---
title: "Japan’s listed firms leaked 350m records in ten months, over 10 times last year"
summary: "Tokyo Shoko Research’s count to October: 215 leak incidents at listed companies, already a full-year record, 109 of them in October, ten above 10 million records, and who lost the most."
url: https://www.thetechbag.com/blog/japan-listed-companies-350m-records-leaked-10x
format: Trend
desk: "Security"
area: "Risk & compliance"
region: Global
published: 2026-11-13
facts_checked: 2026-11-13
author: TechBag (The TechBag Journal)
tags: ["Japan data breach","Japan data leak record","Japan personal information leak","Tokyo Shoko Research","SG Holdings data breach","Sagawa Express","Yumirink","Ryohin Keikaku","Muji data breach","Capcom data breach","KDDI","Sourcenext","BASE","Monogatari Corporation","Bookoff data breach","Nojima data breach","listed companies","unauthorised access","email delivery service","supplier risk","Personal Information Protection Commission","TDnet","CERT-In","DPDP Rules"]
cover: https://www.thetechbag.com/blog/covers/japan-listed-companies-350m-records-leaked-10x.png
---

# Japan’s listed firms leaked 350m records in ten months, over 10 times last year

*Tokyo Shoko Research’s count to October: 215 leak incidents at listed companies, already a full-year record, 109 of them in October, ten above 10 million records, and who lost the most.*

Trend · Security · Risk & compliance · By TechBag · Published 2026-11-13 · Facts checked 2026-11-13 · Canonical: https://www.thetechbag.com/blog/japan-listed-companies-350m-records-leaked-10x

The short version

1. Japan’s listed companies and their subsidiaries disclosed 350.0 million leaked or lost personal records from January to October, more than ten times the 30.6 million of all of last year, by Tokyo Shoko Research’s count.[1]
2. The 215 incidents already beat the full-year record of 189, set in 2024. October alone brought 109, and six of the year’s ten leaks above 10 million records.[1]
3. It has not stopped: from 2 to 13 November, 32 listed companies posted 38 notices about unauthorised access or leaks on the stock exchange’s disclosure service, and Nojima reported about 7 million members’ data taken from its online store.[4][5]

Tokyo Shoko Research, a Japanese credit-research firm, has counted every leak or loss of personal data that a listed company or its subsidiary has disclosed since 2012. Its count for the first ten months of 2026, published on 9 November, is the largest in the series by both measures: incidents and records.[1] What changed in October, why the record count ran so far ahead of the incident count, and what does a company that holds customer lists check first?

## 215 incidents by October, after fourteen years below 190

Until September, 2026 looked like 2025: between 8 and 17 incidents a month, about the same pace as the year before. Then October brought 109, more than half the year’s 215.[1] The previous record was 189 incidents in all of 2024; 2025 had 180, at a record 158 companies.[2]

**Figure: Japan’s listed companies passed the full-year record for leaks in ten months**

*Personal-data leak and loss incidents disclosed by listed companies and their subsidiaries, by year, 2012 to October 2026*

|  | Incidents |
| --- | --- |
| 2012 | 71 |
| 2013 | 107 |
| 2014 | 70 |
| 2015 | 87 |
| 2016 | 89 |
| 2017 | 90 |
| 2018 | 85 |
| 2019 | 86 |
| 2020 | 103 |
| 2021 | 137 |
| 2022 | 165 |
| 2023 | 175 |
| 2024 | 189 |
| 2025 | 180 |
| 2026 to Oct | 215 |

Source: Tokyo Shoko Research, surveys of 30 January 2026 and 9 November 2026 · as of 9 November 2026 · 2026 is January to October, preliminary

The cause has been shifting for years. In 2012 TSR counted 9 incidents from malware or unauthorised access; in 2025 it counted 116, 64.4% of the year’s 180, ahead of misdirected emails (37) and lost or wrongly discarded records (18). Internal systems and servers were where 140 of the 180 began.[2]

## Ten leaks above 10 million records, and why records are not people

In fourteen years to 2025, TSR counted three incidents of 10 million records or more. In 2026 there have been ten, six of them disclosed in October; 29 more fell between 1 million and 10 million, against 6 in 2025.[1] The largest is SG Holdings, the parent of the parcel carrier Sagawa Express, at up to 53.23 million records, duplicates included, after unauthorised access to its website’s parcel-inquiry service; it first disclosed possible access on 30 September. Until this year the largest in the series was Benesse’s, about 35.04 million.[1]

