かっことリンク jointly released the Cashless Security Report 2026, which summarizes trends in fraudulent e-commerce use and statistics on card-information breaches. The report discusses incidents in 2025 and trends in countermeasures for fiscal 2026.
かっこ provides e-commerce operators with fraud-detection solutions to combat fraudulent logins and orders, as well as information leaks and impersonation throughout the process from account opening to transactions. It has now jointly released a report with リンク, which provides cloud-hosting and security-related services, summarizing statistics on credit-card information breaches and trends in fraudulent e-commerce use.
The report consists of ① an overview of card-information breaches in 2025, ② an overview of fraudulent use in e-commerce, ③ other cashless-security topics, and ④ policy trends. The number of exposed card records in 2025 was 246,474, while the number of data-breach incidents was 21, the lowest level since 2020.
In 2025, it was disclosed that approximately 127,000 records in a supermarket's member and points-management system may have been accessed without authorization in a ransomware attack. The report points out that merchants were required to identify card information remaining outside payment systems and check their compliance with PCI DSS.
Losses from fraudulent card use totaled ¥51.05 billion. Although the effects of EMV 3-D Secure adoption were evident, attacks targeting merchants that had not adopted it and theft of one-time passwords were said to be continuing. The share of fraudulent orders of ¥10,000 or less rose from 19.3% in 2023 to 29.8% in 2025, reportedly reflecting the impact of authorization-related factors and reselling targeting products limited to first-time purchasers.