, GSS notice, 11 September 2026
- Sakura Internet, investigation results, 10 September 2026
Earlier entries in the 12-month list
- EPARK Relax & Esthe, first notice
- KDDI, notice on the ISP mail platform
- Kyushu Electric Power Transmission and Distribution, 8 June 2026
- E-Store, second notice, 2 August 2026
- CAMPFIRE, investigation results, 2 June 2026
- Coop Yamaguchi, second notice
- Universal Music Japan, investigation results, 18 May 2026
- Yellow Hat, 2Rinkan notice, June 2026
- Komatsu, 16 June 2026
- KIND, 28 August 2026
- Unimat Life, notice
- COTA, notice
Query references