Japan’s autumn 2026 data breaches spread through the services companies use: reading 85 disclosed incidents

01Leaked records reached 7.6 times the previous year’s total in ten months

First, let us check the overall scale.

The research firm MM Research Institute has counted, incident by incident since 2022, the leaks (including possible leaks) caused by cyberattacks that Japanese organizations have disclosed. Its tally published on November 4, 2026 shows 661 incidents and about 376 million leaked records in 2026 through the end of October. For all of 2025 the figures were 428 incidents and 49.53 million records. The number of incidents is about 1.5 times higher, but the number of leaked records reached about 7.6 times the previous year’s total in just ten months.

Moreover, most of it is concentrated after the summer. About 94% of the items leaked in 2026 came from incidents disclosed in July or later.

October did not just bring more incidents. In MM Research Institute’s count, October had 193 incidents, more than double September’s 81. The size of each incident changed too. Line the incidents up by the number of records leaked, and the one in the middle (the median) went from 1,500 records in September to about 29,000 in October. October alone had 30 incidents involving more than a million records.

In other words, it was not only a few giant incidents that were large: the typical incident grew. The sections that follow look at why.

Note that ANN’s 233 and MM Research Institute’s 193 are counted differently. MM Research Institute treats disclosures by several organizations about an attack on the same contractor as one incident, and excludes human errors such as misdirected emails and lost items. Under either count, October was the highest month in its own tally.

02The reported counts use different units, so they cannot be added up

Building the list raises a problem right away: each incident is counted in a different unit. E-Store reported de-duplicated people, Sagawa Express records per parcel, Times Car accounts, and ARARA email addresses.

Sagawa Express’s count covers information on parcels handled over about 100 days, from late June to September 30, 2026; a person who sends several parcels is counted each time. ARARA’s count is the number of recipient email addresses, and one person may have several addresses. Gyazo’s about 23.62 million includes anonymous, unregistered accounts. On top of that, one person may be counted as a parcel recipient, as an online store member and as a game ID holder.

So you cannot add up the counts of the 85 incidents and say that “information on hundreds of millions of people was leaked.” What you can say is that your own information is likely to be in at least one of them.

03The largest leaks happened at the services companies trusted with their email

Because the units differ, the incidents cannot be ranked precisely by size. Even so, line up the incidents in the tens of millions and you find companies most people have never heard of.

ARARA, with the largest number, runs an “email delivery service” that sends newsletters and notices on behalf of companies and local governments. Ymirlink’s Cuenote, with about 47.86 million records, is the same kind of email delivery service. E-Store rents out the systems that many merchants use to run their online shops.

When such a company is breached, the dozens or hundreds of organizations that had entrusted data to it all disclose “possible leaks” at once. ARARA is estimated to have up to about 380 client companies, and Nikkei xTECH alone had confirmed at least 116 disclosures, excluding local governments, by November 9. MOS Food Services (about 7.52 million items), SEGA (about 2.2 million), the Cabinet Office (about 63,000) and the City of Kobe (about 21,000) did not have their own systems breached; the data they had entrusted to ARARA was leaked. These counts are part of ARARA’s about 81.33 million.

Email delivery services stand out in particular. According to piyolog, which keeps a record of security incidents, intrusions were found at five email delivery services in the 16 days from October 11 to 27.

None of the companies has said whether the five intrusions were the work of the same attacker. They appear to coincide with the night of October 21, when a fix for a serious vulnerability in the PHP programming language was released, but three of them, SpeeCAN RAIDEN, Cuenote and Blastmail, began earlier, and no company has pointed to a link with PHP. Still, the targets have something in common. An email delivery service holds the customer email addresses of many organizations in one place. From the attacker’s side, breaking through a single entrance reaches the data of hundreds of organizations.

In our list, too, at least 11 of the 85 incidents happened at a party the disclosing organization had entrusted data to (a contractor, an email delivery service, a cloud provider or a booking system). They include MOS, SEGA, the Cabinet Office, the City of Kobe, Shogakukan (email delivery), JAL and ANA (the Amadeus airline booking system), Daiichikosho (a contractor’s PC) and Ride On Express (its server operator). In at least 9 more, such as Ymirlink and IDC Frontier, the company breached was one that provides services to other companies.

This also shows in MM Research Institute’s tally by industry. In information and communications, the industry where incidents rose the most in 2026, 58 of the 176 incidents through the end of October involved breaches of cloud services for other companies (SaaS) or contractors’ systems. In 2025, it was 5 of 56.

