Short answer
Japan's Personal Information Protection Commission published figures on 28 October 2026 showing 2,094 leak cases from unauthorized access reported directly by businesses between 1 April and 16 October. Reports jumped to 830 in the first 16 days of October, and about 260 million people were affected or at risk.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Personal Information Protection Commission (PPC), Japan |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by authorities |
| Sector | Cross-sector regulator statistics |
| Country | Japan |
| Disclosed | 2026-10-28 |
| People or records affected | About 260 million people affected or at risk since 1 April 2026, with possible double counting. Figures are preliminary. |
What data was exposed
- Member and customer records from consumer services, such as names, addresses, phone numbers and email addresses
- In some cases identity documents, hashed passwords and partial card details (varies by incident)
What the PPC reported
Japan’s Personal Information Protection Commission (PPC) published figures on 28 October 2026 showing a sharp rise in leaks caused by unauthorized access, Business+IT reports. From 1 April to 16 October, businesses reported 2,094 cases directly to the PPC. The count excludes reports routed through ministries or government agencies and is preliminary.
The monthly trend is steep. ITmedia gives 235 reports in August and 303 in September. Business+IT says 830 arrived in the first 16 days of October, about 2.7 times September’s full-month total.
The scale
Business+IT reports that the number of people affected or at risk since April reached about 260 million, more than twice Japan’s population. The figure comes from the PPC and can include double counting, because one person’s data may sit in many leaks. The article also says 41 cases involved over one million people, 22 of them reported between 1 and 16 October.
ITmedia lists large incidents from July to October, including consumer apps, e-commerce sites and a mailing system. We cover several of them in separate posts, such as Bookoff and Times Car. The figures in the ITmedia text were partly garbled in our copy, so we do not repeat its per-company numbers here.
The government response
Business+IT lists a PPC warning on 7 October about large-scale leaks, a JPCERT/CC call for countermeasures on 8 October, a joint call by the National Cybersecurity Office and IPA on 9 October, and IPA guidance for individuals on 26 October. It also notes that attacks are spreading from consumer services to employee systems, admin tools and contractors’ systems.
Why this matters
The larger risk is secondary harm: scams, unauthorized transfers and fraudulent contracts that use stolen data. Business+IT advises people to be wary of phishing emails and SMS that use breach news as bait, to go to official sites instead of clicking, and to avoid reusing passwords.
Our guide to phishing messages shows how to check a link, and what to do after a data breach covers password changes and monitoring.
What we do not know
These are preliminary counts that cover cases up to 16 October. We have not seen the PPC’s own table, so the figures here rest on two news reports of it. See our editorial policy.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails and SMS that use breach news as bait and link to fake login pages
- List-type attacks that try one leaked password across many services
- Fake notices from outsourcing vendors you never dealt with directly
What to do if you are affected
- 01Do not click links in messages about a leak. Open the company's official app or website yourself.
- 02Stop reusing passwords. Start with email, online banking, brokerage, shopping and social media accounts.
- 03Be careful with notices from outsourcing vendors, since leaks often happen through services you did not sign up to directly.
- 04Turn on multi-factor authentication wherever it is offered.
- 05Read IPA's guidance for individuals on responding to leaks, published on 26 October.
Frequently asked questions
How many leak cases did Japan's PPC receive?
Business+IT and ITmedia report 2,094 unauthorized-access leak cases reported directly to the PPC from 1 April to 16 October 2026. The figures exclude reports routed through ministries and are preliminary.
How fast are reports rising?
Reports were 235 in August and 303 in September. In the first 16 days of October there were 830, about 2.7 times September's monthly total.
How many people are affected?
The PPC figures cited by both outlets put the total at about 260 million people affected or at risk since 1 April. That is more than twice Japan's population, and ITmedia notes the count can include double counting and later revisions.
How many cases involved over one million people?
Business+IT reports 41 cases involving more than one million people, 22 of them reported between 1 and 16 October.
What did government agencies do?
Business+IT lists a PPC warning on 7 October, a JPCERT/CC call for countermeasures on 8 October, a call from the National Cybersecurity Office and IPA on 9 October, and IPA guidance for individuals on 26 October.
Sources
- PPC figures on surging unauthorized-access leaks, and what individuals should do, Business+IT (SB Creative), 2026-10-30
- Information leaks reach 260 million people: companies hit by unauthorized access as of October, ITmedia, 2026-10-31
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.