Country
Japanese car-care products maker Soft99 announced on Nov 10 that its official online shop was accessed by an outside third party, and personal data of up to 136,968 members and shoppers may have leaked .
The Japan Chamber of Commerce and Industry (JCCI) announced on Nov 10 that the external exam management server used for its online tests was accessed without authorization, and data of up to about 980,000 examinees (about 1.
NTT Data announced on Nov 9 that the sign-up service for Sumitomo Life's standalone Vitality programs, which it builds and operates under contract, was accessed by a third party and personal data of about 80,000 users leaked .
Japanese furniture retailer Nitori Holdings said on November 9 that it confirmed unauthorized third-party access to a system it manages on November 6 and that up to 37.
Japanese indoor golf school operator Step Golf said in a second notice on Nov 10 that it was accessed without authorization on Oct 23 and 25, and database backup files containing personal data were very likely leaked .
Japan's Doutor Coffee said on November 6 that its payment processor reported suspicious activity on its official online shop on October 28, and an investigation by its outsourced developer found a third party had accessed the site's admin panel on October 24-25 and exported and viewed member data .
According to Security NEXT, Yakult discovered a third-party intrusion into its website on October 26, 2026, and confirmed by November 4 that a total of 39,505 personal data records had been leaked .
According to Security NEXT, NTT Docomo detected an external intrusion into its Online Shop and My docomo services on November 4, 2026, suspending application procedures on both services for maintenance early the next morning .
According to Security NEXT, Nojima detected an attack on its online store member management system on November 1, 2026, and subsequent investigation confirmed a data breach affecting members of both its online store and used mobile phone buyback website .
The Japan Network Security Association (JNSA) announced on November 6 that its "Information Security Comprehension Test Service" suffered unauthorized third-party access, potentially exposing personal data for up to approximately 15,128 users .
According to Security NEXT, the Tokyo Metropolitan Bureau of Waterworks discovered on October 2, 2026, that only empty storage boxes remained inside a locked cabinet while four hard drives were missing .
According to Security NEXT, Denny's Japan discovered on October 30, 2026 that application-related systems had been breached by a third party, potentially exposing personal data of legacy app customers .
According to Security NEXT, the operator of Sukesan Udon stated that a server misconfiguration at contractor Caho Enterprise may have allowed external parties to view personal data of current and former employees .
According to Security NEXT, an improperly configured application file on the website for Fukuoka Prefecture's nursing care workplace certification program allowed personal data of 183 corporate officers across 24 organizations to be viewed by third parties .
According to Security NEXT, during an inventory check on September 9, 2026, Nara Prefecture discovered that a USB flash drive used for data exchange with its pharmaceutical and medical device application review system was missing .
MS&AD group insurers Mitsui Sumitomo Insurance and Aioi Nissay Dowa said on Nov 6 that unauthorized access to their policyholder portal was detected on the night of Nov 2, related services were halted late on Nov 3, and the investigation confirmed a data leak .
Kyocera Communication Systems (KCCS) issued a second update on November 6 stating that a web server operated by its subsidiary MOTEX suffered unauthorized access, potentially exposing customer information including company names, personal names, email addresses, and phone numbers .
According to Security NEXT, istyle confirmed on October 28, 2026, that @cosme suffered an intrusion exposing data for some shared-ID members .
According to Security NEXT, Club Tourism detected third-party access to its servers on October 30, 2026; subsequent investigation confirmed the intrusion vector and method, indicating that some personal data may have been exfiltrated .
According to Security NEXT, Japan's Ministry of Foreign Affairs (MOFA) detected an intrusion on an externally connected network on July 27, 2026, and subsequently blocked access and disabled authentication credentials .