Japan's Potential Data Leaks Exceed 165 Million Records as Companies Reveal Wider Breaches

Millions of records exposed across everyday services

Personal information potentially leaked through unauthorized access in Japan during 2026 has exceeded 165 million records, according to a tally by security company Macnica. The disclosures reach across rail travel, shopping, karaoke, software, parcel delivery and car sharing, including information belonging to people who had already closed their accounts.

Sourcenext alone announced on October 15 that 22,519,960 customer records might have leaked. Adventure, which operates the Skyticket travel booking website, disclosed a possible breach involving about 14.64 million records. Yamato Transport later identified 5.31 million affected records linked to its deferred payment service.

The 165 million figure counts personal information cumulatively across incidents. A person whose information appears in several affected services can therefore be counted more than once. The total also includes possible leaks, alongside disclosures in which companies have identified compromised information.

Macnica's more detailed investigation of a particular pattern of website breaches found 119 public disclosures by October 6, already above the 84 recorded throughout 2025. Of those 119 disclosures, 81 came from July onward.

Japan's Information technology Promotion Agency, known as IPA, issued an urgent warning on October 9, calling on company leaders to check internet services, accounts and stored data. Its advice connects two immediate tasks: finding intruders and reducing the amount of personal information they could steal.

For customers, the consequences depend on what each service held. Some affected databases contained contact details. Others potentially included passwords, credit card information or images of identity documents. The disclosures also show how an attack on a contractor can reach customers of several businesses at once.

What Macnica counted and why the increase matters

Macnica's website breach analysis examined 265 publicly disclosed incidents involving domestic organizations between January 2024 and October 6, 2026. Its annual counts rose from 62 in 2024 to 84 in 2025 and 119 in the incomplete 2026 period.

The 2026 count was already 35 incidents, or about 42%, above the previous full year. The 81 disclosures from July onward represented roughly 68% of the year's total and about 31% of all 265 incidents examined.

Yutaka Sejiyama of Macnica's Security Research Center prepared the public disclosure analysis, with attack analysis contributed by Motohiko Sato of Itochu Cyber & Intelligence and Yosuke Hasegawa, chief technology officer of Secure Sky Technology.

The researchers selected incidents they judged to share similar features. Their dataset excludes ransomware and certain other attack patterns, including attempts to enter customer accounts using passwords stolen from unrelated services. When several clients disclosed damage from a single incident at a shared contractor, the researchers counted the contractor incident once.

The broader company disclosures described below include ransomware incidents as well. Readers therefore need to keep track of two measures: the amount of customer information potentially exposed and the number of selected website incidents tracked in Macnica's technical investigation.

Which companies reported the largest exposures?

Sourcenext said the potentially affected information included names, addresses, telephone numbers, workplaces, email addresses and passwords. The software company identified unauthorized access to its membership information system on October 13 and announced the possible exposure two days later.

Adventure reported attacks on its servers and the business management system for Skyticket, potentially affecting about 14.64 million personal information records. It said credit card and passport numbers had not leaked.

Daiichikosho, operator of the Big Echo karaoke chain, said approximately 8.72 million personal records might have been exposed through a system managed by an outside contractor. The incident involved malware at the outsourcing company.

JR East said about 6.09 million customer accounts might have been compromised, while JR Kyushu put its possible exposure at about 1.3 million accounts. Both companies linked their breaches to a ransomware attack on IDC Frontier, a cloud services subsidiary of SoftBank. Together, their disclosed totals amount to about 7.39 million accounts.

Bookoff Group Holdings initially disclosed possible exposure affecting up to 6.43 million customers after unauthorized access at its subsidiary managing membership data. A subsequent description put the leaked information at about 6.38 million people, including approximately 210,000 former members.

Lawson reported unauthorized access to more than 2.15 million customer records, potentially including names, email addresses and credit card information. Uzabase, operator of NewsPicks, said some user information might have been exposed through unauthorized access to a management tool.