Of course, many incidents involved companies’ own systems being breached directly. Leaks from the official apps of restaurant and retail chains such as Yakiniku King, Burger King, Matsuya, MrMax and MUJI were concentrated in September and October. However, no one has reported a common developer or membership system behind them.

Data is CITY looks at a company’s systems as a city. In city terms, however firmly you lock up your own building, if the management company holding your spare keys is broken into, intruders can get into your rooms. What happened in autumn 2026 is that intrusions into such management companies piled up, one after another, within a few weeks.

04Leaked information becomes material for scam emails and credential stuffing

A leak does not end when the data gets out.

When an email delivery service is taken over, attackers can send scam emails from that service under the genuine sender. At ARARA, from October 28 to 30, up to about 7.13 million emails posing as a credit card company were sent from ARARA’s addresses. Suspicious emails were also sent from SpeeCAN RAIDEN, about 1.42 million on October 13, and from Ymail, about 1.34 million by November 3. Because they come from addresses that usually send notices, they are hard to tell apart.

The other is passwords. In MM Research Institute’s tally, credentials such as passwords and login IDs leaked in 2026 reached a cumulative about 161 million by the end of October, about 31 times 2025’s figure. On November 11, it emerged that about 420,000 passwords for a service Ymirlink had shut down in February had been leaked unencrypted. Data from a discontinued service had been left in place rather than deleted.

Leaked combinations of email addresses and passwords are used for “credential stuffing,” trying logins at other services one after another. If you reuse the same password, attackers can get into services that were not themselves breached. On November 9, Ryohin Keikaku disclosed that about 270,000 items may have been leaked from the MUJI online store through credential stuffing.

Leaks produce scam emails, and scam emails and credential stuffing produce the next leaks. Looking at each incident separately, you cannot see this cycle.

05The first figures announced change sharply in follow-up reports

Building the list revealed one more thing: the numbers move a lot after the fact.

Ymirlink estimated a cumulative about 9 million items in its first report on October 19, raised it to a cumulative about 51.63 million in its second report on October 26, and on November 11 settled on a cumulative about 47.86 million as the final figure. ARARA said in its first report on October 29 that “no leak has been confirmed,” but in its third report on November 6 disclosed a leak of about 81.33 million items.

It can take months from an attack to its disclosure. Even in our list, Nichirei disclosed on September 18 an attack from July, and E-Store issued its final report on October 16 on attacks from May to August.

When the incident is at a contractor, the company that entrusted the data learns of it even later. SEGA was told by ARARA on November 1 that there “may have been external access,” was informed on the 3rd that data removal had been confirmed, and disclosed on the 9th. Nikkei xTECH’s reporting also found cases where a leak was later confirmed at a company first told it was “not affected.”

So even if the first announcement makes you think “this doesn’t concern us” or “the numbers are small,” you need to keep watching the follow-up reports.

06What companies should check starts with a list of where their data is kept

Companies can learn a lot from this autumn’s incidents. Four things in particular can be started right away.

First, list the outside services that hold your customers’ data. Email delivery, booking management, membership apps, online shops, surveys, campaign entries, recruitment management. It is not unusual for each department to sign its own contracts, so that no one in the company knows them all.

Second, entrust only the items that are needed. Of the about 81.33 million items leaked at ARARA, about 47.04 million included information other than email addresses, such as names and dates of birth. Sending emails should not require anything beyond the email address.

Third, have the data of discontinued services deleted. The passwords leaked at Ymirlink belonged to a service shut down in February. When a contract ends, confirm that the data has been deleted.

Fourth, decide in advance what to do when a vendor contacts you. Who receives the notice, what to check, and when to inform customers and the Personal Information Protection Commission. Assume that the figures in the first report will change.

We turned the four points into a checklist you can take straight into an internal meeting. The front has checkboxes; the back has a table where each department lists the services that hold its data, and a section for the steps to take when a vendor reports an incident.

There are also things each person can do: don’t reuse passwords, and use two-step verification wherever a service offers it. And even when a notice arrives from the company’s usual address, don’t log in through the link in the email; open the service from its official app or a bookmark.

07List of the main incidents disclosed from September 1 to November 11

This is the source material behind the analysis. The 85 rows include a follow-up to the same incident (Sony Life) and a separate incident at the same company (Ryohin Keikaku). [Vendor] marks incidents that happened at a service the disclosing organization relied on (a contractor, email delivery, cloud and so on); [Provider] marks breaches of a company that provides services to other businesses. Figures are as of each disclosure and mix confirmed counts, maximum possible counts, records and accounts. They cannot be added together.

September

October

November (through the 11th)