Japan Data Breaches Top 260 Million People in Fiscal 2026

Japan's Personal Information Protection Commission (PPC) has reported that personal data belonging to roughly 260 million people leaked between April 1 and October 16, 2026. The figure was presented on October 28.

The number appears in a reference document titled "Recent trends in personal data leaks caused by unauthorized access," distributed at the commission's 374th meeting. It is a cumulative total across multiple services, so it likely includes duplicates, meaning the same person may be counted more than once.

October sees a sharp spike

Reports had been rising since May, but October brought a steep jump. The month now accounts for about 40% of all reports filed this fiscal year.

Several October incidents each affected more than 10 million people. They include about 22.52 million records at Sourcenext, 14.64 million at skyticket, 11.18 million at Burger King Japan and 10.78 million at the Yakiniku King restaurant chain. The tally does not yet include the most recent case: parcel carrier Sagawa Express, where unauthorized access exposed about 53.23 million records.

What the regulator is asking

The PPC issued a public warning on October 7 about the string of leaks hitting web services, e-commerce sites and apps. It urged operators to review their security management measures and to make sure personal data that is no longer needed is deleted. Holding less data limits the damage when a breach occurs.

The Information-technology Promotion Agency (IPA) and other bodies have also published cybersecurity guidance for individuals. For consumers, the scale of the leaks means changing reused passwords and staying alert to phishing messages that exploit exposed email addresses and phone numbers.