Vendor breach map

Japan supply chain cyberattacks

I list every organization in Japan that has published a cyber incident notice. This page sorts them by supplier: who was hit because a vendor was breached, and which vendors those were.

Organizations breached on their own systems are in the Japan breach tracker. Both pages use the same public notices.

Japan Cyberattack Tracker, updated 21 October 2026. Latest public notice: 21 October 2026.

At a glance

303

Incidents

Public notices in this list

162

Hit through a vendor

53.5% of incidents

139

Breached directly

45.9%. 26 are the vendors themselves. 113 are other organizations.

31

Compromised vendors

Named in a public notice. Cases with no named vendor are listed separately.

Of the 162 incidents that came through a vendor, 141 name that vendor in their notice (87.0% of those 162). 8 were linked from other public evidence (4.9%). 13 do not name the vendor (8.0%). 2 incidents are unclear (0.7% of all incidents).

Charts

Direct or through a vendor

Each bar is a count of incidents. The share uses all 303 incidents, rounded to one decimal place.

  • Hit through a vendor 162 (53.5%)
  • Breached directly 113 (37.3%)
  • Vendor breached itself 26 (8.6%)
  • Unclear 2 (0.7%)

Organizations listed per vendor

Each bar counts organizations that published their own notice about that vendor. If the vendor's notice names a larger number of clients, that number is quoted on the vendor. The last bar is organizations whose notice does not name the vendor. It is not a company.

Metrics

These charts use the same notices. Each one states how many incidents it uses (n) and how many it leaves as unknown. A missing date, the word Unknown, or a date that is not a single calendar day stays unknown.

Exposure type

Each incident is one published notice. n = 303. Unknown: 0. Shares use all 303 incidents.

  • Hit through a vendor 162 (53.5%)
  • Breached directly 113 (37.3%)
  • Vendor breached itself 26 (8.6%)
  • Unclear 2 (0.7%)

Attack type

These are broader descriptions than the wording in each notice. The downloadable list still quotes the notice. n = 303. Unknown: 0. Shares use all 303 incidents.

  • Unauthorized access (method undisclosed) 198 (65.3%)
  • Vulnerability / API / app-flaw exploit 39 (12.9%)
  • Account / email compromise 31 (10.2%)
  • Ransomware 30 (9.9%)
  • Malware (contractor PC) 2 (0.7%)
  • Outage (vendor incident) 2 (0.7%)
  • BEC / payment fraud 1 (0.3%)

Who reported first

First means the earliest report among the sources listed for that incident. n = 137. Unverified: 166. An incident stays unverified when that first report is not confirmed, including when two sources carry the same date. Shares use those 137 incidents.

  • Organization notice 112 (81.8%)
  • News outlet 19 (13.9%)
  • TDnet 6 (4.4%)

Industry groups

Each incident sits in one industry group. Other is one of those groups. The industry bars further down keep the words from the notices. n = 303. Unknown: 0. Shares use all 303 incidents.

  • Government / public sector 54 (17.8%)
  • IT / internet / SaaS 46 (15.2%)
  • Corporate community sites 38 (12.5%)
  • Retail / e-commerce 28 (9.2%)
  • Media / entertainment 24 (7.9%)
  • Other 19 (6.3%)
  • Transport / logistics 18 (5.9%)
  • Education / research 17 (5.6%)
  • Manufacturing / construction / utilities 17 (5.6%)
  • Finance / insurance 15 (5.0%)
  • Travel / hospitality / leisure 11 (3.6%)
  • Healthcare / pharma 10 (3.3%)
  • Restaurant / food service 6 (2.0%)

News outlets that reported first

These are the news outlets in the chart above, under the name written for each incident. n = 19. The share is of those incidents.

