Incidents in country:
28 incidents catalogued
BK Japan, the operator of Burger King's Japanese mobile app, confirmed unauthorized access to its member database exposing about 11.18 million records.
Japanese second-hand retailer Bookoff Group disclosed that unauthorized access to a subsidiary's membership system may have leaked the personal data of up to about 6.43 million member records.
Japanese karaoke giant Daiichi Kosho warned that a malware infection at an external contractor may have exposed the personal data of about 8.6 million customers and 93,000 others handled on its behalf.
A ransomware attack on SoftBank subsidiary IDC Frontier triggered an automatic shutdown of its IDCF Cloud platform in eastern Japan, knocking out websites for local governments and companies.
Japanese semiconductor test-equipment maker Advantest began notifying individuals that a February 2026 ransomware intrusion had exfiltrated personal data, including Social Security and passport numbers.
Osaka Metropolitan University said a suspected ransomware attack took down about 500 servers and may have exposed data on at least 130,000 students and staff.
Tokyo Metro disclosed that an unauthorised third party had accessed the email addresses of roughly 59,000 customers enrolled in its Metpo loyalty programme, warning members to watch for follow-on phishing attempts.
A ransomware attack in the early hours of 26 September 2026 disrupted business systems across Japan's Keio Group, hitting payment and reservation services in its hospitality division while train operations continued to run normally.
Japanese mobility group Park24 said unauthorized access to its Times Car car-sharing system exposed personal data, including driver's license images, for about 6.6 million members.
Helpfeel's image-sharing service Gyazo disclosed that an attacker exploited a flaw in its image-upload server to run commands and reach its database, exposing about 23.6 million user records and roughly 490 million image metadata records.
Japan's Digital Agency disclosed that attackers exploited a vulnerability in a VPN product to access its Government Solution Service and steal personal information belonging to roughly 240,000 people, using a maintenance employee's account.
Japanese cloud and data center provider Sakura Internet said an investigation into a rental-server intrusion uncovered unauthorized access to its sales management system, potentially exposing member and contract data on up to 1,360,563 accounts.
Nihon Kotsu, Japan's largest taxi operator, disclosed that a malware infection had forced it to take core systems offline, knocking out its telephone dispatch, web booking and reservation services while it investigates whether any data was stolen.
Aflac disclosed that attackers who breached its Japanese subsidiary's policyholder portal exfiltrated the personal information of roughly 4.38 million customers and insurance agents.
Japanese beverage group Sapporo Holdings disclosed suspected unauthorised access at its overseas subsidiaries Pokka in Singapore and Sleeman Breweries in Canada, shutting down affected systems to investigate.
A flaw in third-party software let attackers breach the shared email platform KDDI operates for six Japanese ISPs, potentially exposing up to 14.22 million email addresses and passwords.
Japanese motor and electronics giant Nidec confirmed a ransomware attack on its Taiwanese subsidiary Nidec Chaun Choung Technology, after which the Blackfield gang claimed the breach and demanded a $2 million ransom.
A dataset dubbed FortiBleed exposed valid Fortinet FortiGate VPN credentials — including plaintext passwords — for 73,932 firewall URLs across 194 countries, the product of a Russian-speaking crew that reused passwords from earlier breaches and infostealer logs rather than any new Fortinet vulnerability.
Qilin ransomware operators encrypted servers across Asahi's Japanese data centres, halting ordering, shipment, and production at 30 factories, leaking 27 GB of internal data, and exposing personal information of approximately 1.5 million customers, employees, and contacts.
Phishing access let BlackSuit (Russian-linked) encrypt KADOKAWA's infrastructure and the Niconico video-sharing platform, taking services offline for two months. KADOKAWA paid ~$2.9M in cryptocurrency — and BlackSuit leaked the stolen 1.5 TB anyway.
In October 2023, the Japanese consultancy firm Toumei suffered a data breach. The breach exposed over 100M lines and 10GB of data including 77k unique email addresses along with names, phone numbers and physical addresses.
In January 2023, the Japanese arm of Zurich insurance suffered a data breach that exposed 2.6M customer records with over 756k unique email addresses. The data was subsequently posted to a popular hacking forum and also included names, genders, dates of birth and details of insured vehicles.
An attack on Toyota plastics-and-electronics supplier Kojima Industries paralysed one server enough to halt production at all 14 of Toyota's Japanese plants — about 13,000 vehicles of daily output — making the case the canonical example of just-in-time manufacturing's cyber-fragility.
Tokyo-based cryptocurrency exchange Coincheck lost 523 million NEM tokens (~$530M at the time) from a hot wallet that had no multi-signature protection. The largest single crypto-exchange theft at the time — later attributed to North Korea's Lazarus Group.