In brief
The Personal Information Protection Commission reported over 2,000 incidents from April to mid‑October, including six that affected more than 10 million people each. Major firms such as Sony Life, Don Quijote, Bandai Namco, Kyushu University, Ryohin Keikaku, Matsuya Foods, and All Nippon Airways were cited. Minister Minoru Kihara warned of rapid growth of large‑scale leaks, announcing emergency countermeasures.
In a sweeping disclosure released on October 31, Japan’s Personal Information Protection Commission announced that the personal data of approximately 260 million people had been compromised from the start of the current fiscal year in April to mid‑October, according to reports filed by companies outside the financial and telecommunications sectors.
The figure, roughly twice the country’s total population, was derived from 2,094 separate incidents of unauthorized access reported between April 1 and October 16. Many individuals were counted more than once because a single person’s data appeared in multiple breaches, the commission noted, hinting that the actual number of distinct victims could be smaller but the overall exposure remains enormous.
Six of the reported events involved leaks that each affected more than 10 million people, the commission said. This threshold underscores a growing trend toward massive‑scale data exposures rather than isolated, small‑scale incidents.
Among the companies and institutions affected were Sony Life Insurance Co., discount retailer Don Quijote, video‑game publisher Bandai Namco Entertainment Inc., and Kyushu University and its affiliated hospital, which announced data compromises following unauthorized access to their websites or other systems. Friday’s reports added Ryohin Keikaku Co., the operator of the Muji brand; Matsuya Foods Holdings Co.; and All Nippon Airways Co., as potential victims of similar leaks.
The week of October showed a stark surge: 830 incidents were reported in the first half of the month alone, compared with 303 incidents for the entire September. The overall number of breaches for fiscal 2025 was 1,256, according to Kyodo News, indicating a near‑doubling in the kind of large‑scale attacks witnessed in the last six months.
Because the commission’s data excludes financial and telecommunications firms, experts warn that the total tally may be understated, raising questions about how many more people could have been penalized by breaches that remain unreported to the agency.
Chief Cabinet Secretary Minoru Kihara took the podium at a press conference on Friday to confirm the urgency of the situation. He said, “The number of large‑scale leaks is increasing rapidly, and the government is taking the situation very seriously.” He also announced that the government will compile a package of emergency countermeasures quickly.
“The number of large‑scale leaks is increasing rapidly, and the government is taking the situation very seriously.”
In an accompanying statement, Kihara added that the package would include measures “to strengthen security systems, clarify privacy obligations, and coordinate with affected industries.” The rollout of these countermeasures is expected to proceed over the next few weeks, but the commission did not specify a timeline for when mandatory compliance would be enforced.
Uncertainties remain over the long‑term impact on the affected individuals, the precise extent of overlaps in data sets, and whether the surge of attacks is part of a larger, global threat pattern that is still unfolding. The commission has asked for more detailed reporting from companies with privacy responsibilities, but the exact thresholds for continued disclosure are yet to be clarified. For now, the picture is one of alarming scale, unsubstantiated gaps, and an evolving response that has yet to resolve how many more lives may be vulnerable to this wave of cyberattacks.