  • ITmedia 4 (21.1%)
  • NTV 3 (15.8%)
  • Nikkei 2 (10.5%)
  • 2nd-rtl 1 (5.3%)
  • Asahi Shimbun 1 (5.3%)
  • bankenjp 1 (5.3%)
  • FNN 1 (5.3%)
  • Japan Times 1 (5.3%)
  • NHK 1 (5.3%)
  • piyolog 1 (5.3%)
  • Sanyo Shimbun 1 (5.3%)
  • Yahoo! News 1 (5.3%)
  • Yomiuri 1 (5.3%)

Records named in the notices, by industry group

Each figure is the headline number in the notice, or the maximum when the notice gives a range. It is not a count of unique people. An incident already included in a vendor total is left out, so the same records are not added twice. n = 117. Unknown: 103. Left out because they are already in a vendor total: 83. The share is of the summed records (196,274,757).

No bar for Corporate community sites: those notices have no usable figure. They are in the unknown count.

  • IT / internet / SaaS 95,422,141 (48.6%)
  • Restaurant / food service 28,676,162 (14.6%)
  • Travel / hospitality / leisure 19,163,566 (9.8%)
  • Retail / e-commerce 16,929,700 (8.6%)
  • Transport / logistics 14,076,612 (7.2%)
  • Media / entertainment 11,502,051 (5.9%)
  • Finance / insurance 4,311,800 (2.2%)
  • Government / public sector 3,468,617 (1.8%)
  • Healthcare / pharma 1,827,665 (0.9%)
  • Manufacturing / construction / utilities 662,466 (0.3%)
  • Education / research 223,348 (0.1%)
  • Other 10,629 (0.0%)
Records by industry group, same figures as the chart
Industry group Records Notices with a figure Notices with no figure
IT / internet / SaaS 95,422,141 26 18
Restaurant / food service 28,676,162 6 0
Travel / hospitality / leisure 19,163,566 7 3
Retail / e-commerce 16,929,700 16 11
Transport / logistics 14,076,612 13 5
Media / entertainment 11,502,051 11 7
Finance / insurance 4,311,800 7 5
Government / public sector 3,468,617 12 16
Healthcare / pharma 1,827,665 3 6
Manufacturing / construction / utilities 662,466 7 8
Education / research 223,348 7 9
Other 10,629 2 6
Corporate community sites 0 0 9

Disclosures by month

The month is the date the notice was published. n = 300. Unknown: 3. A month between the first and last dated notice is shown even when its count is zero.

0 129 258 4 Aug 2026 38 Sep 2026 258 Oct 2026
Disclosures by month, same figures as the chart
Month Incidents
Aug 2026 4
Sep 2026 38
Oct 2026 258
Unknown 3

Days from discovery to disclosure

This counts only when the notice gives one calendar day for when the incident was found, and a date for when it was published. n = 106. Unknown: 197. Median of those n incidents: 2 days. The share on each bar is of those n incidents.

  • 27 Same day
  • 67 1 to 7 days
  • 9 8 to 30 days
  • 3 31 to 90 days
  • 0 91 days or more

Days from attack start to disclosure

This counts only when the notice gives one calendar day for the start, or a range written as a start date, the word to, and an end date. The start date is used. n = 86. Unknown: 217. Median of those n incidents: 3 days. The share on each bar is of those n incidents.

  • 7 Same day
  • 62 1 to 7 days
  • 16 8 to 30 days
  • 1 31 to 90 days
  • 0 91 days or more

Industries named in the notices

These are the industry words from the notices. A label used at least 3 times has its own bar. Other stated industries is the count of labels used fewer than 3 times. Those labels are not merged into a broader sector. n = 301. Unknown: 2. Shares use all 303 incidents. Unknown means the notice left the industry blank, said Unknown, or said the industry was not stated.

  • Local government 36 (11.9%)
  • Various (community site) 13 (4.3%)
  • Education 9 (3.0%)
  • Law enforcement (prefectural police) 9 (3.0%)
  • Media 7 (2.3%)
  • Government 4 (1.3%)
  • Insurance 4 (1.3%)
  • Manufacturing 4 (1.3%)
  • Rail 4 (1.3%)
  • Food manufacturing (community site) 3 (1.0%)
  • Hospitality 3 (1.0%)
  • Prefectural government 3 (1.0%)
  • Restaurant 3 (1.0%)
  • Other stated industries 199 (65.7%)

Named in multiple breaches

These organizations are named in two or more distinct incidents. A later update of the same incident counts once. Similar names that may be different companies are not combined. 10 organizations are on this list. Uncombined names are left out.

