Risk of Data Breaches Involving Large Volumes of Personal Information
First written in FY2017. 2 of 7 entries say "Mitigated", first in FY2019. Latest entry: FY2026.
The whole theme swung hardest in 2026: 13 of 71 companies on the "Worse" side.
- FY2026WorsenedAnnual report
「Cyberattacks targeting the supply chain, including our company, business partners and group companies, could cause personal information leaks or business disruptions, undermining stakeholders' trust and resulting in lost business opportunities.」
The company has positioned cyberattacks as a top risk, specifying the impact pathway from attacks targeting not only the company itself but also its supply chain, including business partners and group companies, through information leaks and business disruptions to lost opportunities. - FY2024-Q1WorsenedAnnual report
「We recognize that the social and economic environment surrounding our company remains unpredictable, given developments toward new regulatory changes concerning climate change and other matters, the increasing risk of cyberattacks and other factors.」
The increasing risk of cyberattacks is specified as a source of uncertainty in the social and economic environment, indicating heightened external pressure on existing risks such as information leaks. - FY2023MitigatedAnnual report
「If important information or other data is leaked at our group or an outsourced service provider as a result of external unauthorized access, an accident while media is being transported, involvement by an insider or other causes, we may incur liability for damages, our group's trust may be impaired, we may become subject to sanctions under applicable laws and regulations, and additional costs may arise in responding to these events. We have established systems for the proper handling of information through organizational, technical, personnel-related and physical measures, including developing rules and other policies concerning information handling, implementing system security measures, providing education and training to officers and employees, and managing access to and exit from facilities.」
The company continues to describe the risk of information leaks and specifies security measures combining policies, systems, education and facility management. - FY2021RestatedAnnual report
「Given the nature of our business, our group acquires, holds and uses information on large numbers of customers. To prevent leaks of important customer information, we have established systems for the proper handling of personal information and implemented various measures, including education and training for officers and employees and system security measures.」
The company continues to describe the risk of leaks involving large volumes of customer information and the measures taken through education, training and system controls. - FY2020ReframedAnnual report
「Our group has implemented various measures against external cyberattacks, including system security measures and education and training for officers and employees. However, if an external cyberattack causes a computer system outage, data tampering, leakage of important information or other problems, and our operations are disrupted by liability for damages, administrative sanctions, damage to the group's creditworthiness or other consequences, our financial results may be affected.」
In addition to the risk of large-scale personal information leaks, the company separately specifies system outages, data tampering and information leaks caused by cyberattacks as risks, and describes measures including education and training. - FY2019MitigatedAnnual report
「Our group handles large volumes of personal information and has established an Information Security Basic Policy, a Personal Information Protection Policy and other policies, while implementing organizational, technical, physical and personnel-related security measures.」
The company continues to describe the risk of personal information leaks and specifies organizational, technical, physical and personnel-related security measures based on its Information Security Basic Policy and other policies. - FY2017First statedAnnual report
「Our group has established a Personal Information Protection Policy and has worked to ensure the proper handling of personal information, including by obtaining PrivacyMark certification in October 2006. However, if personal information is leaked at our company or an outsourced service provider as a result of unauthorized system access, an accident during transportation, involvement by an insider or other causes, and our creditworthiness is damaged, or if we incur liability for damages to individuals or face business-related sanctions, our financial results may be affected.」
Against the backdrop of a business structure involving the handling of large volumes of personal information, the company describes the risk of leaks caused by unauthorized access, transportation accidents, insiders and other factors, as well as the resulting impact.