Japan’s listed firms leaked 350m records in ten months, over 10 times last year

01215 incidents by October, after fourteen years below 190

Until September, 2026 looked like 2025: between 8 and 17 incidents a month, about the same pace as the year before. Then October brought 109, more than half the year’s 215.¹ The previous record was 189 incidents in all of 2024; 2025 had 180, at a record 158 companies.²

The cause has been shifting for years. In 2012 TSR counted 9 incidents from malware or unauthorised access; in 2025 it counted 116, 64.4% of the year’s 180, ahead of misdirected emails (37) and lost or wrongly discarded records (18). Internal systems and servers were where 140 of the 180 began.²

02Ten leaks above 10 million records, and why records are not people

In fourteen years to 2025, TSR counted three incidents of 10 million records or more. In 2026 there have been ten, six of them disclosed in October; 29 more fell between 1 million and 10 million, against 6 in 2025.¹ The largest is SG Holdings, the parent of the parcel carrier Sagawa Express, at up to 53.23 million records, duplicates included, after unauthorised access to its website’s parcel-inquiry service; it first disclosed possible access on 30 September. Until this year the largest in the series was Benesse’s, about 35.04 million.¹

Nine of the ten were unauthorised access; the tenth, at Kyushu Electric Power’s grid subsidiary, was records lost or wrongly discarded. Two routes stand out. Consumer apps and sites: Ryohin Keikaku, which runs Muji, and Monogatari Corporation, which runs the Yakiniku King restaurant chain, both reported access through their official apps. And suppliers: Yumirink builds email-delivery systems for companies and local governments, so its breach put its clients’ customer data at risk too, and TSR says the damage “snowballed”.¹ Each listed client that discloses counts as an incident of its own, which is how one supplier’s breach becomes many lines in the count.

A record is not a person. Bookoff’s third report on its October breach puts the gap in numbers: 6,427,735 member records were sent out, which are 6,383,279 people once records sharing an email address are counted once.³ Across companies the overlap is wider, since one shopper can sit in a parcel carrier’s, a retailer’s and a mailing service’s files at once. TSR’s total of 349,998,482 is close to three times Japan’s population, but it is a count of records disclosed, not of people affected.¹

03November so far, and what to watch

TSR says large leaks kept coming to light in November.¹ On 2 November Nojima, an electronics retailer, said about 7 million members’ names, birth dates, addresses, phone numbers, email addresses, login IDs and encrypted passwords were taken from its Nojima Online store and its used-phone buying site on 1 November; it holds no card data there.⁴ Bookoff traced its breach to an access-control flaw in part of its member system, filed a preliminary report with Japan’s Personal Information Protection Commission and plans the confirmed report in early December.³

For a company holding customer lists, the year’s count points to three checks:

• Which suppliers hold your customer data, starting with email delivery, where one breach reached many clients. Our Analysis of ARARA follows one such service to up to 380 client firms.
• Who can reach member data through your app and website, the route in the Muji, Yakiniku King and Bookoff cases.¹³
• How fast you would notice. TSR notes that even an information and communications group with its own security business took more than two months to detect unauthorised access.¹

What to watch: TSR’s full-year count, which last year came on 30 January²; whether November’s disclosures keep the monthly figure near October’s 109; and the confirmed reports due to the regulator, Bookoff’s in early December.³