Part 8 of a series on Japan’s cybersecurity blind spot. Start with the overview, Japan cyberattacks in 2026: what the breach wave reveals, or read the previous part, Nobody had to hack Japan’s earthquake warning.

Two scenes from this breach wave.

Yoshinoya, whose job applicants’ data leaked, has started blocking access to its systems from overseas IP addresses. Nikkei reported it as one of the emergency measures companies are taking, and FNN carried the same story. Meanwhile, after Times Car lost driving-licence images for about 1.6 million accounts, people lined up at licence centres around the country to get new licences.

A company and thousands of individuals, doing different things for the same reason. Something bad happened, and they did something. In both cases the something doesn’t change the outcome, because it was chosen without understanding how the harm actually happened. And in both cases it feels like protection, which is the dangerous part.

When you don’t know what failed, every fix is a guess

The IP block isn’t really the story. It’s just the measure Yoshinoya happened to pick.

Imagine the alternatives. Yoshinoya could have put a password on its website. It could have forced every customer account to reset its password, banned USB sticks in the office, bought a new firewall, or sent every employee to security training. Some of those are sensible things to do on an ordinary day. None of them would have stopped this breach, because none of them touches where the data actually was. A company that doesn’t understand how it was breached can choose any of these, announce it, and feel safer, without being any safer at all.

That’s the pattern this article is about. Not one bad measure, but a habit: responding to a breach with whatever is visible, available, and easy to explain, instead of finding out what failed and fixing that.

What actually leaked, and where

From April 2022 to June 2024, Yoshinoya and Hanamaru used a recruiting platform run by ApplyNow to take part-time job applications. Between 9 August and 7 September 2026, someone got into that platform through a vulnerability in a data analysis tool ApplyNow used, according to Yoshinoya’s own notice.

The leak covered 4,998 Yoshinoya applicants and 368 Hanamaru applicants (names, email addresses, phone numbers, birth dates, gender, and some addresses and occupations), plus 418 accounts belonging to Yoshinoya Group recruiting staff, with encrypted passwords. ApplyNow’s other customers were hit too. Kichiri Holdings, ApplyNow’s parent, disclosed that its platform also held My Number and bank account details for some users, and six city governments found that applicants to their staff exams were affected.

Yoshinoya says ApplyNow’s platform is separate from its own systems, and no unauthorized access to Yoshinoya’s systems has been confirmed. The data walked out of someone else’s database.

The breach started with a belief

The most important sentence in Yoshinoya’s notice isn’t about attackers. It’s about what the company thought was true.

The contract with ApplyNow ended in 2024. Yoshinoya says it understood, under ApplyNow’s terms of use, that applicant data would be deleted when the contract ended. It wasn’t. In the notice’s own words, ApplyNow’s actual practice was different from what Yoshinoya believed. Two years of former applicants’ details sat in a database Yoshinoya had stopped paying for and assumed was empty.

Nobody had to be dramatically negligent for that to happen. Someone read the terms, felt confident, and moved on. Nobody checked. The weak point wasn’t only a data analysis tool. It was the gap between what Yoshinoya believed about its data and what was actually true. Confidence without understanding caused the breach, and the response is more of the same.

Why the IP block is a guess

It guards a door the attacker didn’t use. The breach happened on a former vendor’s platform. Blocking foreign traffic to Yoshinoya’s own systems would not have stopped it, and won’t stop the next one if another vendor is still holding data it shouldn’t.

It assumes something nobody has shown. No attacker in this wave has been publicly identified, and the government says it does not know whether the incidents are connected. One reader under Nikkei’s article on Hatena noted he has been seeing unauthorized access from Japanese IP addresses since last spring.

It mistakes an IP address for a passport. Anyone can rent a server in Tokyo or route traffic through a compromised Japanese machine. The suspicious source addresses JPCERT/CC has published for this wave show attackers use whatever infrastructure works.

Geo-restriction isn’t worthless. JPCERT/CC lists it as a general measure where a service only serves a limited area. As one layer among others, fine. As the response to this breach, it’s a guess.

The same pattern, at the licence centre

Individuals are doing the same thing, for understandable reasons.

When Times Car disclosed that identity-document images for about 1.6 million accounts had been acquired, mostly driving licences, people started lining up to replace them. TV Asahi showed queues. Fukushima TV reported more than 20 reissues at one centre. Police told Jiji Press that offices around the country were fielding calls from people who wanted to “rewrite” their licence information, and almost every office agreed to reissue as a special case.

A long queue of people standing behind red rope barriers in the bright, modern lobby of the Kanagawa driver's licence centre
A queue at the Kanagawa driver's licence centre in May 2026, months before the leak. Photo: Nesnad, Wikimedia Commons, CC BY 4.0.