  • Saitama Prefecture (埼玉県)

    3 incidents

    • 7 October 2026. Breached directly. Shibusawa MIX.
    • 16 October 2026. Through Studio. さいたま緑の森博物館.
    • 20 October 2026. Through Cuenote FC (Yumi Link). ぷらっとさいたま smart-farming site (Cuenote FC).

  • City of Nagoya (名古屋市)

    2 incidents

    • 9 October 2026. Through Commune. なごや学生プラットフォーム.
    • 14 October 2026. Through Arcadia. Net119 emergency-call system (Arcadia).

  • Japan Post (日本郵政)

    2 incidents

    • 29 September 2026. Breached directly. Post Office app.
    • 19 October 2026. Breached directly. ゆうID / ゆうゆうポイント site.

  • Kyoto City (京都市)

    2 incidents

    • 14 October 2026. Through Arcadia. Disaster info distribution.
    • 16 October 2026. Through Studio. Commissioned culture programmes (Studio).

  • M3 (エムスリー)

    2 incidents

    • 15 October 2026. Breached directly. MR君.
    • 21 October 2026. Through Studio. M3PSP / 1人1円ファンド website forms (Studio).

  • Nikkei (日本経済新聞社)

    2 incidents

    • 4 October 2026. Breached directly. Employee Microsoft 365 account; Google Workspace account; cloud service.
    • 16 October 2026. Breached directly. Development cloud service (2nd incident).

  • Nikkei BP (日経BP)

    2 incidents

    • 4 October 2026. Breached directly. Employee email account.
    • 17 October 2026. Through Nikkei dev cloud. Users affected by Nikkei dev-cloud incident.

  • Recruit (リクルート)

    2 incidents

    • 3 October 2026. Breached directly. StudySapuri.
    • 17 October 2026. Breached directly. Carsensor (カーセンサー).

  • Uzabase (ユーザベース)

    2 incidents

    • 8 October 2026. Breached directly. NewsPicks admin/business management tool.
    • 19 October 2026. Through Studio. Website contact form (Studio).

  • Yokosuka City (横須賀市)

    2 incidents

    • 7 October 2026. Through Sagawa Express. Furusato nozei.
    • 13 October 2026. Through Arcadia. Disaster/safety alert email service (outsourced).

Vendor directory

The line under each name comes from that vendor's own notice. Where the vendor has not published a separate notice, the line says so and quotes the system named in a customer's notice.

Named in the notice
The organization's notice names this vendor.
Linked from other evidence
The notice does not name the vendor. I linked this organization from other public evidence.
Vendor not named
The notice does not name the vendor. A name in parentheses is a suspicion, not a confirmed link.

162 organizations listed under a vendor

Arcadia

IT services (disaster alert email for local governments). The affected system is Bulk notification service "SpeeCAN RAIDEN" (and school service "Raiden School"); plus separate disaster system for fire staff/volunteer fire corps.

41 organizations have published a notice. 34 name this vendor in the notice. 7 were linked from other public evidence.

What the vendor reported: Up to ~3,136,000 emails, ~105,000 phones, ~15,000 fax numbers (+ contact names & stored message bodies); separate fire system ~120K (Oct 14 update: 119RAIDEN up to ~97,000 emails / ~17,000 phones / ~400 fax; NET119 ~13,000 records)

Organizations hit through Arcadia

Kyoto Prefectural Police (京都府警察) - staff safety-confirmation system + resident anti-crime mail (Arcadia)

Law enforcement (prefectural police)

2026-10-21 (NPA via press)

Unknown (part of ~16,000 resident emails across 4 forces per Kyodo; force-level figure not given)

Named in the notice

Gunma Prefectural Police (群馬県警察) - staff safety-confirmation system (Arcadia)

Law enforcement (prefectural police)

