Public disclosures

Japan Cybersecurity Tracker

I keep a row for every organization in Japan that has published a notice about a cyber incident. This page is the whole sheet: the counts, the sectors and attack types, the analysis, the prefecture map, the searchable list of incidents, and the same incidents sorted by vendor, so you can see which suppliers the notices trace back to.

The figures are counts and sums of that sheet. The dataset page is the stable address to cite, and the CSV is available on request.

Updated 30 October 2026. Latest public notice: 30 October 2026.

At a glance

544

Incidents

Public notices in this list, one row each. 544 disclosing organizations.

375,417,904

Records affected

Headline figures from 196 rows. 132 rows already counted on a vendor row left out.

298

Hit through a vendor

54.8% of incidents

243

Breached directly

44.7%. 50 are the vendors themselves. 193 are other organizations.

60

Compromised vendors

Named in a public notice. Cases with no named vendor are listed separately.

Of the 298 incidents that came through a vendor, 269 name that vendor in their notice (90.3% of those 298). 8 were linked from other public evidence (2.7%). 21 do not name the vendor (7.0%). 3 incidents are unclear (0.6% of all incidents).

Latest

The newest notices in the sheet. Scroll sideways for more, or search the full list.

  1. 30 October 2026

    Ministry of Foreign Affairs (外務省) - internet-connected network

    ~3,600 (incl. ~900 non-MOFA staff)

    Account / email compromise · Government / public sector

  2. 30 October 2026

    Ryobi Systems (両備システムズ) - AITEL health-checkup booking system

    778 (4 client organisations)

    Account / email compromise · Healthcare / pharma

  3. 30 October 2026

    Ryohin Keikaku (良品計画) - MUJI app (MUJIアプリ)

    Up to ~27.26 million (incl. withdrawn members)

    Unauthorized access (method undisclosed) · Retail / e-commerce

  4. 30 October 2026

    West Japan Mitsubishi Motors Sales (西日本三菱自動車販売) - employee Microsoft 365 account

    Not disclosed

    Account / email compromise · Retail / e-commerce

  5. 30 October 2026

    World (ワールド) - subsidiary Tin Pan Array (ティンパンアレイ) business server

    ~1.2 million member records (gross/延べ; details under confirmation)

    Unauthorized access (method undisclosed) · Retail / e-commerce

  6. 29 October 2026

    All Nippon Airways (ANA / 全日空) - reservation records (Amadeus)

    ~37,800 people (bookings 2023-08-10 to 2026-09-23): ~36,100 booking no. + name; ~1,700 also passport info/phone

    Unauthorized access (method undisclosed) · Other

  7. 29 October 2026

    Cacco (かっこ) - X-log mail-delivery credentials

    Not disclosed

    Account / email compromise · IT / internet / SaaS

  8. 29 October 2026

    Chugoku Electric Power (中国電力) - ぐっとずっと。クラブ point-exchange deliveries (Sagawa Express)

    ~17,600 (incl. duplicates)

    Unauthorized access (method undisclosed) · Manufacturing / construction / utilities

Charts

Disclosures by week

Week starting Monday, from the sheet's disclosure week column.

  • 1 27 Jul
  • 1 10 Aug
  • 2 24 Aug
  • 1 31 Aug
  • 6 7 Sep
  • 9 14 Sep
  • 8 21 Sep
  • 31 28 Sep
  • 96 5 Oct
  • 112 12 Oct
  • 167 19 Oct
  • 107 26 Oct
  • 3 Not stated

Direct or through a vendor

Each bar is a count of incidents. The share uses all 544 incidents, rounded to one decimal place.

  • Hit through a vendor 298 (54.8%)
  • Breached directly 193 (35.5%)
  • Vendor breached itself 50 (9.2%)
  • Unclear 3 (0.6%)

Organizations listed per vendor

Each bar counts organizations that published their own notice about that vendor. The top 8 are shown; 30 more vendors have one or two organizations each. The last bar is organizations whose notice does not name the vendor. It is not a company.

Where the notices come from

Each tile is a prefecture, shaded by how many of the 544 notices came from an organization based there. Red dots are compromised vendors' head offices, sized by the organizations listed under them; a numbered dot stands for more than six. Hover a tile or dot for its figures.

42 of 47 prefectures have at least one notice. 3 organizations have no confirmed head office and sit under Not located. A notice is placed where the disclosing organization is based, not where the breached system ran.

  • 0
  • 1
  • 2 to 4
  • 5 to 9
  • 10 to 29
  • 30 or more
  • Vendor head office
Hokkaido: 7 notices, 1 vendor head office Hokkaido 7 Portus, Kushiro: 1 organization listed Aomori: 4 notices, 1 vendor head office Aomori 4 GETTIIS (Link Station), Aomori: 0 organizations listed Akita: 5 notices Akita 5 Iwate: 1 notice Iwate 1 Yamagata: 0 notices Yamagata 0 Miyagi: 6 notices Miyagi 6 Niigata: 5 notices Niigata 5 Fukushima: 3 notices Fukushima 3 Ishikawa: 1 notice Ishikawa 1 Toyama: 5 notices Toyama 5 Nagano: 6 notices Nagano 6 Gunma: 4 notices Gunma 4 Tochigi: 4 notices Tochigi 4 Shimane: 2 notices Shimane 2 Tottori: 1 notice Tottori 1 Fukui: 0 notices Fukui 0 Gifu: 1 notice Gifu 1 Yamanashi: 4 notices Yamanashi 4 Saitama: 11 notices, 1 vendor head office Saitama 11 Kobo (発車オーライネット), Kawaguchi: 0 organizations listed Ibaraki: 5 notices, 1 vendor head office Ibaraki 5 Busitec, Hitachinaka: 1 organization listed Hiroshima: 8 notices Hiroshima 8 Okayama: 3 notices, 1 vendor head office Okayama 3 AITEL (Ryobi Systems), Okayama: 0 organizations listed Hyogo: 5 notices Hyogo 5 Kyoto: 11 notices, 2 vendor head offices Kyoto 11 Sagawa Express, Kyoto: 9 organizations listed WASIMIL (AZOO), Kyoto: 1 organization listed Shiga: 0 notices Shiga 0 Aichi: 21 notices Aichi 21 Shizuoka: 13 notices Shizuoka 13 Tokyo: 290 notices Tokyo 290 42 vendor head offices in Tokyo. The vendor table under the map lists them. 42 Chiba: 5 notices Chiba 5 Yamaguchi: 4 notices Yamaguchi 4 Osaka: 35 notices, 5 vendor head offices Osaka 35 Arcadia, Minoh: 41 organizations listed WASABI SWITCH, Osaka: 3 organizations listed futureshop (own servers), Osaka: 1 organization listed Sakura Internet, Osaka: 1 organization listed DIGYM, Osaka: 0 organizations listed Nara: 0 notices Nara 0 Mie: 2 notices Mie 2 Kanagawa: 23 notices, 1 vendor head office Kanagawa 23 QLIFICA, Yokohama: 1 organization listed Wakayama: 1 notice Wakayama 1 Saga: 1 notice Saga 1 Fukuoka: 19 notices, 3 vendor head offices Fukuoka 19 Hotelier, Fukuoka: 1 organization listed Kaho Enterprise, Fukuoka: 1 organization listed GoWeb, Fukuoka: 0 organizations listed Oita: 3 notices Oita 3 Ehime: 3 notices Ehime 3 Kagawa: 3 notices Kagawa 3 Tokushima: 1 notice Tokushima 1 Nagasaki: 0 notices Nagasaki 0 Kumamoto: 1 notice Kumamoto 1 Miyazaki: 2 notices Miyazaki 2 Kochi: 3 notices Kochi 3 Kagoshima: 6 notices Kagoshima 6 Okinawa: 3 notices Okinawa 3

Notices by prefecture of the disclosing organization, busiest first. Same figures as the map.

