Designing to limit data leaks: 21 cases involving Japan

The September 29, 2026 third report confirmed that identity documents had leaked for about 1.6 million accounts. Documents included driving licence images, proof of address, and documents used for student and family plans. This is an account count, not necessarily a count of people.[1]

The report was updated on October 1. Individual notifications had begun, with further investigation into the details.[1]

On January 27, 2026, Kama-Asa reported unauthorized acquisition of membership data through an external app connected to Smaregi. Confirmed fields were names for 5,375 people and telephone numbers for 1,825. These field-specific counts must not be added together as a victim total.[2]

The notice concerns in-store or telephone registrations, excluding customers who used only the online store. It distinguishes the external app from Smaregi's main system and official apps. Exposure of email addresses, addresses and card data was not confirmed.[2]

IIJ disclosed the Secure MX intrusion on April 15, 2025. The initial possible scope was up to 4,072,650 email accounts. Its April 22 update confirmed exposure of account/password information for 132 contracts and 311,288 email accounts; some involved account information only.[3][4]

The update confirmed email-body exposure for six contracts and separately reported external-cloud credential information concerning 488 contracts. Contracts, email accounts and data categories are different units. The initial maximum possible scope is not a confirmed victim count.[3][4]

After detecting unauthorized access on January 18, 2025, Kaikatsu Frontier reported possible exposure of 7,290,087 membership records. Its March 17 report had not confirmed an actual leak or secondary harm. The number describes possible scope.[5]

The reported scope included names, addresses and telephone numbers, while excluding card data, email addresses and app passwords. The report also described program changes and stronger monitoring. Those measures do not establish that each potentially affected record was stolen.[5]

Tully's October 3, 2024 report described intrusion through a system vulnerability and tampering with a payment application. Possible exposure involved 92,685 personal-information records, including 52,958 card-information records. The card count is a subset.[6]

The card scope covered purchases from July 20, 2021 to May 20, 2024; membership records used a different period. The notice excluded the Rakuten store, app, digital gifts and Tully's Card registration data.[6]

For the attack detected on June 8, 2024, KADOKAWA's August 5 report confirmed external leakage of personal information for 254,241 people. Groups included business partners, former employees, job applicants, and N/S school students and guardians. Leakage of Niconico login credentials was not confirmed.[7]

The company presumed that employee account information had been stolen through phishing or a similar method, but had not established the route or method. The confirmed affected count and the presumed initial access mechanism carry different certainty.[7]

Kumon reported that ransomware at its printing and mailing contractor Iseto caused a leak. Its August 20, 2024 third report identified 739,714 members in the newly established scope after removing overlap within that scope. An earlier notice concerned 4,678 people with contact or authentication-code information; the categories must not be simply added.[8]

The exposed membership data included learning materials, classroom details, school year and test information. Kumon described minimizing data supplied to contractors and confirming deletion after work.[8]

Tokyo Gas's July 17, 2024 initial report described possible exposure of information for about 4.16 million consumers supplied by TGES's commissioning clients. These were not Tokyo Gas household gas/electricity contract records. Business contacts and TGES employees were separate categories.[9][10]

A December 18 update from client Nihongas reported no confirmed traces of leakage or secondary-harm reports after specialist investigation. That update concerns Nihongas's notification scope, not all TGES clients. Sending notifications is distinct from confirming exfiltration.[9][10]

Fujitsu's July 9, 2024 investigation followed its March 15 disclosure. Forty-nine computers in its domestic internal network were affected, with possible unauthorized copying and external removal of files containing personal and business information. Forty-nine is a computer count, not a victim count.[11]

The report found no evidence of impact on customer cloud services and distinguished the malware from ransomware.[11]

A system failure occurred on May 19, 2024, followed by confirmation of ransomware the next day. The February 13, 2025 investigation report states that police confirmed information leakage on June 7. Shared-folder documents included names, addresses and diagnoses, with a scope estimated at up to 40,000 people.[12]

Shared clinical documents are distinct from the electronic medical record system itself. Leakage was confirmed, while the affected population remained an estimate. Missing logs prevented establishment of the initial intrusion route; the report does not justify naming a specific vulnerable device as the cause.[12]

The August 30, 2024 report on an issue discovered in April described leakage of about 860,000 records concerning the company's policyholders and others to other insurers at 384 multi-insurer agencies. Separately, the company received about 100,000 records about other insurers through secondees at 35 agencies, including about 80,000 individual and 20,000 corporate records. Different directions and units cannot become '960,000 people'.[13][14]

The issue concerns information handling through agencies and secondees, rather than simply external intrusion. The April 30, 2025 notice concerns regulatory guidance on the same incident; it is not a new leak event.[13][14]

The November 27, 2023 disclosure, updated February 14, 2024, describes malware on a contractor's employee computer and intrusion through infrastructure shared with NAVER. Updated figures were 302,980 user, 86,211 business-partner and 130,315 employee-related records, including possible exposure. Estimates and overlap prevent a unique-person total.[15]

The updated notice also revised the initial intrusion date. It excluded LINE chat contents, bank-account and card information from the affected scope. Shared authentication infrastructure does not mean every category of LINE data leaked.[15]

NTT West's October 17, 2023 notice confirmed unauthorized removal and third-party leakage of about 1.2 million customer records used in its telemarketing work by a former dispatched employee. Fields included names, addresses and telephone numbers, and some dates of birth.[16]