20 October 2026

~3,700 (nearly all staff)

Named in the notice

Kagoshima Prefectural Police (鹿児島県警察) - disaster safety-confirmation system (Arcadia)

Law enforcement (prefectural police)

20 October 2026

~2,200 officers and staff

Named in the notice

Saitama Prefectural Police (埼玉県警察) - staff safety-confirmation system (Arcadia)

Law enforcement (prefectural police)

20 October 2026

~13,000 (all staff)

Named in the notice

Tochigi Prefectural Police (栃木県警察) - staff safety-confirmation system (Arcadia)

Law enforcement (prefectural police)

20 October 2026

~3,900 (all staff)

Named in the notice

Commune

SaaS (community platform). The affected system is Commune / Commune for Work.

39 organizations have published a notice. 39 name this vendor in the notice. 10 organizations suspended the service and reported no leak.

What the vendor reported: ~307,000 members (estimate, deduped, excl. attacker-created accounts; may change): ~126,000 with email (incl. ~42,000 Commune staff/test/demo accounts) + ~181,000 without email

Organizations hit through Commune

Leak or possible leak

JMAM (日本能率協会マネジメントセンター)

Publishing / training (community site)

9 October 2026

2,950 (leak confirmed)

Named in the notice

Suspended, no leak reported

Miki Shoko (三起商行) - ミキハウスパーク

Apparel (community site)

13 October 2026

No leak reported (members' emails not included in leaked data)

Named in the notice

Suspended, no leak reported

T&S (ティーアンドエス) - ペチコミュ

Retail / pet goods (community site)

13 October 2026

No leak reported (suspension notice only)

Named in the notice

Suspended, no leak reported

Dr.BEAUTOPIA (ドクタービュートピア) - Lov me Lab

Cosmetics / beauty (community site)

2026-10-10 (second-maintenance notice)

No leak reported (no damage per Commune)

Named in the notice

Suspended, no leak reported

DyDo DRINCO (ダイドードリンコ) - dydoいっしょにラボ

Beverages (community site)

9 October 2026

No leak reported (Commune found no damage)

Named in the notice

Suspended, no leak reported

Studist (スタディスト) - Teachme Compass

SaaS (community site)

9 October 2026

No leak reported

Named in the notice

Suspended, no leak reported

Shizuoka Industrial Creation Platform secretariat (しずおか産業創造プラットフォーム事務局)

Industry promotion platform (community site)

8 October 2026

No leak reported (suspension notice only)

Named in the notice

Suspended, no leak reported

Studio

SaaS (no-code website builder). The affected system is Studio cloud environment (accounts, editor/CMS data, form submissions, stored credentials).

22 organizations have published a notice. 22 name this vendor in the notice.

What the vendor reported: All registered users potentially affected; count TBD (Studio has 900K+ users per ITmedia)

Organizations hit through Studio

Chiba Prefecture (千葉県) - commissioned programmes (Studio)

Government (prefecture)

20 October 2026

137 entries (78 + 29 + 4 businesses; 15 + 11 persons)

Named in the notice

IDC Frontier

Data center / cloud. The affected system is Part of cloud service run from Fukushima data center.

18 organizations have published a notice. 17 name this vendor in the notice. One was linked from other public evidence.

What the vendor reported: 495 companies and local governments affected (service outage); portal registration info of 48 companies illicitly queried; leakage of VM data not confirmed (Oct 7 notice per 漏洩ナビ); 5th report (Oct 14): no external leak of VM data judged; snapshot backups of 194 of the 495 affected orgs retrievable; entry path identified but not disclosed (Nikkei xTECH)

Organizations hit through IDC Frontier

Yamada Denki (ヤマダデンキ) - ヤマダゲーム etc.

Retail (electronics)

2026-10-08 (2nd report 2026-10-15)

No leak (IDCF finding, 2nd report)

Named in the notice

Sagawa Express

Logistics. The affected system is Parcel tracking inquiry service (お荷物問い合わせサービス).

7 organizations have published a notice. 7 name this vendor in the notice.