Notices by prefecture, first half
Prefecture Notices Share Via vendor Direct
Tokyo 290 53.6% 130 160
Osaka 35 6.5% 16 19
Kanagawa 23 4.3% 17 6
Aichi 21 3.9% 16 5
Fukuoka 19 3.5% 12 7
Shizuoka 13 2.4% 9 4
Saitama 11 2.0% 6 5
Kyoto 11 2.0% 6 5
Hiroshima 8 1.5% 5 3
Hokkaido 7 1.3% 3 4
Miyagi 6 1.1% 5 1
Nagano 6 1.1% 4 2
Kagoshima 6 1.1% 6 0
Akita 5 0.9% 5 0
Niigata 5 0.9% 5 0
Toyama 5 0.9% 3 2
Ibaraki 5 0.9% 2 3
Hyogo 5 0.9% 2 3
Chiba 5 0.9% 3 2
Aomori 4 0.7% 3 1
Gunma 4 0.7% 3 1
Notices by prefecture, second half
Prefecture Notices Share Via vendor Direct
Tochigi 4 0.7% 4 0
Yamanashi 4 0.7% 3 1
Yamaguchi 4 0.7% 4 0
Fukushima 3 0.6% 3 0
Okayama 3 0.6% 2 1
Oita 3 0.6% 3 0
Ehime 3 0.6% 2 1
Kagawa 3 0.6% 2 1
Kochi 3 0.6% 3 0
Okinawa 3 0.6% 1 2
Shimane 2 0.4% 2 0
Mie 2 0.4% 1 1
Miyazaki 2 0.4% 2 0
Iwate 1 0.2% 0 1
Ishikawa 1 0.2% 0 1
Tottori 1 0.2% 0 1
Gifu 1 0.2% 1 0
Wakayama 1 0.2% 1 0
Saga 1 0.2% 1 0
Tokushima 1 0.2% 1 0
Kumamoto 1 0.2% 0 1
Not located 3 Left out Head office not confirmed

Vendor head offices by prefecture

58 of 60 named vendors are placed. The number after each vendor is the organizations listed under it.

Tokyo 42
Blastmail (Rakus Lite Cloud) 69 · Commune 39 · Studio 34 · Cuenote FC (Yumi Link) 19 · IDC Frontier 18 · Amadeus 3 · DIRIGIO 3 · Sankei Living Shimbun 3 · Scala Communications 3 · ApplyNow 2 · Arara Message 2 · Level Enter 2 · NEC (via unnamed contractor) 2 · Nikkei dev cloud 2 · palan (Metabase) 2 · Temairazu 2 · Commerble 1 · Cox (watch repair) 1 · Daiwa Institute of Research 1 · So-net 1 · SourceNext 1 · Star Platinum 1 · TradeWorks 1 · Value Card (Value Design) 1 · Y-mail (Igrex) 1 · ACCESS (CROS) 0 · CN Point (Clubnets) 0 · COMSBI (Sonicmoov) 0 · Digital Arts (cloud services) 0 · ELESTYLE (OneQR / elepay) 0 · Entouch (Toho HD) 0 · FaveConnect (Nippon TV Wands) 0 · Furusato Choice (Trust Bank) 0 · GMO Internet (お名前.com デスクトップクラウド) 0 · Hakuhodo (住宅省エネ2024 secretariat) 0 · KOMOJU 0 · OWNLY (Smartshare) 0 · PingCAP (TiDB Cloud) 0 · ShopServe (E-Store) 0 · TechnoHill (1FEdu) 0 · Travelzip 0 · VALTEC (MOT cloud services) 0
Fukuoka 3
Hotelier 1 · Kaho Enterprise 1 · GoWeb 0
Hokkaido 1
Portus 1
Ibaraki 1
Busitec 1
Kanagawa 1
QLIFICA 1
Okayama 1
AITEL (Ryobi Systems) 0
Not located 2
Forestec · Postscape (CVX)

Metrics

These charts use the same notices. Each one states how many incidents it uses (n) and how many it leaves as unknown. A missing date, the word Unknown, or a date that is not a single calendar day stays unknown.

Exposure type

Each incident is one published notice. n = 544. Unknown: 0. Shares use all 544 incidents.

  • Hit through a vendor 298 (54.8%)
  • Breached directly 193 (35.5%)
  • Vendor breached itself 50 (9.2%)
  • Unclear 3 (0.6%)

Attack type

These are broader descriptions than the wording in each notice. The downloadable list still quotes the notice. n = 544. Unknown: 0. Shares use all 544 incidents.

  • Unauthorized access (method undisclosed) 372 (68.4%)
  • Vulnerability / API / app-flaw exploit 72 (13.2%)
  • Account / email compromise 60 (11.0%)
  • Ransomware 32 (5.9%)
  • Malware (contractor PC) 3 (0.6%)
  • Outage (vendor incident) 3 (0.6%)
  • BEC / payment fraud 2 (0.4%)

Who reported first

First means the earliest report among the sources listed for that incident. n = 369. Unverified: 175. An incident stays unverified when that first report is not confirmed, including when two sources carry the same date. Shares use those 369 incidents.

  • Organization notice 332 (90.0%)
  • News outlet 29 (7.9%)
  • TDnet 8 (2.2%)

Industry groups

Each incident sits in one industry group. Other is one of those groups. The industry bars further down keep the words from the notices. n = 544. Unknown: 0. Shares use all 544 incidents.

  • Government / public sector 96 (17.6%)
  • IT / internet / SaaS 83 (15.3%)
  • Retail / e-commerce 66 (12.1%)
  • Media / entertainment 51 (9.4%)
  • Corporate community sites 38 (7.0%)
  • Education / research 35 (6.4%)
  • Other 35 (6.4%)
  • Finance / insurance 33 (6.1%)
  • Manufacturing / construction / utilities 28 (5.1%)
  • Transport / logistics 25 (4.6%)
  • Travel / hospitality / leisure 21 (3.9%)
  • Healthcare / pharma 19 (3.5%)
  • Restaurant / food service 14 (2.6%)

News outlets that reported first

These are the news outlets in the chart above, under the name written for each incident. n = 29. The share is of those incidents.

  • ITmedia 5 (17.2%)
  • Stock exchange filing (TDnet) 5 (17.2%)
  • NTV 3 (10.3%)
  • Asahi Shimbun 2 (6.9%)
  • Nikkei 2 (6.9%)
  • 2nd-rtl 1 (3.4%)
  • bankenjp 1 (3.4%)
  • FNN 1 (3.4%)
  • Japan Times 1 (3.4%)
  • KAB (TV Asahi network) 1 (3.4%)
  • NHK 1 (3.4%)
  • Okinawa Times 1 (3.4%)
  • piyolog 1 (3.4%)
  • RKC Kochi 1 (3.4%)
  • Sanyo Shimbun 1 (3.4%)
  • Yahoo! News 1 (3.4%)
  • Yomiuri 1 (3.4%)

Records named in the notices, by industry group

Each figure is the headline number in the notice, or the maximum when the notice gives a range. It is not a count of unique people. An incident already included in a vendor total is left out, so the same records are not added twice. n = 197. Unknown: 147. Left out because they are already in a vendor total: 200. The share is of the summed records (375,442,384).