The count concerns NTT West's commissioned work, not every client or the entire group. Bank-account, card and password information was excluded. This is an insider misuse case involving authorized work access, distinct from internet-based intrusion.[16]

NTT Docomo's July 21, 2023 update reported that a former dispatched worker at NTT Nexia had improperly moved sales-support files to personally contracted external storage. Investigation expanded the initial maximum of about 5.29 million records to about 5.96 million, including former customers.[17]

The breakdown was about 1.65 million Plala and 4.31 million Hikari TV records, with overlap handling explained. Unauthorized removal was confirmed; third-party viewing, saving or misuse was not. The notice excluded payment information and passwords.[17]

Toyota's May 31, 2023 additional report described externally accessible vehicle-ID and map-update information relating to about 260,000 domestic customers because of cloud settings. That domestic scope differs from the names and addresses discussed for overseas customers in the same report.[18]

The domestic data alone could not identify specific individuals. Evidence of third-party copying or misuse, and secondary harm, had not been confirmed. External accessibility is distinct from observed acquisition, and this additional scope must not be combined with other notices as if it were one count.[18]

The Personal Information Protection Commission's March 25, 2024 action concerned MKSystem's June 2023 ransomware incident. Encryption created a risk of leakage or other loss of personal data. Up to about 22.42 million people describes the managed population, not confirmed leak victims.[19]

The document also reports 3,067 submitted reports and an aggregate reported population of 7,496,080, excluding unknown counts and potentially containing overlap. Reports, managed populations and confirmed exposure are different measures. Multiple clients reporting the same platform incident do not create separate attacks.[19]

JAXA's July 5, 2024 report concerns intrusion recognized in October 2023. It describes targeting VPN equipment, spreading into servers, stealing account information and impersonating legitimate users in Microsoft 365. Leakage of some cloud-held business and personal information was confirmed.[20]

Possible leakage from endpoints and servers was treated separately, without a published affected-person count. The compromised systems did not handle sensitive rocket or satellite operations information. The report separately states that other intrusions detected in 2024 had not caused confirmed leakage.[20]

Following the temporary loss of a USB drive on June 21, 2022, Amagasaki's November 28 report stated that forensic checks of the recovered drive and related computers and servers found no confirmed personal-information leakage. This is a comparison case about loss and evidence, not a confirmed breach.[21][22]

The report identified subcontracting without approval and failure to follow contracted transport procedures. The city's 2023 measures included file-transfer services and prohibiting USB use.[21][22]

Capcom's April 13, 2021 investigation covered the disruption detected in November 2020. Initial access occurred in October through an old backup VPN device at its North American subsidiary, with impact in Japan and the US. Confirmed personal-information leakage concerned 15,649 people.[23]

That count is not limited to Japan and is separate from possible exposure. Lost logs constrained parts of the investigation; a maximum possible population must not be presented as confirmed. The reported initial entry point was backup equipment rather than an actively used primary device.[23]

Fast Retailing's May 13, 2019 notice confirmed unauthorized login to 461,091 Uniqlo/GU online-store accounts between April 23 and May 10. Names, addresses and contact details may have been viewed. Confirmed login is distinct from confirmation that every field was exported.[24]

The company presumed credential stuffing using credentials possibly leaked from other services. Only part of card numbers was displayed, and security codes were neither displayed nor stored. Affected passwords were invalidated. Reused passwords can connect otherwise separate services' security incidents.[24]

The ministry's June 12, 2015 account states that unauthorized access through malicious email led to personal-information leakage discovered on May 28 and announced June 1. At that stage, about 1.25 million records were thought to have leaked. We preserve the source's unit: records, not people.[25]

The ministry also announced an investigation committee and warned about impersonation calls exploiting the incident. This is a historical example, not an event that occurred in 2026.[25]

The Kumon, TGES and external POS-app cases show why reviewing only a company's own systems cannot describe data held by contractors and integrations. For your own environment, record the fields transferred, purpose, storage location, subcontractors, deletion date and responsible owner together. This gives incident responders a concrete route for determining affected data.

Check whether unnecessary authentication fields accompany mailing files or identity-document images remain after their purpose ends. Supply only necessary fields and verify deletion through the actual process and records. These are checks for your environment, rather than assertions about undisclosed weaknesses at the organizations described.

A valid login does not justify unlimited data retrieval. Separate everyday work accounts, contractor maintenance access and personally contracted storage. Limit bulk exports and identity-document viewing to the scope required for the job. MFA, time-limited permissions and destination restrictions constrain different operations.

Using actual permission settings, establish what one compromised identity can reach across shared folders, customer data, cloud systems and backups. Monitor normal human viewing separately from machine-driven bulk retrieval, and preserve evidence of unusual volumes or destinations even when the underlying operation is authorized.

External accessibility, account misuse, file exfiltration, public disclosure and secondary harm are different facts. Correlate authentication, viewing, export and transmission histories. Short retention or logs that a compromised administrator can delete may leave responders unable to determine whether exposure occurred.

Protect logs under separate administration and detect collection failures. Record confirmed findings and uncertainty alongside the affected scope at that time. Prepare notification counts that preserve units, overlapping records and field-specific subsets.