Large-scale breach disclosures surged in Japan in autumn 2026, highlighting intrusions through subcontractors and the increasing sophistication of AI-enabled attacks. The report summarizes the disclosed cases and their scope of impact.
The incidents that occurred in succession this autumn included a ransomware attack on the Keio Electric Railway Group that caused server outages. Although railway operations were not affected, the number of leaked records has not been disclosed. Since late September, an unauthorized access incident at Times Mobility has raised the possibility that images of more than approximately 1.6 million identity verification documents were affected, while Dai-ichi Life examined the potential impact on personnel information relating to approximately 120,000 current and former employees.
At Nikkei Inc., the hijacking of an employee's Microsoft 365 account raised concerns about the leakage of information relating to approximately 1,646 people. In a separate incident involving unauthorized access through a subcontractor's server at Daiwa Securities, approximately 220,000 records were disclosed as within the scope of impact. Around the same time, an incident came to light in which unauthorized logins through the management site of スカラコミュニケーションズ potentially spread inquiry information relating to as many as approximately 713,126 cases across multiple companies.
In addition, an intrusion resulting from the misuse of a VPN account at 両毛システムズ led to the impact expanding to 9 organizations in total, comprising 8 gas operators and 1 local government. The impact of supply-chain incidents is also reflected in an IPA survey, which identified intrusions through business partners in approximately 19.8% of cases, suggesting that effects on business partners account for most of the damage.
Three common factors have emerged in these incidents: automation using AI, gaps in investment, and intrusion routes through external subcontractors. The situation has become clear in which attackers cannot be allowed to slow their pace. The concentration of disclosures may also have been influenced by the establishment of reporting practices and a trend toward early disclosure.