No bar for Corporate community sites: those notices have no usable figure. They are in the unknown count.

  • IT / internet / SaaS 147,382,603 (39.3%)
  • Transport / logistics 67,334,619 (17.9%)
  • Retail / e-commerce 59,038,209 (15.7%)
  • Restaurant / food service 31,074,240 (8.3%)
  • Media / entertainment 27,972,624 (7.5%)
  • Travel / hospitality / leisure 23,066,475 (6.1%)
  • Finance / insurance 12,353,402 (3.3%)
  • Government / public sector 3,474,278 (0.9%)
  • Healthcare / pharma 1,856,627 (0.5%)
  • Manufacturing / construction / utilities 911,416 (0.2%)
  • Education / research 727,567 (0.2%)
  • Other 250,324 (0.1%)
Figures as a table
Records by industry group, same figures as the chart
Industry group Records Notices with a figure Notices with no figure
IT / internet / SaaS 147,382,603 39 27
Transport / logistics 67,334,619 14 7
Retail / e-commerce 59,038,209 32 20
Restaurant / food service 31,074,240 9 1
Media / entertainment 27,972,624 20 8
Travel / hospitality / leisure 23,066,475 11 6
Finance / insurance 12,353,402 14 10
Government / public sector 3,474,278 17 20
Healthcare / pharma 1,856,627 8 8
Manufacturing / construction / utilities 911,416 10 11
Education / research 727,567 14 14
Other 250,324 9 6
Corporate community sites 0 0 9

Disclosures by month

The month is the date the notice was published. n = 541. Unknown: 3. A month between the first and last dated notice is shown even when its count is zero.

0 249 498 Aug 2026: 4 notices 4 Aug 2026 Sep 2026: 39 notices 39 Sep 2026 Oct 2026: 498 notices 498 Oct 2026
Figures as a table
Disclosures by month, same figures as the chart
Month Incidents
Aug 2026 4
Sep 2026 39
Oct 2026 498
Unknown 3

Days from discovery to disclosure

This counts only when the notice gives one calendar day for when the incident was found, and a date for when it was published. n = 276. Unknown: 268. Median of those n incidents: 2 days. The share on each bar is of those n incidents.

  • 57 Same day
  • 182 1 to 7 days
  • 27 8 to 30 days
  • 7 31 to 90 days
  • 3 91 days or more

Days from attack start to disclosure

This counts only when the notice gives one calendar day for the start, or a range written as a start date, the word to, and an end date. The start date is used. n = 117. Unknown: 427. Median of those n incidents: 4 days. The share on each bar is of those n incidents.

  • 8 Same day
  • 73 1 to 7 days
  • 29 8 to 30 days
  • 6 31 to 90 days
  • 1 91 days or more

Industries named in the notices

These are the industry words from the notices. A label used at least 3 times has its own bar. Other stated industries is the count of labels used fewer than 3 times. Those labels are not merged into a broader sector. n = 542. Unknown: 2. Shares use all 544 incidents. Unknown means the notice left the industry blank, said Unknown, or said the industry was not stated.

  • Local government 65 (11.9%)
  • Various (community site) 13 (2.4%)
  • Education 12 (2.2%)
  • Law enforcement (prefectural police) 9 (1.7%)
  • Media 7 (1.3%)
  • Media (newspaper) 6 (1.1%)
  • Insurance 5 (0.9%)
  • Government 4 (0.7%)
  • Government (prefecture) 4 (0.7%)
  • Hospitality 4 (0.7%)
  • Manufacturing 4 (0.7%)
  • Media (publishing) 4 (0.7%)
  • Rail 4 (0.7%)
  • Retail (e-commerce) 4 (0.7%)
  • Central government 3 (0.6%)
  • Finance (securities) 3 (0.6%)
  • Food manufacturing (community site) 3 (0.6%)
  • Media (broadcasting) 3 (0.6%)
  • Postal / logistics 3 (0.6%)
  • Prefectural government 3 (0.6%)
  • Restaurant 3 (0.6%)
  • Restaurant (fast food) 3 (0.6%)
  • Retail (convenience store) 3 (0.6%)
  • Retail (electronics) 3 (0.6%)
  • Retail (luxury resale) 3 (0.6%)
  • SaaS (email delivery service) 3 (0.6%)
  • Other stated industries 361 (66.4%)

Named in multiple breaches

These organizations are named in two or more distinct incidents. A later update of the same incident counts once. Similar names that may be different companies are not combined. 28 organizations are on this list. Uncombined names are left out.