Lawson, Daiichikosho and Uzabase said they had confirmed no illegal use at the time of their announcements. The rail operators, Bookoff and Adventure likewise reported finding no evidence of misuse by third parties and urged customers to watch for suspicious emails and telephone calls.

Delivery records, development tools and schools were affected

Yamato Transport said on October 16 that 5.31 million personal information records belonging to some users of its deferred payment service had been compromised. The company first announced the breach on September 29.

The affected information included names, addresses and telephone numbers collected from October 1, 2018, over roughly eight years. The long collection period shows how a single intrusion can expose information accumulated across many years of customer activity.

Nikkei Inc. disclosed about 1.83 million compromised records, including names, addresses and email addresses, following unauthorized access to a cloud service used for system development. A development service is used to build or maintain software, placing another part of a company's technology environment within the reach of attackers.

Japan's education ministry also said eight schools, mostly universities, had reported breaches from late September through the Thursday preceding the latest disclosures. Macnica's investigation identified affected services as varied as library catalogue searches, sightseeing train reservations, university accommodation bookings and ticket refund management.

How the disclosures unfolded

Several incidents became public within weeks of one another, while investigations continued to establish how much information was involved. Sourcenext's account provides particularly precise times for the intrusion and its response.

• September 29: Yamato Transport first announced its breach. Park24 disclosed its car sharing data breach in late September.
• October 6: Macnica's research cutoff recorded 119 selected website breach disclosures during 2026.
• October 8: Macnica added a reference to a related warning from JPCERT/CC, Japan's computer security incident response organization.
• October 9: IPA issued its urgent inspection advice. JR East, Bookoff, Daiichikosho and Adventure were among companies whose disclosures became public that day. Sourcenext later traced the start of its intrusion to about 10 a.m. on October 9.
• October 13: Sourcenext detected unauthorized access at about 9 a.m. and took emergency steps to block it by that afternoon.
• October 15: Sourcenext announced the possible exposure of 22,519,960 records.
• October 16: Yamato detailed its 5.31 million affected records, Nikkei disclosed its breach, and Park24 announced plans to finish deleting identity document images by the end of October.

Sourcenext's timeline places the start of unauthorized access nearly four days before detection. IPA's instructions to examine recent activity and then extend the search further back address precisely this need to reconstruct what happened before an alarm was raised.

Attackers searched for weaknesses across whole services

Macnica's technical analysis describes attackers examining individual websites and their application programming interfaces, or APIs. An API is a channel through which an app or website asks another system for information or tells it to perform a task.

Investigators observed weaknesses such as APIs returning more information than necessary, functions carrying excessive permissions and features intended for members being accessible to anonymous visitors. Other problems involved login sessions, processing rules and access settings.

Some attackers examined mobile apps to extract API keys, credentials used when communicating with a service. They then used those keys to make requests resembling ordinary traffic. The researchers also observed weak administrator passwords and exploitation of known software vulnerabilities.

The practical challenge is broader than installing a single software update. A service may need its own checks to ensure that the server verifies who is making a request and which records that person is permitted to receive. Administrative tools that export large amounts of information also need close attention.

Most disclosures offered little detail about the cause

Among the 81 selected incidents disclosed from July onward, Macnica could classify nine as involving vulnerabilities in software products or related tools, four as involving misuse of credentials or password attacks, and three as involving site settings or access control failures.

The remaining 65 disclosures, about 80.2%, contained too little explanation to assign a cause. That leaves other organizations with limited detail about which weaknesses to search for in their own systems.

Some announcements described what intruders did after gaining access. Eleven incidents involved installation or execution of unauthorized programs, nine involved retrieving or viewing information through APIs or databases, and six involved creation of unauthorized accounts or authentication keys. These categories overlap because an incident could involve several actions.

Macnica also found at least 25 disclosures from July onward involving website alteration or misuse without a specific concern about personal information leakage. Examples included redirecting visitors to outside websites, showing fake warnings, changing registration information and misusing cloud services.