What the vendor reported: Under investigation

Organizations hit through Sagawa Express

Scala Communications

IT services (web inquiry/contact form systems). The affected system is FAQ / inquiry system "i-ask" (admin site) for client companies.

3 organizations have published a notice. 3 name this vendor in the notice.

What the vendor reported: 713,126 records (cumulative) from up to 5 client companies

Organizations hit through Scala Communications

ApplyNow

SaaS (recruitment management). The affected system is Recruitment management platform (via data-analysis tool vuln).

2 organizations have published a notice. 2 name this vendor in the notice.

What the vendor reported: ~390,000 people (incl. ~30,000 ApplyNow Sign users; per ApplyNow 2026-10-09 update, count still being confirmed)

Organizations hit through ApplyNow

NEC (via unnamed contractor)

IT services / systems integration. The affected system is Customer systems maintained by NEC; NEC-created cloud storage shared with customers and the contractor.

2 organizations have published a notice. 2 name this vendor in the notice.

What the vendor reported: Not disclosed

Organizations hit through NEC (via unnamed contractor)

Nikkei dev cloud

Media. The affected system is External cloud service used for system development.

2 organizations have published a notice. 2 name this vendor in the notice.

What the vendor reported: ~1.83M (~150K incl. name/email/address/phone/birthdate, of which ~120K incl. email; ~1.68M identifier-only)

Organizations hit through Nikkei dev cloud

Temairazu

Travel / hotel booking SaaS. The affected system is Site controller "TEMAIRAZU" series (accommodation reservation management).

2 organizations have published a notice. 2 name this vendor in the notice.

What the vendor reported: Up to ~4.45M people

Organizations hit through Temairazu

Ota Ward Izu Kogen Gakuen (大田区立伊豆高原学園)

Local government facility (lodging)

9 October 2026

69 bookings (suspicious messages sent)

Named in the notice

Amadeus

There is no separate notice from this vendor. The customer notice names this system: Hotel booking platform.

One organization has published a notice. One names this vendor in the notice.

Organizations hit through Amadeus

Busitec

IT services (municipal systems). The affected system is Crematorium booking system (斎場予約システム) provided to Ashikaga City.

One organization has published a notice. One names this vendor in the notice.

What the vendor reported: ~8,800 people (possible)

Organizations hit through Busitec

Daiwa Institute of Research

There is no separate notice from this vendor. The customer notice names this system: Internet trading system 'Financial Plate/WB4' web server / temporary session DB.

One organization has published a notice. One names this vendor in the notice.

Organizations hit through Daiwa Institute of Research

Hotelier

Hospitality (hotel operator). The affected system is Accommodation management system (leftover account of former operator).

One organization has published a notice. One names this vendor in the notice.

What the vendor reported: 7,919 guests across 8 facilities (leak confirmed)

Organizations hit through Hotelier

Daiei Sangyo (大英産業) - Grand Inn Canalside

Real estate / hospitality

7 October 2026

Not disclosed (web bookings 2026-04-08 to 2026-09-14)

Named in the notice

Portus

There is no separate notice from this vendor. The customer notice names this system: Vendor's internal server holding school learning-device account settings.

One organization has published a notice. One names this vendor in the notice.

Organizations hit through Portus

Sakura Internet

There is no separate notice from this vendor. The customer notice names this system: Data stored on 'Sakura Rental Server'.

One organization has published a notice. One names this vendor in the notice.

Organizations hit through Sakura Internet

SourceNext

Software. The affected system is Member information management system (member info retrieval API).

One organization has published a notice. One names this vendor in the notice.

What the vendor reported: 22,519,960

Organizations hit through SourceNext

TradeWorks

There is no separate notice from this vendor. The customer notice names this system: Online trading customer data at contractor TradeWorks.

One organization has published a notice. One names this vendor in the notice.

Organizations hit through TradeWorks

Breached vendors with no named customers yet

These vendors have announced a breach, but none of their customers have been publicly named yet. Where the vendor's notice says how many clients were affected, we quote it below.