  • Kyoto City (京都市) 3 incidents
    • 14 October 2026. Through Arcadia. Disaster info distribution.
    • 16 October 2026. Through Studio. Commissioned culture programmes (Studio).
    • 22 October 2026. Through Blastmail (Rakus Lite Cloud). WMG2027 Kyoto-area volunteers (via Kanko).
  • Saitama Prefecture (埼玉県) 3 incidents
    • 7 October 2026. Breached directly. Shibusawa MIX.
    • 16 October 2026. Through Studio. さいたま緑の森博物館.
    • 20 October 2026. Through Cuenote FC (Yumi Link). ぷらっとさいたま smart-farming site (Cuenote FC).
  • Chiba Prefecture (千葉県) 2 incidents
    • 20 October 2026. Through Studio. Commissioned programmes (Studio).
    • 27 October 2026. Breached directly. 7 prefectural high schools' email accounts.
  • City of Nagoya (名古屋市) 2 incidents
    • 9 October 2026. Through Commune. なごや学生プラットフォーム.
    • 14 October 2026. Through Arcadia. Net119 emergency-call system (Arcadia).
  • Digital Agency (デジタル庁) 2 incidents
    • 11 September 2026. Unclear from the notice. Government Solution Service (GSS) - shared IT environment for ministries; file server accessed.
    • 22 October 2026. Through Studio. Website forms via Studio.
  • FutureShop (フューチャーショップ) 2 incidents
    • 8 October 2026. Through IDC Frontier. Mail delivery service on IDCF Cloud.
    • 21 October 2026. Breached directly. Own EC servers (c02, c05, c12, g06).
  • Japan Post (日本郵便) 2 incidents
    • 25 September 2026. Breached directly. International mail inquiry web service.
    • 29 October 2026. Through Unidentified vendor. International Mail My Page mail magazine.
  • Japan Post (日本郵政) 2 incidents
    • 29 September 2026. Breached directly. Post Office app.
    • 19 October 2026. Breached directly. ゆうID / ゆうゆうポイント site.
  • JETRO (日本貿易振興機構 / ジェトロ) 2 incidents
    • 19 October 2026. Breached directly. Website.
    • 27 October 2026. Through Unidentified vendor. E-Venue business matching.
  • KOMOJU (株式会社KOMOJU) 2 incidents
    • 22 October 2026. Breached directly. KOMOJU payment platform.
    • 26 October 2026. Breached directly. CRM (2nd report).
  • Koriyama City (郡山市) 2 incidents
    • 14 October 2026. Through Arcadia. Disaster/safety alert email service (outsourced).
    • 23 October 2026. Through Studio. Commissioned project sites via Studio.
  • Lawson (ローソン) 2 incidents
    • 8 October 2026. Breached directly. Lawson ID & Lawson app reservation.
    • 26 October 2026. Through Unidentified vendor. App reservation store search (contractor).
  • M3 (エムスリー) 2 incidents
    • 15 October 2026. Breached directly. MR君.
    • 21 October 2026. Through Studio. M3PSP / 1人1円ファンド website forms (Studio).
  • Miyazaki Prefecture (宮崎県) 2 incidents
    • 13 October 2026. Through Arcadia. Disaster/safety alert email service (outsourced).
    • 27 October 2026. Through palan (Metabase). AR tourism project (palan).
  • Nikkei (日本経済新聞社) 2 incidents
    • 4 October 2026. Breached directly. Employee Microsoft 365 account; Google Workspace account; cloud service.
    • 16 October 2026. Breached directly. Development cloud service (2nd incident).
  • Nikkei BP (日経BP) 2 incidents
    • 4 October 2026. Breached directly. Employee email account.
    • 17 October 2026. Through Nikkei dev cloud. Users affected by Nikkei dev-cloud incident.
  • NTT Docomo (NTTドコモ) 2 incidents
    • 8 October 2026. Through IDC Frontier. Kids web-filtering feature.
    • 27 October 2026. Through So-net. Docomo Hikari plala (S-course) members (So-net).
  • Oita Prefecture (大分県) 2 incidents
    • 13 October 2026. Through Arcadia. Disaster/safety alert email service (outsourced).
    • 21 October 2026. Through Blastmail (Rakus Lite Cloud). おおいた子育て応援パスポート (via QTmedia).
  • Okinawa Prefecture (沖縄県) 2 incidents
    • 22 October 2026. Breached directly. 行政資料目録システム.
    • 29 October 2026. Through Arara Message. 島まーる mail magazine (Arara Message).
  • Recruit (リクルート) 2 incidents
    • 3 October 2026. Breached directly. StudySapuri.
    • 17 October 2026. Breached directly. Carsensor (カーセンサー).
  • Sally (株式会社Sally) 2 incidents
    • 21 October 2026. Breached directly. Ūzu (ウズ) inquiry-management system.
    • 21 October 2026. Through Studio. Website forms (Studio).
  • Setagaya Ward (世田谷区) 2 incidents
    • 13 October 2026. Through Arcadia. Disaster/safety alert email service (outsourced).
    • 23 October 2026. Through Blastmail (Rakus Lite Cloud). STEAM education course mail (via Shogakukan Shueisha Productions).
  • Tohoku Electric Frontier (東北電力フロンティア) 2 incidents
    • 17 October 2026. Through Studio. Event-related website inquiry forms on Studio (5 sites).
    • 22 October 2026. Through Blastmail (Rakus Lite Cloud). Eポイントモール mail (via ADDIX).
  • Tokyo Metro (東京メトロ) 2 incidents
    • 26 September 2026. Through Unidentified vendor. Metopo (Metro Point Club) member email delivery service (contractor server).
    • 23 October 2026. Through Blastmail (Rakus Lite Cloud). Event mail magazine.
  • Uzabase (ユーザベース) 2 incidents
    • 8 October 2026. Breached directly. NewsPicks admin/business management tool.
    • 19 October 2026. Through Studio. Website contact form (Studio).
  • Valuence Japan (バリュエンスジャパン) 2 incidents
    • 21 October 2026. Through WASABI SWITCH. ALLU external-mall orders (WASABI SWITCH).
    • 21 October 2026. Breached directly. なんぼや online purchase system.
  • Yamada Denki (ヤマダデンキ) 2 incidents
    • 8 October 2026. Through IDC Frontier. ヤマダゲーム etc..
    • 23 October 2026. Breached directly. ヤマダビデオ / スマホゴールド会員 procedure screens.
  • Yokosuka City (横須賀市) 2 incidents
    • 7 October 2026. Through Sagawa Express. Furusato nozei.
    • 13 October 2026. Through Arcadia. Disaster/safety alert email service (outsourced).

Analysis

These charts are counted from the same notices when the site is built, so a refresh of the sheet updates them. Each caption says what is included and what is left out.

Vendor concentration

Each bar counts organizations that published a notice naming that vendor. The top 8 named vendors account for 232 of 277 notices that name a vendor (83.8%). Notices that do not name a vendor (21) are left out of that share.

  • Blastmail (Rakus Lite Cloud) 69 (24.9%)
  • Arcadia 41 (14.8%)
  • Commune 39 (14.1%)
  • Studio 34 (12.3%)
  • Cuenote FC (Yumi Link) 19 (6.9%)
  • IDC Frontier 18 (6.5%)
  • Sagawa Express 9 (3.2%)
  • Amadeus 3 (1.1%)
  • Other named vendors 45 (16.2%)

Incidents by region

Each notice is counted in the region of the organization's head office, running from north to south. This is where the organization is based. n = 541. Head office not located: 3. Shares use all 544 notices.

  • Hokkaido 7 (1.3%)
  • Tohoku 19 (3.5%)
  • Kanto 342 (62.9%)
  • Chubu 56 (10.3%)
  • Kansai 54 (9.9%)
  • Chugoku 18 (3.3%)
  • Shikoku 10 (1.8%)
  • Kyushu 32 (5.9%)
  • Okinawa 3 (0.6%)
  • Head office not located 3 (0.6%)

Local governments affected

Prefectures, municipalities, and prefectural police forces that published their own notice. National ministries and agencies are not included. n = 94 (17.3% of all 544 notices). A larger number written in a vendor's notice is not added here.

  • Municipalities 72 (13.2%)
  • Prefectures 12 (2.2%)
  • Prefectural police 10 (1.8%)

Industries

Industry groups as written in the sheet. Other is one of those groups. n = 544. Not stated: 0. Shares use all 544 notices.

  • Government / public sector 96 (17.6%)
  • IT / internet / SaaS 83 (15.3%)
  • Retail / e-commerce 66 (12.1%)
  • Media / entertainment 51 (9.4%)
  • Corporate community sites 38 (7.0%)
  • Education / research 35 (6.4%)
  • Other 35 (6.4%)
  • Finance / insurance 33 (6.1%)
  • Manufacturing / construction / utilities 28 (5.1%)
  • Transport / logistics 25 (4.6%)
  • Travel / hospitality / leisure 21 (3.9%)
  • Healthcare / pharma 19 (3.5%)
  • Restaurant / food service 14 (2.6%)

Disclosure speed

Days from the date the incident was found to the date the notice was published. Counted only when both dates are a single calendar day. A notice dated before that discovery day is left out as a bad date. It is not its own bar. n = 276. Not counted: 268. Median of those n notices: 2 days. The share on each bar is of those n notices.

  • Same day 57 (20.7%)
  • 1 to 7 days 182 (65.9%)
  • 8 to 30 days 27 (9.8%)
  • 31 to 90 days 7 (2.5%)
  • 91 days or more 3 (1.1%)

How attackers got in

The attack type the notice gives. Method not disclosed means the notice said unauthorized access and did not say how. n = 544. Not stated: 0. Shares use all 544 notices, including notices that do not state a type.

  • Unauthorized access (method undisclosed) 372 (68.4%)
  • Vulnerability / API / app-flaw exploit 72 (13.2%)
  • Account / email compromise 60 (11.0%)
  • Ransomware 32 (5.9%)
  • Malware (contractor PC) 3 (0.6%)
  • Outage (vendor incident) 3 (0.6%)
  • BEC / payment fraud 2 (0.4%)

Data types exposed

Kinds of data the notice says were exposed. One notice can name more than one kind, so these shares can add up to more than the whole. A line that says no password, no card, or no My Number is not counted as that kind. Notices that name at least one kind: 399. Not stated: 145. Shares use all 544 notices.

