Personal data leaks have occurred one after another at Japanese companies and local governments, with more than 600 publicly reported incidents as of the end of September 2026. Large-scale breaches have also occurred, including the approximately 6.6 million records involved in the Times Car incident, while the misuse of AI has been cited as accelerating attacks.
Personal data leaks have occurred one after another in Japan. According to a cybersecurity industry survey, more than 600 incidents had been publicly reported in the current fiscal year as of the end of September, a substantial increase from 2024 and 2025. This trend has prompted some to describe the situation as the worst deterioration seen in the past three years.
In a case made public in late September, Times Car suffered unauthorized access to its systems, exposing approximately 6.6 million records of personal information, including driver's license details. The leakage of data containing identity-verification elements could increase the risk of future misuse, such as for opening bank accounts.
Since then, it has been disclosed that information involving JR East's Ekinet reservation website and its affiliated company Viewcard could potentially have been exposed, with a maximum combined total of approximately 6.09 million records. Bookoff Group Holdings disclosed the potential exposure of approximately 6.43 million records, while Adventure, the operator of Skyticket, disclosed the potential exposure of approximately 14.64 million records. These incidents have been identified as cases in which multiple types of information may have been leaked simultaneously.
Experts have analyzed the misuse of AI as a contributing factor and have pointed to improvements in the ability to use AI to discover vulnerabilities. In practice, there is a view that increasingly advanced models hosted in the cloud are being used in more cases to execute attacks in less time than before.