In brief
From April to mid‑October, the commission identified 2,094 incidents of unauthorized data access involving about 260 million individuals—twice Japan’s population. Breaches spiked in October, with 830 events in the first half of the month, and major firms such as Sony Life, Don Quijote, Bandai Namco, Kyushu University, Muji, Matsuya Foods, and All Nippon Airways reported potential compromises. The cabinet has called the trend "rapidly increasing" and promised emergency countermeasures.
On Tuesday, Tokyo’s Personal Information Protection Commission released data showing that personal information of approximately 260 million people has been compromised across more than 2,000 incidents from the beginning of Japan’s fiscal year in April to mid‑October.
The commission’s report lists 2,094 separate incidents of unauthorized access. Six incidents each involved the disclosure of personal data on more than 10 million people. The number of breaches rose sharply in October, with 830 events reported in the first half of the month alone, compared with 303 for all of September. According to Kyodo News, the fiscal 2025 tally for the entire year was 1,256 incidents.
On Wednesday, several companies and institutions—including Sony Life Insurance Co., discount retailer Don Quijote, video game publisher Bandai Namco Entertainment Inc., and Kyushu University with its affiliated hospital—alerted the public to possible leaks after unauthorized access to their websites or other systems. On Friday, Muji brand operator Ryohin Keikaku Co., restaurant chain operator Matsuya Foods Holdings Co., and All Nippon Airways Co. also reported potential data breaches.
The figure of 260 million people is noted by the commission as “roughly twice Japan’s population,” acknowledging that many individuals appear on multiple incident lists. The report also states that because the data exclude financial and telecommunications firms, the actual scale could be larger.
The number of large‑scale leaks is increasing rapidly, and the government is taking the situation very seriously.
—Minoru Kihara, Chief Cabinet Secretary, at a press conference Friday. He said the government will compile a package of emergency countermeasures quickly and presented the findings to highlight the growing threat of cyberattacks on personal data.