The researchers discussed the possible use of artificial intelligence to repeat searches across many websites. AI involvement and the attackers' ultimate purpose remain unconfirmed. Their observed activity centered on access permissions, settings, authentication and known vulnerabilities. One hypothesis they offered is that collected names, service details and reservations could help criminals make later phishing messages or fraudulent calls more convincing.

Former customers were caught in the breaches

Park24's breach involved about 6.6 million membership records, including former members, and about 1.6 million identity verification documents such as images of driving licenses. Times Car had retained identity documents for seven years after customers ended their memberships.

Park24 said on October 16 that it planned to finish deleting identity document images by the end of that month. Its response puts a concrete deadline on an issue also raised by IPA: businesses need to examine whether they still need the data they hold.

Bookoff's approximately 210,000 former members represented about 3.3% of the 6.38 million people identified in the later description of its leak. Pet supplies retailer Charm also said most of roughly 25,000 records belonging to former customers had leaked.

Closing an account can therefore leave a customer exposed for years if the business keeps the underlying records. Contact details can help criminals impersonate a familiar service, while passwords and identity document images create additional risks. Macnica recommends reviewing unnecessary records, including unexpected personal details accumulated in notes fields, and retiring API keys when a service closes.

What IPA wants organizations to check now

IPA's October 9 advisory calls for urgent inspections of applications exposed to the internet, outside services and accounts, and stored information. It places responsibility on company leaders, particularly where businesses handle large amounts of personal or sensitive data.

For applications, IPA recommends reviewing recent logs, the records of activity kept by systems, and checking for missing security patches. Investigators should begin with roughly the past month and then extend the review to three months, looking for unusual error volumes and changes from normal activity.

For outside services, including cloud and VPN services, companies should list what the organization and individual departments use. They should establish how long logs are retained, who can inspect them, and whether the provider holds records that the customer cannot see directly.

Account checks should look for unfamiliar users and accounts that have become active despite previously being disabled or deleted. Unusual login times, locations and repeated failed attempts also warrant attention. IPA recommends treating abnormal logs or accounts as a security incident and seeking specialist investigation.

Macnica's related advice includes checking whether APIs enforce permissions on the server, removing secrets embedded in apps, protecting administrator accounts with multiple authentication steps and restricting access to management functions. Monitoring also needs a clear human response: someone must review alerts, contact the right people and begin investigation.

IPA is preparing a security assessment scheme for supply chains, known as the SCS assessment scheme, for a planned launch in March 2027. Its common assessment criteria are intended to help clients and contractors understand security conditions across the businesses that share information.

Similar incidents extended beyond Japan

Macnica identified 99 similar incidents across 13 countries and territories, mainly during July through September 2026. South Korea accounted for 30, France for 11 and Poland for eight.

The South Korean cases involved websites and APIs across shopping, reservations, education and financial support. That spread resembles the range of services appearing in Japanese disclosures.

Disclosure laws and practices affect how many incidents become public in each country. Macnica described Japan as prominent in its investigation while leaving open whether attackers were specifically concentrating on Japan.

Across the Japanese cases, the immediate priorities are concrete: find unauthorized activity, secure access to customer information and remove records that no longer need to be kept. The contractor incidents and exposure of former members show why that work must reach beyond a company's main website and its current customer list.

Key Points

• Macnica's tally puts personal information potentially leaked through unauthorized access in 2026 at more than 165 million records, with repeat counting possible across services.
• Its narrower website investigation recorded 119 disclosures by October 6, including 81 from July onward.
• Sourcenext disclosed 22,519,960 potentially affected records; Adventure reported about 14.64 million.
• Contractor breaches affected customers of major businesses, while retained records exposed former members of Park24, Bookoff and Charm.
• IPA called for urgent reviews of logs, patches, accounts, outside services and stored data.
• Park24 planned to finish deleting identity document images by the end of October. IPA's supply chain security assessment scheme is scheduled to begin in March 2027.