Exposure to Personal Data Breaches and Cyberattacks
First written in FY2019. 5 of 12 entries say "Materialised", first in FY2021. Latest entry: 2026-06-01.
The whole theme swung hardest in 2024: 13 of 87 companies on the "Worse" side.
- FY2026-H1MaterialisedAnnual report
「On 19 October 2025, we confirmed that a system failure caused by a ransomware infection had occurred at our subsidiary ASKUL Corporation. We are working with external experts and relevant organisations to investigate the scope of the impact, including any leakage of personal information, customer data or other information outside the company, and to restore the systems.」
After the end of the interim period, a system failure caused by a ransomware infection occurred at subsidiary ASKUL Corporation. The scope of the impact, including any leakage of personal information and customer data, is under investigation, and the impact on operating results is also being assessed. - FY2025MaterialisedAnnual report
「In November 2024, a defect occurred in the LINE Album service provided by the company, whereby image data belonging to other users was inadvertently included in album thumbnail images, and the company received administrative guidance from the Ministry of Internal Affairs and Communications on 8 March 2025.」
In addition to the previously disclosed unauthorised access incident, a defect in the display of images in LINE Album occurred, leading to administrative guidance from the Ministry of Internal Affairs and Communications. Measures to prevent recurrence and strengthen data governance continue to be implemented. - FY2024MaterialisedAnnual report
「In addition, regarding the unauthorised access incident announced by LINE Yahoo㈱ on 27 November 2023, LINE Yahoo㈱ reported the matter to the Ministry of Internal Affairs and Communications and the Personal Information Protection Commission, received administrative guidance from the Ministry of Internal Affairs and Communications on 5 March and 16 April 2024, and received a recommendation and requests for reports and other information from the Personal Information Protection Commission on 28 March 2024.」
An actual unauthorised access and information leakage incident at LINE Yahoo developed into administrative guidance from the Ministry of Internal Affairs and Communications and recommendations from the Personal Information Protection Commission. Measures to prevent recurrence and strengthen data governance are being implemented. - FY2024-Q3Adds a new analysis of improper-use risks and data governance measures.Annual report
「The group is maintaining and managing its security level by strengthening AI-based detection of indications of internal misconduct, including behavioural detection, monitoring officers' and employees' use of work computers, internal network usage and access to internal servers, and monitoring and protecting against unauthorised access arising from external cyberattacks. In addition, if the group's products or services are misused for fraud or other crimes, this could lead to a decline in confidence in and trust of the group.」
For personal information and cyber risks, describes measures including enhanced AI-based detection of indications of internal misconduct, and adds the risk of products and services being misused for fraud and other crimes, together with the data governance of the LINE Yahoo group following the reorganisation. - FY2023WorsenedAnnual report
「The field of generative AI, represented by ChatGPT in particular, is developing rapidly and is expected to have a significant impact on existing business models.」
Adds risks of information leakage and personal information protection concerns arising from generative AI, as well as the risk of unauthorised use of services, to the personal information and cyber risk discussion. - FY2022WorsenedAnnual report
「In addition, following the management integration of Z Holdings㈱ and LINE㈱, the volume of data, including personal information, handled by the group has increased substantially. The group will work to strengthen group-wide governance for the proper handling of personal information, but ineffective measures or governance enhancements could result in administrative sanctions imposed on the group by the authorities, damage to the group's reputation, reduced demand for its services, the development and implementation of additional measures, and data leaks or other incidents posing a risk of data leakage, which could affect the group's business development, financial position and operating results.」
Newly states that the volume of data handled increased substantially following the LINE integration and specifies the risks of administrative sanctions, reputational damage and data leaks if group-wide personal information governance fails to function. - FY2021MaterialisedAnnual report
「On 17 March 2021, LINE㈱ announced that it had granted an affiliated company in China, which was a contractor, access rights to view certain personal information obtained from users. Although no unauthorised external access or information leakage has been confirmed in this matter, the group considers it a serious incident because certain aspects of its security management measures and explanations to users were inadequate.」
Disclosed an actual incident involving the granting of access rights to personal information and inadequacies in security management and explanations. States that no unauthorised external access or information leakage has been confirmed. - FY2020RestatedAnnual report
「Despite these initiatives, the group's information may be leaked or lost as a result of intentional or negligent acts by the group's officers, employees or contractors, or cyberattacks, hacking, computer virus infections and other unauthorised access by malicious third parties.」
Continues to describe cyberattack and information leakage risks and explains measures including a SOC, access monitoring, protection and training. - FY2019First statedAnnual report
「The group's information may be leaked or lost as a result of intentional or negligent acts by the group's officers, employees or contractors, or cyberattacks, hacking and other unauthorised access by malicious third parties.」
Identifies the leakage of customer and confidential information, cyberattacks and unauthorised access, together with the resulting loss of trust, damages claims and remediation costs, as risks.