Japan Data Breaches Hit 260 Million Victims in Six Months

Japan's Personal Information Protection Commission said on October 28 that incidents of unauthorized access involving leaked or potentially leaked personal data affected a cumulative 260 million people between April 1 and October 16, 2026. That is more than double Japan's total population as of October 1, according to the Statistics Bureau of the Ministry of Internal Affairs and Communications.

Reports accelerate sharply

The commission's data shows 2,094 reported cases over the period. Monthly counts were nearly flat in April (166) and May (163), then rose gradually through summer: 185 in June, 212 in July and 235 in August. September jumped to 303 cases, and October reached 830 by the 16th, about 2.7 times the September total in only half a month.

October alone accounts for roughly 40 percent of all cases in the period. The daily rate climbed to about 52 reports, more than five times the roughly 10 per day recorded in September.

What the figure does and does not mean

The 260 million figure is a cumulative total that includes duplicates, so it does not mean 260 million separate individuals were affected. The count also covers cases where data may have been exposed, not only confirmed leaks.

The tally is limited to incidents that private companies reported directly to the commission. Reports routed through supervising ministries and those from government bodies are excluded. Because the numbers rely on preliminary information, they may change as investigations conclude.

The figures come amid a run of high-profile incidents in Japan, including suspected unauthorized access at the logistics firm Sagawa and at airline reservation systems. For consumers, the data underlines how often personal information is now exposed, while companies face pressure to harden servers and vendors that handle customer data.