  • Email 348 (64.0%)
  • Name 288 (52.9%)
  • Phone 171 (31.4%)
  • Date of birth 69 (12.7%)
  • Password or login 46 (8.5%)
  • Payment or bank account 25 (4.6%)
  • Identity document 12 (2.2%)
  • Address 6 (1.1%)
  • Not stated 145 (26.7%)

Weekly trend

Notices by the week they were published. The week starts on Monday, counted from the disclosure date. n = 541. No usable date: 3.

  • 1 27 Jul
  • 0 3 Aug
  • 1 10 Aug
  • 0 17 Aug
  • 2 24 Aug
  • 1 31 Aug
  • 6 7 Sep
  • 9 14 Sep
  • 8 21 Sep
  • 31 28 Sep
  • 96 5 Oct
  • 112 12 Oct
  • 167 19 Oct
  • 107 26 Oct

Incidents

One row per notice, newest first, or the same notices grouped under the vendor they trace back to.

25 of 544 shown

Disclosed incidents from the sheet
Organization Disclosed Sector Attack type Records Sources
Ministry of Foreign Affairs (外務省) - internet-connected network 30 October 2026 Government / public sector Account / email compromise ~3,600 (incl. ~900 non-MOFA staff)
Details for Ministry of Foreign Affairs (外務省) - internet-connected network
System
MOFA network that can communicate externally (consular systems for passports / Tabireg not affected)
Industry
Government (national ministry)
Attack window
Unknown
Discovered
27 July 2026
How it was hit
Directly compromised
Third party
No (direct)
Data exposed
Names, email addresses etc. No highly confidential information confirmed
Status
Access blocked; credentials invalidated; investigated with external specialists; no secondary harm confirmed
Notes
Medium-High (multiple outlets citing MOFA announcement; MOFA web notice not located)
Attacker claims
Not reported in sources
Ryobi Systems (両備システムズ) - AITEL health-checkup booking system 30 October 2026 Healthcare / pharma Account / email compromise 778 (4 client organisations)
Details for Ryobi Systems (両備システムズ) - AITEL health-checkup booking system
System
AITEL health-checkup reservation system
Industry
IT services (healthcare SaaS)
Attack window
Unknown
Discovered
27 October 2026
How it was hit
Directly compromised (vendor)
Third party
Vendor itself
Downstream victims
4 client organisations (3 groups, 5 records; 1 group, 773 records), none named
Data exposed
Name, kana, gender, DOB; for 5 also phone, email, address, booking; for 773 email (728). No medical data
Status
Abused function and accounts stopped; system-wide check; police and ministries consulted
Notes
High (official notice). Single source
Attacker claims
Not reported in sources
Ryohin Keikaku (良品計画) - MUJI app (MUJIアプリ) 30 October 2026 Retail / e-commerce Unauthorized access (method undisclosed) Up to ~27.26 million (incl. withdrawn members)
Details for Ryohin Keikaku (良品計画) - MUJI app (MUJIアプリ)
System
Official MUJI app
Industry
Retail (apparel / household goods)
Attack window
Unknown
Discovered
Unknown
How it was hit
Directly compromised
Third party
No (direct)
Data exposed
Email address, date of birth, gender. No card data, name, address or phone
Status
Access blocked and fix applied; no dark-web posting or misuse confirmed; affected customers to be contacted; app and net store operating normally
Notes
High (official notice). 'Possible' leak; cause not stated
Attacker claims
Not reported in sources
West Japan Mitsubishi Motors Sales (西日本三菱自動車販売) - employee Microsoft 365 account 30 October 2026 Retail / e-commerce Account / email compromise Not disclosed
Details for West Japan Mitsubishi Motors Sales (西日本三菱自動車販売) - employee Microsoft 365 account
System
Employee Microsoft 365 mail account
Industry
Retail (auto dealer)
Attack window
Unknown
Discovered
Unknown
How it was hit
Directly compromised
Third party
No (direct)
Data exposed
Customer names, addresses, vehicle info in emails
Status
All account passwords changed; PPC notified
Notes
High (official notice + Mitsubishi Motors summary)
Attacker claims
Not reported in sources
World (ワールド) - subsidiary Tin Pan Array (ティンパンアレイ) business server 30 October 2026 Retail / e-commerce Unauthorized access (method undisclosed) ~1.2 million member records (gross/延べ; details under confirmation)
Details for World (ワールド) - subsidiary Tin Pan Array (ティンパンアレイ) business server
System
Tin Pan Array business server holding member data
Industry
Retail (apparel group subsidiary)
Attack window
2026-10-17 14:51
Discovered
28 October 2026
How it was hit
Directly compromised
Third party
No (direct)
Data exposed
Name, address, phone, date of birth, gender, email. No card/payment data or face data confirmed leaked
Status
Server isolated 10-28 12:08; access path cut by 21:36; some internal systems stopped; police and PPC notified 10-29; external experts to investigate
Notes
High (TDnet disclosure). Count is gross (延べ)
Attacker claims
Not reported in sources
All Nippon Airways (ANA / 全日空) - reservation records (Amadeus) 29 October 2026 Other Unauthorized access (method undisclosed) ~37,800 people (bookings 2023-08-10 to 2026-09-23): ~36,100 booking no. + name; ~1,700 also passport info/phone
Details for All Nippon Airways (ANA / 全日空) - reservation records (Amadeus)
System
Passenger service system operated by Amadeus
Industry
Airline
Attack window
Unknown (vendor incident)
Discovered
20 October 2026
How it was hit
Downstream (via vendor)
Third party
Yes (via third party)
Vendor
Amadeus (Spain)
Vendor link
Confirmed
Data exposed
Booking number, name; for ~1,700 passport information and phone number. No card data or passwords
Status
Investigating with Amadeus; affected customers to be contacted
Notes
High (multiple broadcasters reporting ANA statement); ANA notice URL not located
Attacker claims
Not reported in sources
Cacco (かっこ) - X-log mail-delivery credentials 29 October 2026 IT / internet / SaaS Account / email compromise Not disclosed
Details for Cacco (かっこ) - X-log mail-delivery credentials
System
Mail-delivery service credentials used by X-log
Industry
IT (fraud detection)
Attack window
2026-10-08 to 2026-10-13
Discovered
Unknown
How it was hit
Directly compromised
Third party
Yes (via third party)
Vendor
Unnamed mail-delivery service
Vendor link
Unknown
Data exposed
No personal-data leak or X-log intrusion found
Status
Credentials reissued; senders restricted
Notes
High (official notice). No leak confirmed
Attacker claims
Not reported in sources
Chugoku Electric Power (中国電力) - ぐっとずっと。クラブ point-exchange deliveries (Sagawa Express) 29 October 2026 Manufacturing / construction / utilities Unauthorized access (method undisclosed) ~17,600 (incl. duplicates)
Details for Chugoku Electric Power (中国電力) - ぐっとずっと。クラブ point-exchange deliveries (Sagawa Express)
System
Energia Point goods deliveries via contractor using Sagawa
Industry
Utility (electric power)
Attack window
2026-06-21 to 2026-09-30 (shipments)
Discovered
Unknown
How it was hit
