Risk of customer confidential information and personal information breaches
First written in FY2016. 7 of 11 entries say "Mitigated", first in FY2018. Latest entry: FY2025.
The whole theme swung hardest in 2026: 13 of 74 companies on the "Worse" side.
- FY2025MitigatedAnnual report
「Number of major security incidents 0 (annual) 0」
The fiscal 2024 actual result for major security incidents was 0, in line with the KPI target of 0. The Group continues to strengthen its information-management framework, contractor training, zero-trust infrastructure, CSIRT and SOC. - FY2024MaterialisedAnnual report
「Number of major security incidents: 0 (annual) 1」
The disclosed actual result for fiscal 2023 was 1 major security incident against a KPI target of 0. The details of the incident cannot be identified from this disclosure alone. - FY2023-Q3MitigatedAnnual report
「In view of the importance of this matter, the Company established a third-party committee comprising external experts on 1 July 2022 and commissioned it to objectively verify the facts and analyse the causes concerning this incident and similar transactions, and to recommend improvement measures. The Company received the committee’s investigation report on 12 December 2022. Taking the findings seriously, it is working to implement recurrence-prevention measures thoroughly, while continuing efforts to strengthen security measures and the management and supervision of contractors. The device was found on 24 June 2022, and, as stated in the investigation report published by the Amagasaki City Investigation Committee on 28 November 2022, no personal information leak was confirmed.」
Regarding the loss of the USB memory device containing personal information, the Company received the third-party committee’s investigation report and is proceeding with recurrence-prevention measures and stronger contractor management. No personal information leak was confirmed. - FY2023-Q2MitigatedAnnual report
「In connection with this matter, the Personal Information Protection Commission issued statutory guidance on 21 September 2022. Taking the Commission’s guidance seriously, the Group is working to strengthen governance across the Group concerning the proper handling of personal information, improve its information-management framework and operations, and renew education and guidance for all officers and employees and contracted business partners, in order to prevent a recurrence and make every effort to restore trust.」
Regarding the loss of the USB memory device containing personal information, the Group received guidance from the Personal Information Protection Commission and has specified measures to strengthen governance, improve its information-management framework and operations, and renew education and guidance. - FY2023-Q1MitigatedAnnual report
「In view of the importance of this matter, the Company established on 1 July 2022 a third-party committee comprising 3 independent external experts to verify the facts objectively, analyse the causes and implement improvement measures, while fulfilling its accountability to stakeholders.」
Regarding the loss of the USB memory device containing personal information, the Company established a third-party committee of 3 external experts and proceeded with cause analysis, improvement measures and recurrence prevention. - FY2022MaterialisedAnnual report
「However, on 21 June 2022, a serious incident occurred in which an employee of one of the Company’s business partners lost a USB memory device containing encrypted personal information. The device was found on 24 June 2022, but the Company is investigating, in cooperation with the relevant authorities, whether any personal information was leaked.」
The previously identified information-breach risk materialised in the form of an incident in which an employee of a business partner lost a USB memory device containing personal information. - FY2021MitigatedAnnual report
「The Group is strengthening its security infrastructure in response to the increased use of telework and cloud services. It is also strengthening its incident-detection and response capabilities through cybersecurity exercises for its CSIRT (Computer Security Incident Response Team), which specialises in preventing cyberattacks and responding to incidents, and by expanding the monitoring coverage of its internal SOC (Security Operation Center), which monitors and analyses threats to the Group’s networks, servers and other systems.」
The Group continues to strengthen its security infrastructure in response to increased use of telework and cloud services, conduct CSIRT exercises and expand SOC monitoring coverage. - FY2020MitigatedAnnual report
「The Group is strengthening its incident-detection and response capabilities through cybersecurity exercises for its CSIRT (Computer Security Incident Response Team), which specialises in preventing cyberattacks and responding to incidents, and by expanding the monitoring coverage of its internal SOC (Security Operation Center), which monitors and analyses threats to the Group’s networks, servers and other systems.」
The Group is strengthening its cybersecurity detection and response capabilities through CSIRT exercises and expanded monitoring coverage by its internal SOC. - FY2019WorsenedAnnual report
「Meanwhile, cyberattacks are becoming more advanced and sophisticated each year, making cybersecurity risk a major management issue.」
The Group explicitly identifies the increasing sophistication and complexity of cyberattacks as information-breach and information-security risks and positions them as major management issues. - FY2018MitigatedAnnual report
「In preparation for cyberattacks and other threats, the Group has established and operates its Group Information Security Incident Response Technical Support Team (CSIRT: Computer Security Incident Response Team). It also maintains insurance coverage up to a specified amount to respond to an unexpected information breach.」
The establishment and operation of a CSIRT are explicitly described as measures addressing information-breach risk, and insurance coverage remains in place. - FY2016First statedAnnual report
「The Group recognises information management as its most important issue as a company operating in the ICT industry and takes every precaution in managing information. However, although it maintains insurance coverage up to a specified amount to respond to an unexpected information breach, business performance could be affected if response costs exceed that amount or if the Group suffers a loss of social credibility.」
Information management is identified as the highest-priority issue, while response costs following an information breach and declining credibility are identified as risks.