Open dataset · Data as of 30 October 2026
Japan Cybersecurity Tracker dataset
The Japan Cybersecurity Tracker is a dataset of published cyber incident notices from organizations in Japan, kept by Matt Ketchum at MKUltraman since 19 October 2026. Each row is one organization's own disclosure: the sector, the date the notice was published, the attack type as the notice described it, the records affected as the notice stated them, whether the organization was breached directly or through a vendor, the vendor's name where one is named or inferred, and links to the sources. As of 30 October 2026 it holds 544 incidents disclosed between 1 August 2026 and 30 October 2026, of which 298 (54.8%) reached the organization through a vendor. The dataset is free to reuse under Creative Commons Attribution 4.0 International with attribution to Matthew Ketchum, MKUltraman. This page is the stable address for citing it; the figures below are recomputed from the CSV on every refresh, and the release history records each one.
Headline figures, 30 October 2026
Incidents disclosed per month
Counted by the month of the disclosure date. n = 541. Without a usable date: 3.
| Month | Incidents | Share of busiest month |
|---|---|---|
| Aug 2026 | 4 | |
| Sep 2026 | 39 | |
| Oct 2026 | 498 |
How organizations were hit
Shares use all 544 incidents. "Hit through a vendor" means the notice attributes the incident to a supplier's system.
| Exposure | Incidents | Share |
|---|---|---|
| Hit through a vendor | 298 | 54.8% |
| Breached directly | 193 | 35.5% |
| Vendor breached itself | 50 | 9.2% |
| Unclear | 3 | 0.6% |
Industry groups with the most notices
Grouped from the industry stated in each notice. n = 544. Unknown: 0.
| Industry group | Incidents | Share |
|---|---|---|
| Government / public sector | 96 | 17.6% |
| IT / internet / SaaS | 83 | 15.3% |
| Retail / e-commerce | 66 | 12.1% |
| Media / entertainment | 51 | 9.4% |
| Corporate community sites | 38 | 7.0% |
| Education / research | 35 | 6.4% |
| Other | 35 | 6.4% |
| Finance / insurance | 33 | 6.1% |
Vendors with the most downstream notices
Counts organizations that published their own notice naming, or inferred to depend on, the vendor. Vendor notices that name more customers are not added. A separate Arcadia tally says 160 public bodies had disclosed impact by 16 October 2026. That figure counts disclosures, not confirmed leaks.
| Vendor | Downstream notices | Named in source |
|---|---|---|
| Blastmail (Rakus Lite Cloud) | 69 | 69 |
| Arcadia | 41 | 34 |
| Commune | 39 | 39 |
| Studio | 34 | 34 |
| Cuenote FC (Yumi Link) | 19 | 19 |
| IDC Frontier | 18 | 17 |
| Sagawa Express | 9 | 9 |
| Amadeus | 3 | 3 |
Request the CSV
The file is sent on request rather than downloaded, so I know who holds it. Say what you plan to do with it and I will send the current release. UTF-8 with a byte-order mark, comma separated, one header row, 544 data rows. Columns: Organization, Sector, Disclosure date, Attack type, Records, Exposure type, Compromised vendor, Vendor identification, Source URLs. Record figures are the words in the notice, not normalized numbers. Working notes and helper columns are left out.
How to cite
Short form, for a chart footnote or a news report:
Source: Japan Cybersecurity Tracker, Matthew Ketchum, mkultraman.com
Reference list:
Ketchum, M. (2026). Japan Cybersecurity Tracker: disclosed cyber incidents affecting organizations in Japan [Data set, version of 2026-10-30]. MKUltraman. https://www.mkultraman.com/japan-cybersecurity-tracker/dataset/BibTeX:
@misc{ketchum2026japancyberattacks,
author = {Ketchum, Matthew},
title = {Japan Cybersecurity Tracker: disclosed cyber incidents affecting organizations in Japan},
year = {2026},
publisher = {MKUltraman},
howpublished = {\url{https://www.mkultraman.com/japan-cybersecurity-tracker/dataset/}},
note = {Data as of 2026-10-30. CSV available on request.}
}Name the data date, because the figures change with each refresh. Link this page, so readers reach the method notes and can ask for the current file.
Licence
The figures on this page, and the CSV once you have it, are published under the Creative Commons Attribution 4.0 International licence. You may copy, redistribute, chart and build on it, including commercially, as long as you credit Matthew Ketchum, MKUltraman, and link to this page. The notices the rows point to belong to the organizations that published them.
Release history
The CSV is refreshed from the source sheet as notices are published. Each refresh updates the figures on this page and the file sent on request.
- Refresh through row 545. Adds notices through 30 October, including Yakult, Kurogane Kasei, ELESTYLE, Clubnets, WASIMIL, MUJI, World, the Foreign Ministry, and further customers of Cuenote, Blastmail, Sagawa and Arara. Rows that named a vendor from the disclosure date alone still say the vendor was not named.
- Editorial review of attribution. Five rows that suspected a vendor on matching dates alone (IDC Frontier, Scala, Temairazu, GMO) now say the vendor was not named. Two notes that named a company no source tied to the incident were cut. The research columns on foreign ownership and foreign platforms were removed from the file.
- The public CSV download was withdrawn. The file is now sent on request through the contact form; the figures on this page stay public.
- Page renamed to the Japan Cybersecurity Tracker at /japan-cybersecurity-tracker/, merging the organization list that was at /japan-breach-tracker/ with the vendor breach map. Old addresses redirect. 86 incidents disclosed 14 to 29 October added, including So-net and docomo Hikari, Hana Cupid, Arara Message, Sony Life, JAL and ANA through Amadeus, and the DIRIGIO mobile-order breach (Baskin-Robbins, Subway, DEAN & DELUCA). More Cuenote FC and Blastmail customers added. Hijacked email and admin accounts are included even where no leak was confirmed. GMO, Times Car, IDC Frontier, Medley, Okamura and System Five updated.
- Ymirlink (Cuenote FC) updated to its second report: 51.6 million gross records from 49 systems. JR Central, JR West and JR Kyushu added as a downstream customer. Joshin updated to its second report; Susaki City added under Studio.
- Refresh through row 426 of the source sheet; Blastmail, Cuenote and WASABI SWITCH downstream customers added.
- Refresh through row 376.
- Refresh through row 329.
- Four refreshes through row 304, including the 21 October PHP2Shell disclosures.
- Refresh through 20 October; first-report, record-total and industry-group charts added.
- First publication of the vendor breach map and the CSV download.
Method and limits
A row is added when an organization in Japan publishes a notice about a cyber incident, or when a vendor's notice is confirmed by the customer's own notice. Organizations that have not published are not listed, so the counts are a floor. Disclosure dates come from the notice. Record counts are the headline or maximum figure the notice gave; a blank stays blank and is not treated as zero. Summing records does not count unique people, because the same records can appear in a vendor's notice and a customer's.
Vendor attribution is marked as named in the source, inferred from the service the notice describes, or unidentified. An inference is not a confirmed link, and a suspected name is recorded only where a published report places the organization in that vendor's incident; matching dates alone do not qualify. The tracker page explains each caveat against the current figures, lists every disclosure by organization, and maps them by vendor.
Analysis built on this data
Questions about the data
Corrections, additions and interview requests go to matt@mkultraman.com, in English or Japanese. Send the organization's own notice when you can; that is the source every row needs.