Nippon Kotsu announced that personal information relating to up to approximately 290,000 people may have been leaked following unauthorized access to its internal systems. Those affected include applicants, employees and their families, and people involved in accidents, while the information may also include My Number and medical examination results.
Nippon Kotsu announced that unauthorized access to its internal systems occurred on 30 October 2026 and that, following an investigation lasting approximately three and a half months with the involvement of external organisations, it had been determined that personal information relating to up to approximately 290,000 people may have been leaked. Those affected include limousine-service customers, former job applicants, employees and former employees, employees’ family members, and personnel at business partners.
The information that may have been leaked includes basic information such as names, addresses and dates of birth, as well as driver’s licences, residence cards, facial photographs and bank account information. It was also reported that, in some cases involving crew members and staff and their family members, My Number was among the information affected. There is also a possibility that sensitive information, including crew members’ medical examination results and injury details related to accident response, was leaked.
The incident could also affect companies, with the leakage of personal information potentially extending to organisations that have business relationships with Nippon Kotsu. Tokyo Electric Power Company Holdings announced that the names and home addresses of its limousine-service users, among other information, may have been leaked, and said it had completed reports to the Personal Information Protection Commission and the police. No secondary harm from unauthorised use has been confirmed at this time, but the seriousness of the situation has been highlighted.