ACCESS (CROS)

Software / cross-border e-commerce support service. The affected system is CROS cross-border EC support service (BI tool provided to one client).

No customer has been publicly named yet.

What the vendor reported: 155,280 customer IDs + 231,998 order IDs; card data for 1,305 accounts (1,671 items, 4 incl. security code)

DIGYM

SaaS (membership / reservation / payment for shops). The affected system is DIGYM cloud membership-management sites.

No customer has been publicly named yet.

What the vendor reported: Under investigation (personal-info leak possible)

Entouch (Toho HD)

Pharmaceutical wholesale / healthcare IT. The affected system is Entouch remote-detailing (online MR meeting) database.

No customer has been publicly named yet.

What the vendor reported: Under investigation

FaveConnect (Nippon TV Wands)

Media / entertainment (fan-club platform). The affected system is FaveConnect admin console (Takane no Nadeshiko official fan club; HEROINES official site).

No customer has been publicly named yet.

What the vendor reported: 117,392 accounts possibly viewed

Furusato Choice (Trust Bank)

Internet (furusato nozei portal / municipality platform). The affected system is ふるさとチョイス and related services.

No customer has been publicly named yet.

What the vendor reported: 4,454,097 member records (outflow confirmed; 10-20 update)

GMO Internet (お名前.com デスクトップクラウド)

Cloud hosting (Windows remote-desktop VPS, used for FX auto-trading). The affected system is Customer server environments on お名前.com デスクトップクラウド (all plans stopped).

No customer has been publicly named yet.

What the vendor reported: 26,739 servers potentially affected (servers, not people/records)

Hakuhodo (住宅省エネ2024 secretariat)

Government subsidy programme administration (advertising agency as secretariat). The affected system is Subsidy application system for 住宅省エネ2024キャンペーン operated by Hakuhodo.

No customer has been publicly named yet.

What the vendor reported: 23,918 people (16,950 businesses) (preliminary)

Kobo (発車オーライネット)

Transport (bus ticket reservation platform). The affected system is API server for integration with external partners.

No customer has been publicly named yet.

What the vendor reported: Up to 8,341 records / 5,614 people (final check ongoing); NHK: 5,000+ customers

PingCAP (TiDB Cloud)

Cloud database / SaaS (TiDB Cloud). The affected system is PingCAP internal systems holding TiDB Cloud account, support and billing data, plus source code (TiDB Cloud production not accessed per company).

No customer has been publicly named yet.

What the vendor reported: Up to ~50,000 personal-information records in Japan (Japanese subsidiary figure); global count not disclosed

ShopServe (E-Store)

SaaS (e-commerce site platform). The affected system is ShopServe server environment / database (current and former merchant shops).

No customer has been publicly named yet.

What the vendor reported: ~23,356,000 people (deduped estimate) across 7,858 shops incl. former shops; ~2,096,900 incl. partial card data. 2nd report (Aug) had said up to 8,853,839 (gross)

WASABI SWITCH

SaaS (e-commerce order hub for shops). The affected system is WASABI SWITCH order / shop systems.

No customer has been publicly named yet.

What the vendor reported: Under investigation (order info of member shops' buyers)

Unidentified vendor

These 13 organizations were exposed through a vendor the notice does not name. They are not customers of one confirmed company. A missing name leaves the vendor's country unknown.

  • 9: No suspected name
  • 2: IDC Frontier suspected
  • 1: Scala suspected
  • 1: Temairazu suspected

Left off this list because the published notice does not say whether the breach was direct or through a vendor: Digital Agency (デジタル庁).

Show 13 organizations

SMBC DS Asset Management (三井住友DSアセットマネジメント) - 投信直販ネット

Finance (asset management)

16 October 2026

No account or trade impact reported

Vendor not named

Nagoya Electric Works (名古屋電機工業) - Infomex Matsumoto

Manufacturing (road / disaster-prevention equipment)

8 October 2026

Under investigation

Vendor not named

Cyber University (サイバー大学)

Education (online university)

7 October 2026

No personal-info impact reported

Vendor not named (IDC Frontier suspected)

Download

The file lists all 303 incidents: organization, sector, disclosure date, attack type, records affected, how the organization was hit, the vendor if one is named, how that vendor was identified, and links to the notices. Record figures are the words in the notice. Working notes are left out.

