Incidents in country:
15 incidents catalogued
Aflac disclosed that attackers who breached its Japanese subsidiary's policyholder portal exfiltrated the personal information of roughly 4.38 million customers and insurance agents.
Japanese beverage group Sapporo Holdings disclosed suspected unauthorised access at its overseas subsidiaries Pokka in Singapore and Sleeman Breweries in Canada, shutting down affected systems to investigate.
A flaw in third-party software let attackers breach the shared email platform KDDI operates for six Japanese ISPs, potentially exposing up to 14.22 million email addresses and passwords.
Japanese motor and electronics giant Nidec confirmed a ransomware attack on its Taiwanese subsidiary Nidec Chaun Choung Technology, after which the Blackfield gang claimed the breach and demanded a $2 million ransom.
A dataset dubbed FortiBleed exposed valid Fortinet FortiGate VPN credentials — including plaintext passwords — for 73,932 firewall URLs across 194 countries, the product of a Russian-speaking crew that reused passwords from earlier breaches and infostealer logs rather than any new Fortinet vulnerability.
Qilin ransomware operators encrypted servers across Asahi's Japanese data centres, halting ordering, shipment, and production at 30 factories, leaking 27 GB of internal data, and exposing personal information of approximately 1.5 million customers, employees, and contacts.
Phishing access let BlackSuit (Russian-linked) encrypt KADOKAWA's infrastructure and the Niconico video-sharing platform, taking services offline for two months. KADOKAWA paid ~$2.9M in cryptocurrency — and BlackSuit leaked the stolen 1.5 TB anyway.
In October 2023, the Japanese consultancy firm Toumei suffered a data breach. The breach exposed over 100M lines and 10GB of data including 77k unique email addresses along with names, phone numbers and physical addresses.
In January 2023, the Japanese arm of Zurich insurance suffered a data breach that exposed 2.6M customer records with over 756k unique email addresses. The data was subsequently posted to a popular hacking forum and also included names, genders, dates of birth and details of insured vehicles.
An attack on Toyota plastics-and-electronics supplier Kojima Industries paralysed one server enough to halt production at all 14 of Toyota's Japanese plants — about 13,000 vehicles of daily output — making the case the canonical example of just-in-time manufacturing's cyber-fragility.
Tokyo-based cryptocurrency exchange Coincheck lost 523 million NEM tokens (~$530M at the time) from a hot wallet that had no multi-signature protection. The largest single crypto-exchange theft at the time — later attributed to North Korea's Lazarus Group.
A spear-phishing email carrying PlugX malware breached Japan's largest travel agency JTB, exposing personal data — including thousands of passport numbers — for up to 7.93 million customers.
A targeted phishing email carrying malware breached the Japan Pension Service, leaking the names, IDs, addresses, and birth dates of about 1.25 million pension enrollees and forcing a national rethink of public-sector cybersecurity.
A contractor's system engineer copied 35 million customer records from Japanese education giant Benesse onto a personal device and sold them to data brokers — the largest insider data theft in Japanese history, triggering a ¥20 billion compensation programme.
Intruders penetrated Sony's PlayStation Network and Qriocity, compromising personal data on roughly 77 million accounts and forcing a 23-day global outage — one of the largest consumer data breaches of its time.