Cacco Inc. and Link published an annual report. The number of card data breach incidents fell in 2025, while losses from fraudulent use remained elevated at ¥51.05 billion.
Cacco Inc. and ㈱リンク published the annual report “Cashless Security Report 2026,” which compiles statistics on credit card data breaches and trends in fraudulent use in e-commerce. There were 21 card data breach incidents in 2025, down approximately 43% year on year, while 246,474 records were compromised, down approximately 54%, bringing both figures to their lowest levels since 2020.
Managing card data held outside payment systems and checking compliance with PCI DSS have emerged as new challenges. It was announced that a ransomware attack on a supermarket operator may have resulted in the unauthorised viewing of approximately 127,000 card records issued by the company.
Losses from fraudulent use were ¥51.05 billion, below the previous year’s ¥55.50 billion for the first time in 10 years, but remained elevated. Although the introduction of EMV 3-D Secure is showing results, attacks are becoming concentrated on merchants that have not introduced the system, while real-time theft of one-time passwords through phishing is widespread. In addition, the proportion of fraudulent orders of ¥10,000 or less rose from 19.3% in 2023 to 29.8% in 2025.
The report also discusses the expected sharp increase in fake CEO scams, developments in the SCS assessment system, and the impact on cashless security of generative AI and the emergence of AI agents.