A reissued licence changes two things: the photo, and the final digit of the 12-digit licence number, which counts reissues. Your name, address, and birth date stay exactly the same, and those are already in the leaked images. Jiji reported that businesses checking ID can’t tell whether a licence has since been replaced, so the effect on fraud is limited. NHK reached the same conclusion. Applicants pay the fee themselves, about ¥1,500 to ¥2,700.

And reissuing is only one option on the same menu. Someone could also cancel their Times Car membership, delete the app, change their email address, or swear off car sharing. None of that pulls back an image that has already been taken. Times Car kept former members’ data for seven years, which is how people who had already left ended up in the leak in the first place.

KTS Kagoshima reports, in Japanese, on residents seeking advice and reissuing licences after the Times Car leak. Video: 大手企業の情報漏えい相次ぐ 鹿児島県内で相談や免許証の再交付も (26/10/08 18:38) from 鹿児島ニュースKTS.

I don’t blame anyone for reissuing. When your face and address are out there, doing something feels better than doing nothing. The risk is walking out with a new card, feeling protected, and then trusting the next convincing phone call a little more than you should. The protection that actually matters sits with the businesses checking ID. Police asked banks and others to tighten their checks, and from April 2027 they will have to read the IC chip in a My Number card or licence, so a leaked image alone will no longer be enough.

Why false confidence is the real danger

A response that misses the cause is worse than no response, because it closes the question.

The company announces a measure. Management reports that action has been taken. The press moves on. Customers feel reassured. Inside the company, the pressure to understand what happened, which vendors still hold what, and which assumptions nobody has verified quietly goes away. The organization is no safer than it was, but it believes it is, and that belief is the same kind that left two years of applicant data on someone else’s server.

The same thing happens to a person with a new licence. They’ve done the responsible thing, so they relax. The scam call that uses their leaked address and birth date doesn’t care what’s on the new card.

Security failures in this wave have mostly come from things organizations didn’t know about their own systems: APIs that answered questions they shouldn’t, tools nobody remembered were exposed, data nobody remembered was kept. Doing something visible, instead of finding out what you don’t know, sets up the next incident.

And it isn’t free

Misdirected fixes still cost something. Nikkei and FNN don’t say exactly which systems Yoshinoya’s block covers, but anything behind it now turns away everyone who looks foreign to a geo-block, which is not the same as attackers:

  • Visitors to Japan. Travel eSIMs often route traffic through another country, so a phone in Japan can show a non-Japanese IP address. One provider warns that its plans used in Japan get a foreign IP, so some Japanese payment and streaming services won’t work.
  • Japanese people abroad. Residents overseas, people on business trips, and anyone sending something home.
  • People on overseas-routed networks. Plenty of employees in Japan reach the internet through a corporate gateway in Singapore or Hong Kong.

When I checked from a server in Singapore on 17 October, Yoshinoya’s main website and holdings site loaded normally. Its official online shop returned a CloudFront error saying the distribution “is configured to block access from your country.” I can’t tell from outside whether that block is new or part of this measure, but it shows the experience on the wrong side of one: no explanation, no Japanese, no way through.

Nobody outside the company can measure the lost orders. The trade is the point: real customers pay a real cost, while an attacker who wants in pays roughly the price of a Japanese server. For individuals, the cost is smaller but just as real: a fee, a morning at the licence centre, and a false sense that the problem is handled.

One question before any response

Before announcing a fix, a company should be able to answer one question: would this have stopped what actually happened?

Answering it means knowing how the breach happened, where the data was, and who had it. If you can’t answer, you don’t have a fix yet. You have a guess, and the honest next step is to find out. For Yoshinoya, the answer points somewhere unglamorous:

  • Verify deletion, don’t assume it. Write deletion into the contract, ask for written confirmation when it ends, and check. Yoshinoya’s terms said the data would go. Nobody confirmed that it did.
  • Know which vendors hold your customers’ data. That includes former vendors, analytics tools, recruiting platforms, and anything a department signed up for with a company card.
  • Stop keeping what you don’t need. JPCERT/CC’s alert says it plainly: don’t keep data past its retention period or after its purpose is over.
  • Treat any single measure as a layer, and know what it costs. Geo-blocking, passwords, and new tools all have a place. Test who they block, and don’t present any of them as the answer.

Yoshinoya’s notice ends with roughly this list: review how it manages contractors, including contracts and regular audits, and tighten its vetting of SaaS products. That’s the right list. It deserves the headline more than the IP block does. It’s also the subject of Part 5 of this series: you outsourced the work, not the responsibility.

If you want to know what’s exposed

Everything above was invisible from inside the company until someone else found it. My external exposure check looks at up to three of your domains the way an outsider would, using only what anyone on the internet can already see: email authentication, DNS, your website platform and versions, public login pages, and certificates. No login attempts and no probing. You get a written report ranking what to fix first within five business days, and a 30-minute debrief. If the bigger question is which vendors hold what, the Diagnostics review maps that.

Sources