Downstream (via vendor)
Third party
Yes (via third party)
Vendor
Sagawa Express
Vendor link
Confirmed
Data exposed
Delivery name, address, phone
Status
Members to be notified; no misuse confirmed
Notes
High (official notice)
Attacker claims
Not reported in sources
Clubnets (クラブネッツ) - CNポイント satellite systems 29 October 2026 IT / internet / SaaS Unauthorized access (method undisclosed) 19,793 (16,936 ID+name; 2,857 ID+name+email+phone+address; separate DBs)
Details for Clubnets (クラブネッツ) - CNポイント satellite systems
System
CN Exchange, CN Contents, CN Monitor (satellite systems)
Industry
Loyalty points / marketing services
Attack window
No
Discovered
29 October 2026
How it was hit
Directly compromised (vendor)
Third party
Vendor itself
Downstream victims
CN Point participating merchants (none named)
Data exposed
CN member ID, name; for 2,857 also email, phone, address. No passwords
Status
CN Exchange/Contents/Monitor stopped Oct 29; core CN Point system running; restart TBD
Notes
High (official notice). Single source; counts are unique per DB, may overlap
Attacker claims
Not reported in sources
ELESTYLE (ELESTYLE株式会社) - OneQR / elepay merchant admin 29 October 2026 Finance / insurance Unauthorized access (method undisclosed) 7,162 merchant registrations
Details for ELESTYLE (ELESTYLE株式会社) - OneQR / elepay merchant admin
System
Merchant management system (access-control flaw)
Industry
Fintech (QR/mobile payment platform)
Attack window
No
Discovered
25 October 2026
How it was hit
Directly compromised (vendor)
Third party
Vendor itself
Downstream victims
Merchants of OneQR/elepay (none named)
Data exposed
Username (company or personal name), email, internal IDs. No passwords, card, bank, transaction or end-user data
Status
Access blocked 2026-10-25; flaw fixed 2026-10-27; PPC notified; merchants contacted individually
Notes
High (official notice). Single source
Attacker claims
Not reported in sources
Goods (株式会社グッズ) - former online shop goods-co.net 29 October 2026 Retail / e-commerce Unauthorized access (method undisclosed) ~19,000 registered members (non-member orderers under investigation)
Details for Goods (株式会社グッズ) - former online shop goods-co.net
System
Former online shop server (goods-co.net)
Industry
Retail (e-commerce, DIY goods)
Attack window
Unknown
Discovered
22 October 2026
How it was hit
Directly compromised
Third party
No (direct)
Data exposed
Name, kana, address, phone, fax, email, gender, occupation, DOB, dealer company info, purchase history, old-site password (transformed). No card data held
Status
Old site stopped 10-23 and not restarted; new shop launched 10-28; customers emailed from 10-29
Notes
High (official notice). Single source; exfiltration not confirmed
Attacker claims
Not reported in sources
Iris Plaza (アイリスプラザ, Iris Ohyama group) - official EC site 29 October 2026 Retail / e-commerce Unauthorized access (method undisclosed) Under investigation
Details for Iris Plaza (アイリスプラザ, Iris Ohyama group) - official EC site
System
アイリスプラザ official online shop
Industry
Retail (e-commerce)
Attack window
Unknown
Discovered
Unknown
How it was hit
Directly compromised
Third party
No (direct)
Data exposed
Under investigation; no card data leak confirmed so far
Status
Site temporarily stopped; investigation ongoing
Notes
High (official notice). No leak confirmed yet
Attacker claims
Not reported in sources
Japan Post (日本郵便) - International Mail My Page mail magazine 29 October 2026 Transport / logistics Unauthorized access (method undisclosed) Not disclosed (some opted-in members)
Details for Japan Post (日本郵便) - International Mail My Page mail magazine
System
Mail-magazine delivery by contractor (International Mail My Page members opted in)
Industry
Postal / logistics
Attack window
Unknown (vendor incident)
Discovered
Unknown
How it was hit
Downstream (via vendor)
Third party
Yes (via third party)
Vendor
Unnamed mail-magazine contractor
Vendor link
Confirmed
Data exposed
Email addresses only (My Page itself not breached)
Status
Contractor's mail service stopped; investigating
Notes
High (official notice). Vendor not named (do not assume Arara/Blastmail)
Attacker claims
Not reported in sources
Kanagawa Prefecture (神奈川県) - 温カナ!news mail magazine (Blastmail) 29 October 2026 Government / public sector Unauthorized access (method undisclosed) ~7,800 email addresses
Details for Kanagawa Prefecture (神奈川県) - 温カナ!news mail magazine (Blastmail)
System
Mail magazine sent by contractor Kanagawa Agenda Promotion Center via Blastmail
Industry
Government (prefecture)
Attack window
Unknown (vendor incident)
Discovered
Unknown
How it was hit
Downstream (via vendor)
Third party
Yes (via third party)
Vendor
Blastmail (Rakus Lite Cloud)
Vendor link
Confirmed
Data exposed
Email addresses (other items under confirmation)
Status
Collecting info via contractor; subscribers warned
Notes
High (official notice)
Attacker claims
Not reported in sources
Matsuya Foods (松屋フーズ) - official app and ordering services 29 October 2026 Restaurant / food service Unauthorized access (method undisclosed) 2,377,127 Matsuben Net / mobile order / delivery users + ~2,000 (up to 3,000) app members possibly leaked (TDnet 2026-10-30)
Details for Matsuya Foods (松屋フーズ) - official app and ordering services
System
Official app, Matsuben Net, mobile order, delivery, website
Industry
Restaurant (fast food)
Attack window
Unknown
Discovered
28 October 2026
How it was hit
Directly compromised
Third party
Unknown
Data exposed
Matsuben Net/mobile order/delivery: ID, address, name, phone, points. App members: ID, prefecture, name, phone, DOB, email, encrypted password, points
Status
Multiple services stopped; investigation ongoing; compensation planned (TDnet 2026-10-30)
Notes
High (TDnet filing). Earlier 'no leak confirmed' superseded
Attacker claims
Not reported in sources
Okinawa Prefecture (沖縄県) - 島まーる mail magazine (Arara Message) 29 October 2026 Government / public sector Unauthorized access (method undisclosed) 2,560 email addresses
Details for Okinawa Prefecture (沖縄県) - 島まーる mail magazine (Arara Message)
System
Remote-island volunteer tour mail magazine sent by contractor JV via Arara Message
Industry
Government (prefecture)
Attack window
Unknown (vendor incident)
Discovered
Unknown
How it was hit
Downstream (via vendor)
Third party
Yes (via third party)
Vendor
Arara Message
Vendor link
Confirmed
Data exposed
Email addresses only (no names)
Status
Members warned of phishing
Notes
High (official notice)
Attacker claims
Not reported in sources
PIECE (株式会社PIECE) - PIECE HOSTEL SANJO guest data (WASIMIL) 29 October 2026 Travel / hospitality / leisure Unauthorized access (method undisclosed) Not disclosed (guests who booked on or before 2026-10-19)
