In brief
The Personal Information Protection Commission released data showing about 260 million people’s information was compromised from April to mid‑October, driven by more than 2 094 incidents, including large leaks affecting over 10 million individuals each. Despite duplicates among victims, the figure may under‑state the true scale, prompting Tokyo to announce emergency counter‑measures.
Japan’s Personal Information Protection Commission revealed that the personal information of about 260 million people was compromised from the start of the fiscal year in April through mid‑October, a figure that roughly equals twice the nation’s population. The data, compiled from reports filed by companies handling personal data, excludes financial and telecommunications firms, indicating that the true extent could be larger. Researchers counted 2,094 incidents of unauthorized access over the six‑month span, six of which released data on more than 10 million people each. The number of breaches accelerated sharply in October, with 830 events recorded in the first half of the month alone, compared to 303 for all of September.
Early in the year, the commission’s database already noted 1,256 breaches, a figure reported by Kyodo News for fiscal 2025. The new counts place Tokyo closer to its most serious data‑security exposure since the 2017 Sony data leak. While the tally includes some individuals counted twice because they were impacted by multiple incidents, it still represents an unprecedented concentration of compromised personal records across the country.
Patients, Customers, and Consumers Affected
During the latest reporting period, several corporate and institutional names surfaced as affected. Sony Life Insurance Co. disclosed that personal data could have been reached through an unauthorized entry to its website or internal systems. The discount retailer Don Quijote and the video game publisher Bandai Namco Entertainment Inc. also announced potential breaches. Educational and medical institutions were on the list, with Kyushu University and its affiliated hospital reporting that contracted systems may have had data exposed.
In the following weeks, other firms found themselves on the periphery of the wave. The Ryohin Keikaku Co., which manages the Muji chain, and Matsuya Foods Holdings Co., a large restaurant operator, reported possible leaks in late October. All Nippon Airways Co., one of Japan’s largest airlines, also filed notices early the week after the surge. Each announcement mirrored a broader national pattern of data‑security incidents triggered by unauthorized access, ranging from corporate networks to institutional infrastructures.
Chief Cabinet Secretary Minoru Kihara addressed the situation at a press conference on Friday, stressing that the number of large‑scale leaks was climbing quickly and that the government regarded the overall crisis with great seriousness. “The number of large‑scale leaks is increasing rapidly, and the government is taking the situation very seriously,” Kihara said, adding that Tokyo would assemble a bundled emergency package of counter‑measures in the near future.
"The number of large‑scale leaks is increasing rapidly, and the government is taking the situation very seriously," said Chief Cabinet Secretary Minoru Kihara at a press conference.
In an earlier segment of the same briefing, the government expressed its confidence that the accompanying emergency measures would restore public confidence in personal data protection. However, experts noted that the report’s exclusion of financial and telecommunications firms might underestimate the total number of people affected by each breach. The commission’s data points to a broader national vulnerability that may extend beyond the industries that most often appear in the public discussion of data security.
With the scale of the 2026 breaches already eclipsing the 2017 figure, analysts suggest that the pattern of rapid, multi‑sector attacks may continue unless systemic changes to security protocols and enforcement of data‑protection regulations are enacted.
Tokyo’s commitment to swift remedial action came after a series of incidents that, according to the commission, involved repeated intrusion attempts on corporate and institutional networks during the last quarter of the fiscal year. The overarching goal, as expressed by the government, is to halt the identification and exploitation of software vulnerabilities that allow data leakage on a mass scale.
As the push for accountability proceeds, the commission’s report underscores the need for comprehensive protective measures that encompass all sectors, including those that were not included in the most recent data release. The sheer volume of reported incidents and the high number of people listed as affected signal a new benchmark for Japan’s data‑security landscape, prompting the government to act decisively to curb the trajectory of cyberattacks in the city’s public and private spheres.