Source: Japan Cyberattack Tracker, Matthew Ketchum, mkultraman.com

Download the CSV

What these counts leave out

This page covers published notices only. An organization that has not published a notice is not listed. The notices run from 1 August 2026 to 21 October 2026. This copy was updated on 21 October 2026.

Record counts are the figures the notices reported. A blank figure stays blank. Adding the figures does not produce a count of unique people. The same records can appear in a vendor's notice and again in a customer's notice. Where a notice says the service was suspended and no leak was reported, that organization stays in the vendor's count and is marked on the card.

The organizations under a vendor are the ones that published their own notice. That list is incomplete. A separate Arcadia tally says 160 public bodies had disclosed impact by 16 October 2026. That figure counts disclosures, not confirmed leaks. This page lists 41 Arcadia organizations with their own notices. IDC Frontier's own notice is quoted on that vendor and names more organizations than are listed here. Some breached vendors, including ShopServe, have announced a breach and have no named customer yet.

When a notice does not name the vendor, that vendor's country is unknown. On some of those notices I have recorded a suspected name. The suspicion is marked, and it is not a confirmed link.

2 incidents stay unclear, because the published notice does not say whether the organization was breached directly or through a vendor: Digital Agency (デジタル庁) (possible vendor: Unidentified vendor); SoftBank Corp. (ソフトバンク) - My SoftBank (web).

Related analysis

Writing on vendor breaches, subcontracted systems, and the suppliers behind these notices. Newest first.

  1. The front door held. They came in through the vendor's back office. Attackers placed trades in IwaiCosmo Securities customer accounts without stealing a single password. They went through a misconfigured admin function at Trade Works, the vendor that runs the trading system.
  2. Whom Now Shall We Trust? After the Arcadia breach, a real Japanese disaster-alert system sent 1.42 million phishing emails and police contact lists leaked. What that does to trust in authorities, and how to protect yourself.
  3. October 17 was the day Japan's technical debt came due SoftBank, Carsensor, 2nd STREET and GEO all went dark on one day. Shutting everything down is what technical debt leaves you with when attackers arrive.
  4. Commune data breach: one community platform, 29 organizations exposed A flaw in Commune, the community SaaS behind fan sites for Suzuki, Mazda, Panasonic and LINE Yahoo, exposed about 307,000 members. What to ask your vendors.
  5. Studio.Design breach: your website builder held your keys The Studio breach exposed form data, API keys, and the key to decrypt them. What it means for Japanese companies on no-code website builders, and what to do.
  6. Doing something isn't the same as fixing it Yoshinoya blocked foreign IPs. Times Car users reissued licences. Fixes chosen without understanding the breach change nothing, but feel like they do.
  7. You outsourced the work, not the responsibility Japan's 2026 breach wave keeps running through vendors. Why the companies that hired them still own the result, and what to check this week.
  8. Japan cyberattacks in 2026: what the breach wave reveals Lawson, Times Car, Skyticket, and IDCF Cloud exposed different failures in application access, data retention, supplier dependence, monitoring, and recovery.
  9. The 99.7% problem: Japan's SME cybersecurity exposure SMEs are 99.7 percent of Japanese businesses. What visible breaches at large companies imply for the much larger, less visible small-business attack surface.
  10. What functional cybersecurity control looks like in Japan Policies, vendors, and certificates are not control. How organizations of any size can prove they know their stack, limit authority, and recover from failure.

From the same reporting

The full incident list is the Japan breach tracker. The counts on this page use the same notices.

If a supplier on this map is yours

I review vendor risk for companies operating in Japan: the suppliers under your accounts, email, website, and the systems your staff use. Diagnostics is the written review. A Decision Session is the 45-minute conversation if you want to start there.

Book a Decision Session See Diagnostics Discuss your project matt@mkultraman.com