**Figure: Six of the ten leaks above 10 million records were disclosed in October**

*Personal records leaked or lost, or possibly so, in each 2026 incident of 10 million or more, millions, January to October 2026*

SG Holdings (Sagawa Express)

Sep

53.23 m

Yumirink

Oct

51.62 m

Ryohin Keikaku (Muji)

Oct

27.26 m

BASE (E-Store)

Aug

23.35 m

Sourcenext

Oct

22.51 m

Adventure

Oct

14.64 m

KDDI

Jul

12.23 m

Capcom

Oct

11.77 m

Kyushu Electric Power

Jun

10.9 m

Monogatari Corporation

Oct

10.78 m

|  | Value (m) |
| --- | --- |
| SG Holdings (Sagawa Express) | 53.23 |
| Yumirink | 51.62 |
| Ryohin Keikaku (Muji) | 27.26 |
| BASE (E-Store) | 23.35 |
| Sourcenext | 22.51 |
| Adventure | 14.64 |
| KDDI | 12.23 |
| Capcom | 11.77 |
| Kyushu Electric Power | 10.9 |
| Monogatari Corporation | 10.78 |

Source: Tokyo Shoko Research, 9 November 2026 · as of 9 November 2026 · Preliminary; counts include records that may have leaked and duplicates

Nine of the ten were unauthorised access; the tenth, at Kyushu Electric Power’s grid subsidiary, was records lost or wrongly discarded. Two routes stand out. Consumer apps and sites: Ryohin Keikaku, which runs Muji, and Monogatari Corporation, which runs the Yakiniku King restaurant chain, both reported access through their official apps. And suppliers: Yumirink builds email-delivery systems for companies and local governments, so its breach put its clients’ customer data at risk too, and TSR says the damage “snowballed”.[1] Each listed client that discloses counts as an incident of its own, which is how one supplier’s breach becomes many lines in the count.

A record is not a person. Bookoff’s third report on its October breach puts the gap in numbers: 6,427,735 member records were sent out, which are 6,383,279 people once records sharing an email address are counted once.[3] Across companies the overlap is wider, since one shopper can sit in a parcel carrier’s, a retailer’s and a mailing service’s files at once. TSR’s total of 349,998,482 is close to three times Japan’s population, but it is a count of records disclosed, not of people affected.[1]

TechBag countTen months against fourteen years

TSR put the records leaked or lost from 2012 to 2025 at 213.13 million in all. The 350.0 million of January to October 2026 is about 1.6 times that fourteen-year total.[1][2]

## November so far, and what to watch

TSR says large leaks kept coming to light in November.[1] On 2 November Nojima, an electronics retailer, said about 7 million members’ names, birth dates, addresses, phone numbers, email addresses, login IDs and encrypted passwords were taken from its Nojima Online store and its used-phone buying site on 1 November; it holds no card data there.[4] Bookoff traced its breach to an access-control flaw in part of its member system, filed a preliminary report with Japan’s Personal Information Protection Commission and plans the confirmed report in early December.[3]

TechBag countNotices on the exchange, 2 to 13 November

We read the titles of every notice on TDnet, the Tokyo Stock Exchange’s disclosure service, from 2 to 13 November. 38 notices from 32 listed companies report unauthorised access, a leak or ransomware: first reports from companies such as Nitori, EDION and Soft99, and follow-ups from others. Several name a supplier’s email-delivery service as the way in. Notices posted only on a company’s own site, like Nojima’s, are not in TDnet’s lists.[5]

For a company holding customer lists, the year’s count points to three checks:

- **Which suppliers hold your customer data,** starting with email delivery, where one breach reached many clients. Our [Analysis of ARARA](https://www.thetechbag.com/blog/arara-81-million-email-addresses-380-clients-japan) follows one such service to up to 380 client firms.
- **Who can reach member data through your app and website,** the route in the Muji, Yakiniku King and Bookoff cases.[1][3]
- **How fast you would notice.** TSR notes that even an information and communications group with its own security business took more than two months to detect unauthorised access.[1]

**What to watch:** TSR’s full-year count, which last year came on 30 January[2]; whether November’s disclosures keep the monthly figure near October’s 109; and the confirmed reports due to the regulator, Bookoff’s in early December.[3]