Details for PIECE (株式会社PIECE) - PIECE HOSTEL SANJO guest data (WASIMIL)
System
Hotel management system WASIMIL (AZOO)
Industry
Hospitality (hostel)
Attack window
Unknown (vendor incident)
Discovered
19 October 2026
How it was hit
Downstream (via vendor)
Third party
Yes (via third party)
Vendor
AZOO (WASIMIL)
Vendor link
Confirmed
Data exposed
Name, gender, age, DOB, nationality, email, phone, address, emergency contact, reservation details, passport number, online check-in data. No card data
Status
Guests warned about fake payment/card requests; vendor fixed flaw. Separate from the 2026-10-13 Booking.com admin takeover (row 515)
Notes
High (official notice). 漏洩ナビ says 2 PIECE facilities affected; notice fetched covers PIECE HOSTEL SANJO
Attacker claims
Not reported in sources
PMDA (医薬品医療機器総合機構) - DWAP medical-device web application platform 29 October 2026 Government / public sector Vulnerability / API / app-flaw exploit None (no leak, tampering or destruction found)
Details for PMDA (医薬品医療機器総合機構) - DWAP medical-device web application platform
System
DWAP medical-device web application platform
Industry
Government (regulatory agency)
Attack window
2026-10-23 to 2026-10-26
Discovered
Unknown
How it was hit
Directly compromised
Third party
No (direct)
Data exposed
No data leak found
Status
DWAP stopped until further notice; applicants directed to MHLW FD application software
Notes
High (official notice). No leak confirmed
Attacker claims
Not reported in sources
WOWOW - prize / programme-guide deliveries (Sagawa Express) 29 October 2026 Media / entertainment Unauthorized access (method undisclosed) 200
Details for WOWOW - prize / programme-guide deliveries (Sagawa Express)
System
Deliveries via contractor using Sagawa e-Hiden waybill system
Industry
Media (broadcasting)
Attack window
2026-06 to 2026-09 (shipments)
Discovered
Unknown
How it was hit
Downstream (via vendor)
Third party
Yes (via third party)
Vendor
Sagawa Express
Vendor link
Confirmed
Data exposed
Name, address, phone. No card, bank or password data
Status
Investigation by Sagawa ongoing; customers warned
Notes
High (official notice)
Attacker claims
Not reported in sources
AKB48 Mail app (BEENOS Entertainment / DH) 28 October 2026 Media / entertainment Unauthorized access (method undisclosed) None confirmed
Details for AKB48 Mail app (BEENOS Entertainment / DH)
System
AKB48 Mail app version servers
Industry
Media / entertainment (fan app)
Attack window
Unknown
Discovered
28 October 2026
How it was hit
Directly compromised
Third party
No (direct)
Data exposed
No leak traces confirmed so far
Status
Server connections cut from ~11:00 10-28; app was already due to close 2026-11-30
Notes
Medium-High (official AKB48 blog). Single source; no leak confirmed. Separate from Blastmail shop mail (row 421)
Attacker claims
Not reported in sources
Animate (アニメイト) - online shop and Pocket Drama CD mail (Cuenote FC) 28 October 2026 Retail / e-commerce Unauthorized access (method undisclosed) Count not disclosed
Details for Animate (アニメイト) - online shop and Pocket Drama CD mail (Cuenote FC)
System
Mail-magazine subscribers
Industry
Retail (anime goods)
Attack window
Unknown (vendor incident; Yumi Link confirmed access 2026-10-16)
Discovered
26 October 2026
How it was hit
Downstream (via vendor)
Third party
Yes (via third party)
Vendor
Yumi Link (Cuenote FC)
Vendor link
Confirmed
Data exposed
Email, gender, prefecture, Animate member code
Status
Vendor first said no impact (10-20), then data viewed/taken (10-27)
Notes
High (official notice)
Attacker claims
Not reported in sources
Arara (アララ) - Arara Message email delivery service 28 October 2026 IT / internet / SaaS Unauthorized access (method undisclosed) ~3.01M email addresses (recipient lists)
Details for Arara (アララ) - Arara Message email delivery service
System
Arara Message delivery environment bvam001
Industry
SaaS (email delivery service)
Attack window
Unknown
Discovered
28 October 2026
How it was hit
Directly compromised (vendor)
Third party
Vendor itself
Downstream victims
Payどん (Kagoshima Bank and 3 other Kagoshima lenders; separate row); Okinawa Pref. 島まーる 2,560 (row 545); per-client impact under investigation
Data exposed
End-user email addresses only (per vendor)
Status
Affected environment stopped 2026-10-28 17:23; restart TBD
Notes
High (official vendor notice)
Attacker claims
Not reported in sources
B-R Thirty One Ice Cream (Baskin-Robbins Japan / B-R サーティワン) - 31 Mobile Order (DIRIGIO) 28 October 2026 Restaurant / food service Unauthorized access (method undisclosed) Up to 8,174 customers; 9,799 orders; 190 stores
Details for B-R Thirty One Ice Cream (Baskin-Robbins Japan / B-R サーティワン) - 31 Mobile Order (DIRIGIO)
System
31 Mobile Order service provided by DIRIGIO (separate from 31Club app)
Industry
Restaurant (ice cream)
Attack window
Unknown (vendor incident)
Discovered
27 October 2026
How it was hit
Downstream (via vendor)
Third party
Yes (via third party)
Vendor
DIRIGIO
Vendor link
Confirmed
Data exposed
Email, phone, name, 31Club member ID; delivery address for 1 customer. No card data or passwords
Status
Affected customers being notified; PPC report
Notes
High (official notice)
Attacker claims
Not reported in sources
Benefit One (ベネフィット・ワン) - トク買 for Credit Saison members (Forestec) 28 October 2026 Other Unauthorized access (method undisclosed) 29,465 people
Details for Benefit One (ベネフィット・ワン) - トク買 for Credit Saison members (Forestec)
System
トク買 discount service for Credit Saison cardholders, operated via contractor Forestec
Industry
Membership services
Attack window
2026-10-14 13:45 to 2026-10-20 14:05
Discovered
20 October 2026
How it was hit
Downstream (via vendor)
Third party
Yes (via third party)
Vendor
Forestec (フォレステック)
Vendor link
Confirmed
Data exposed
Name, kana, date of birth, gender, postcode, email, customer number, membership data, fee-payment management number; some payment-link authentication data
Status
Service stopped 2026-10-21 17:00; restart TBD
Notes
High (official notice)
Attacker claims
Not reported in sources
Better Home Association (ベターホーム協会) - mail order newsletter (Blastmail) 28 October 2026 Education / research Unauthorized access (method undisclosed) 7,015 email addresses
Details for Better Home Association (ベターホーム協会) - mail order newsletter (Blastmail)
System
Mail-order newsletter
Industry
Education (cooking school)
Attack window
Unknown (vendor incident)
Discovered
21 October 2026
How it was hit
Downstream (via vendor)
Third party
Yes (via third party)
Vendor
Blastmail (Rakus Lite Cloud)
Vendor link
Confirmed
Data exposed
Email only
Status
Leak confirmed
Notes
High (official notice)
Attacker claims
Not reported in sources

