The number of personal data breaches in Japan is expanding rapidly. From 1 April through 16 October 2026, leaks and other incidents resulting from unauthorized access totaled 2,094. The total volume of leaked data was equivalent to approximately 260 million people, more than twice Japan's total population. There are concerns that secondary harm, including fraud and impersonation-related losses, could spread.
According to figures compiled by the Personal Information Protection Commission, the number of incidents involving leaks and other exposures of personal data resulting from unauthorized access, reported directly by private-sector operators between 1 April and 16 October 2026, reached 2,094. The monthly total surged from 166 cases in April to 303 in September and 830 through 16 October. A total of 41 large-scale incidents were confirmed during the period.
Of these, 41 were large-scale incidents in which data on more than 1 million people was leaked, including 22 reported between 1 and 16 October. The figures are preliminary and may change, but the situation is currently considered serious.
The government has also stepped up its response. The Personal Information Protection Commission issued an alert regarding large-scale data breaches on 7 October, followed by calls for countermeasures from JPCERT/CC on 8 October and the National Cybersecurity Office and the Information-technology Promotion Agency on 9 October. The impact extends beyond services for general users to systems for corporate employees and systems operated by external contractors.
Companies are being urged to urgently inspect publicly accessible servers and APIs, implement multifactor authentication, review access permissions, address vulnerabilities and delete unnecessary data. Meanwhile, it is difficult to recover information that has already been leaked, and the leakage of identity verification information creates a risk of contracts entered into through impersonation and unauthorized use.