In India, a leak like these is a six-hour report

No Indian count like TSR’s exists. The rule that applies today is CERT-In’s: a data breach or data leak must be reported to it within six hours of being noticed, under its directions of 28 April 2022.[6] The Digital Personal Data Protection Rules add a breach notice to the Data Protection Board and to each affected person, with a detailed report within 72 hours, under Rule 7, which comes into force on 13 May 2027.[7]

How we did this

Figures as of 13 November 2026, 8:30pm IST

All incident and record counts are Tokyo Shoko Research’s, from its survey of 9 November (January to October 2026, preliminary) and its 2025 survey of 30 January 2026, both in Japanese; the yearly incidents for 2012 to 2025 are read from that survey’s chart and add up to the 1,634 it states. TSR counts disclosures by listed companies and their subsidiaries (not unlisted companies or government bodies) in press releases and notices; it counts records that “may have” leaked, cases of improper handling, and incidents with no stated count; a record is a case or a person, as each company reports it, and totals include duplicates. Company names in the figure are TSR’s; the months are those of the incident or disclosure. Bookoff’s and Nojima’s figures are from their own notices; quotations from the Japanese are our translations. The 1.6 times is our arithmetic on TSR’s two totals. The TDnet count is ours: notices from 2 to 13 November (13 November read at 18:00 Japan time) whose titles contain “unauthorised access”, “personal information”, “leak”, “outflow”, “ransomware” or “security incident” in Japanese, with unrelated titles (results and share deals of companies with “cyber” in their names) removed; corrections and follow-ups count as notices. A figure for NetMile reported in the press is left out, as its operator’s own notice gives no number.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [Tokyo Shoko Research, TSR Data Insight: 上場企業「個人情報漏えい」、過去最悪を更新 (listed companies' personal-data leaks hit a record; January–October preliminary, about 350 million)](https://www.tsr-net.co.jp/data/detail/1203409_1527.html) — 9 November 2026 In Japanese; re-edited from TSR Jōhō of 6 November.
2. [Tokyo Shoko Research, TSR Data Insight: 2025年「上場企業の個人情報漏えい・紛失事故」調査 (2025 survey of listed companies' leak and loss incidents)](https://www.tsr-net.co.jp/data/detail/1202348_1527.html) — 30 January 2026 In Japanese.
3. [Bookoff Group Holdings, 不正アクセスによる個人情報漏えいに関するお詫びとお知らせ（第3報） (third report on the personal-data leak)](https://ssl4.eir-parts.net/doc/9278/tdnet/2906882/00.pdf) — 6 November 2026 In Japanese.
4. [Nojima, ノジマオンラインの不正アクセスに伴う個人情報漏えいに関するお詫びとお知らせ (notice on the Nojima Online leak)](https://www.nojima.co.jp/wp-content/uploads/2026/11/fa47750556e505f2ddb83dc080a6420f.pdf) — 2 November 2026 In Japanese.
5. [Japan Exchange Group, TDnet timely disclosure lists, 2 to 13 November 2026](https://www.release.tdnet.info/inbs/I_main_00.html) — 2–13 November 2026 TechBag count of notice titles; TDnet keeps about a month of lists.
6. [CERT-In, Directions under sub-section (6) of section 70B of the IT Act, 2000 (No. 20(3)/2022-CERT-In)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022
7. [MeitY, Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) (Rules 1 and 7)](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf) — 13 November 2025

**Disclosure.** TechBag is a software reseller: it earns when companies buy through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [Japan’s ARARA lost 81.3 million email addresses from up to 380 clients](https://www.thetechbag.com/blog/arara-81-million-email-addresses-380-clients-japan) — One mailing service, many clients: how ARARA exposed up to 380 firms’ lists, and why 81.3 million addresses are not 81.3 million people.

Go deeper on TechBag

- [Data security posture management guide](https://www.thetechbag.com/browse/data-security-privacy/dspm) — tools that find where copies of customer data sit, including at suppliers
- [Email security guide](https://www.thetechbag.com/browse/security/email-security) — the filters that catch phishing sent to a leaked list
- [Japan’s PM asks for attack reports the same day; ¥10bn set aside](https://www.thetechbag.com/blog/japan-cyber-package-same-day-reports) — the government’s response the same autumn