The data

The CSV behind this page lists all 544 incidents: organization, sector, disclosure date, attack type, records affected, how the organization was hit, the vendor if one is named, how that vendor was identified, and links to the notices. It is sent on request, not downloaded, so I know where it goes. Say what you plan to do with it and I will send the current release.

Source: Japan Cybersecurity Tracker, Matthew Ketchum, mkultraman.com

Request the CSV

For the dated summary figures, full citation formats, licence and release history, use the dataset page. That is the stable address to cite.

How the counts work, and what they leave out

Incident count is the number of rows. Organizations affected is the number of disclosing organizations, one per row. A vendor notice can name a larger set of companies. When it does, that stated count is quoted on the vendor card and is not added on top of the row count.

Records affected adds the numeric headline figure on rows that are not already counted on a vendor row. Blank figures are left out. They are not treated as zero. Last updated is the latest disclosure date written in the sheet.

This page covers published notices only. An organization that has not published a notice is not listed. The notices run from 1 August 2026 to 30 October 2026. This copy was updated on 30 October 2026.

Record counts are the figures the notices reported. A blank figure stays blank. Adding the figures does not produce a count of unique people. The same records can appear in a vendor's notice and again in a customer's notice. Where a notice says the service was suspended and no leak was reported, that organization stays in the vendor's count and is marked on the card.

The organizations under a vendor are the ones that published their own notice. That list is incomplete. A separate Arcadia tally says 160 public bodies had disclosed impact by 16 October 2026. That figure counts disclosures, not confirmed leaks. This page lists 41 Arcadia organizations with their own notices. IDC Frontier's own notice is quoted on that vendor and names more organizations than are listed here. Some breached vendors, including ShopServe, have announced a breach and have no named customer yet.

When a notice does not name the vendor, that vendor's country is unknown. A suspected vendor name is recorded only where a published report places that organization in the vendor's incident, and it is marked as not confirmed. Matching dates alone are not enough: those rows say the vendor was not named. The notes carry no guesses about a company that no source has tied to the incident.

Corrections and additions go to matt@mkultraman.com, in English or Japanese. Send the organization's own notice when you can; that is the source every row needs. A disputed row is checked against its sources and corrected.

3 incidents stay unclear, because the published notice does not say whether the organization was breached directly or through a vendor: Digital Agency (デジタル庁) (possible vendor: Unidentified vendor); SoftBank Corp. (ソフトバンク) - My SoftBank (web); System Five (システムファイブ) - online shop linked system.

Related analysis

Writing from the same reporting: the breach wave, vendor breaches, subcontracted systems, and the suppliers behind these notices. One piece at a time; scroll sideways for the rest of the series, 17 in all.

  1. The top of a dark, angular skyscraper at night, its crown lit gold and a few office windows glowing, against a cloudy night sky GMO's own hackers saw it coming. The fix wasn't fast enough. GMO's own ethical hackers flagged its FX cloud service before attackers used stored broker passwords to drain accounts. What the delay teaches.
  2. The main hall of the Tokyo Stock Exchange in Kabutocho, with a glass cylinder at its center ringed by a scrolling red stock ticker under an arched white ceiling The front door held. They came in through the vendor's back office. Attackers placed trades in IwaiCosmo Securities customer accounts without stealing a single password. They went through a misconfigured admin function at Trade Works, the vendor that runs the trading system.
  3. MKUltraman card titled Whom Now Shall We Trust? Subline: Now what happens to trust in authorities? The side panel marks the Japan Cybersecurity Tracker. Whom Now Shall We Trust? After the Arcadia breach, a real Japanese disaster-alert system sent 1.42 million phishing emails and police contact lists leaked. What that does to trust in authorities, and how to protect yourself.
  4. Dozens of black power and telecom cables strung between utility poles and tangled around transformers in front of a white apartment block in Takadanobaba, Tokyo October 17 was the day Japan's technical debt came due SoftBank, Carsensor, 2nd STREET and GEO all went dark on one day. Shutting everything down is what technical debt leaves you with when attackers arrive.
  5. Illustration of one compromised cloud service with red fault lines spreading to many connected buildings Commune data breach: one community platform, 29 organizations exposed A flaw in Commune, the community SaaS behind fan sites for Suzuki, Mazda, Panasonic and LINE Yahoo, exposed about 307,000 members. What to ask your vendors.
  6. A row of white and teal Luup electric scooters parked in a marked bay beside an office building in Marunouchi, Tokyo, with a Luup sign and QR code in the foreground Studio.Design breach: your website builder held your keys The Studio breach exposed form data, API keys, and the key to decrypt them. What it means for Japanese companies on no-code website builders, and what to do.
  7. The glass front of a Yoshinoya restaurant in Shinjuku at night, with the orange 吉野家 sign lit above the door and menu posters in the windows Doing something isn't the same as fixing it Yoshinoya blocked foreign IPs. Times Car users reissued licences. Fixes chosen without understanding the breach change nothing, but feel like they do.
  8. A platform departure display at a Kobe subway station showing an Earthquake Early Warning in Japanese and English, with a yellow warning triangle, hanging from a station ceiling Nobody had to hack Japan's earthquake warning A false M9.9 warning was cancelled after eight minutes, and Japan asked if it had been hacked. The breach wave has made distrust the reflex. Why that matters.
  9. MKUltraman card titled Japan Cybersecurity Tracker. Subline: Disclosed cyber incidents in Japan, 2026. The side panel marks through a vendor, breached directly, and public notices. Quoted in The Japan Times on Japan's phishing kit crackdown The National Police Agency took down 34 domains selling phishing kits. I told The Japan Times not to wait. Encrypted DNS, passkeys, and a harder rule for links.
  10. Kobe's Harborland waterfront at night, with a lit Ferris wheel and towers reflected in the harbor The PC left in a Kobe hotel room Two people hid a computer on a Kobe hotel's Wi-Fi and sent phishing mail through it. The gap was monitoring, and hotels, offices, and shared spaces can close it.
  11. A street sign titled 霞が関中央官庁案内, Government Buildings Guide, showing a colour map of the ministry buildings beside the Imperial Palace moat, with a list of ministries and agencies in Japanese and English Sovereign AI, made elsewhere Japan says it wants AI sovereignty. When the breach wave hit, its digital minister called Anthropic. What that says about the system Japan runs on.
  12. Commuters walking through a row of green and silver JR ticket gates under departure boards and a sign reading 丸の内北口 You outsourced the work, not the responsibility Japan's 2026 breach wave keeps running through vendors. Why the companies that hired them still own the result, and what to check this week.
  13. Nishi-Shinjuku office towers at night, their lit windows visible from a neighboring building, with traffic on the streets below Blood in the water: Japan's neglected basics are visible from a mile away Japan's 2026 breach wave lands in an environment of neglected basics anyone can see. Why that neglect does triple damage, and why the fixes are easy.
  14. A dim corridor between rows of server racks lit by green and blue status lights Japan cyberattacks in 2026: what the breach wave reveals Lawson, Times Car, Skyticket, and IDCF Cloud exposed different failures in application access, data retention, supplier dependence, monitoring, and recovery.
  15. A wall-mounted network rack buried under a dense tangle of blue, orange, and yellow cables Japan's data breaches: a cyberattack is not an explanation Japanese breach notices describe what attackers did and leave the institutional failure buried. Why victimhood does not end the question of custodianship.
  16. A weathered multi-storey factory building with an open steel-framed work shed beside a narrow street The 99.7% problem: Japan's SME cybersecurity exposure SMEs are 99.7 percent of Japanese businesses. What visible breaches at large companies imply for the much larger, less visible small-business attack surface.
  17. A compact fax machine in a desk drawer printing a page while a person types on a laptop beside it What functional cybersecurity control looks like in Japan Policies, vendors, and certificates are not control. How organizations of any size can prove they know their stack, limit authority, and recover from failure.

If this list reaches your vendors

I provide IT support and administration for organizations in Japan: accounts and access, email and domains, the website, and the suppliers those systems depend on. Diagnostics is the written review of that setup. A Decision Session is the 45-minute conversation if you want to start there.

Book a Decision Session See Diagnostics Discuss your project matt@mkultraman.com