Japan Confronts Wave of Cyberattacks and Data Breaches

In early October 2026 a series of unrelated cyber incidents exposed personal data belonging to millions of Japanese consumers, members, students and teachers. The breaches involved a restaurant-reservation app, a securities-brokerage inquiry platform, a market-research survey site, a discount-store e-commerce server, and a university information system. Compromised records include names, email addresses, phone numbers, membership numbers and, in one case, bank-card details. No confirmed misuse of the stolen information was reported at the time of disclosure.

Japan data breaches expose millions of customer records Data of over 10M customers exposed in cyberattacks on Japanese firms Japan hit by string of cyberattacks, data breaches affecting millions Japan reports widespread data breaches and cyberattacks hitting businesses and academic institutions

• October 5, 2026 – Monogatari Corp., operator of the Yakiniku King restaurant chain, announced unauthorized access to its reservation and rewards app, leaking data for more than 10 million customers. The same day, Daiwa Securities Group disclosed a contractor-operated server breach that could expose data for about 110 000 brokerage customers and roughly 220 000 records overall.

Data of over 10M customers exposed in cyberattacks on Japanese firms

• October 6, 2026 – GMO Research & AI Inc. said up to 948 500 member records were stolen; Max Holdings Ltd. confirmed personal data of up to 1.7 million online-shopping customers may have been compromised; Osaka Metropolitan University reported that information on at least 130 000 students and staff could have been exposed after a ransomware attack disabled about 500 servers.

Japan reports widespread data breaches and cyberattacks hitting businesses and academic institutions

• Monogatari Corp. (Yakiniku King) – “more than 10 million” customer records.

Japan data breaches expose millions of customer records

• Daiwa Securities Group – data for “around 110 000” brokerage clients; total of “about 220 000” records when non-personal inquiries are included.

Japan data breaches expose millions of customer records

• GMO Research & AI Inc. – “up to 948 500” user accounts on its infoQ survey platform.

Japan Times

• Max Holdings Ltd. – personal data of “up to 1.7 million” discount-store customers.

Japan reports widespread data breaches and cyberattacks hitting businesses and academic institutions

• Osaka Metropolitan University – personal information of “at least 130 000” students and teachers.

Japan hit by string of cyberattacks, data breaches affecting millions

Chief Cabinet Secretary Minoru Kihara said authorities are “taking these incidents very seriously” and are gathering information from the affected organisations to assess overall damage. The National Police Agency, together with external firm ResearchWorks, is conducting a nationwide survey of unauthorized-access incidents; findings are slated for release in March 2027. The Digital Agency has advised the public to avoid password reuse, enable multi-factor authentication and be cautious with suspicious links. Kihara noted ongoing collaboration with overseas cybersecurity organisations and investigative authorities.

Japan Times

• “At this point, it is not clear whether these incidents are related, but we are working to grasp the overall picture of the damage by gathering information from those involved and analyzing the methods and trends of the attacks,” — Minoru Kihara, chief cabinet secretary

Japan Times

Sources differ on the exact magnitude of the Yakiniku King breach: Monogatari Corp. cited “more than 10 million” records, while another outlet referenced “more than 10.7 million” users. No source has confirmed a causal link among the separate incidents, and investigators have not disclosed whether the same threat actors were involved. Details on the specific methods used in each intrusion remain limited; the forthcoming police-agency survey is expected to address these gaps.

Japan data breaches expose millions of customer records

The joint police-agency survey with ResearchWorks will publish its analysis in March 2027, providing a consolidated view of attack vectors and trends. Companies continue to work with external security specialists and law-enforcement agencies to remediate vulnerabilities and prevent further unauthorized access.

Japan Times