In the first week of November 2026, Japanese news was full of data breaches. A bulk email service, an online shop's cloud service, a mobile carrier, a loan-guarantee company, and the government's tax system all appeared in headlines within days. If you live in Japan, or you have used Japanese services as a visitor, here is how to read it.
What was reported
| Incident | Type | What was reported |
|---|---|---|
| Arara Message | Bulk email vendor | Parent company says up to about 77 million email addresses leaked, with up to about 380 client companies affected. Credit card numbers were not included. See our report. |
| Iris Ohyama | Online shop's cloud service | The company disclosed that data on up to about 7.7 million people may have been exposed through a third-party cloud service, according to reports. |
| NTT Docomo | Mobile carrier | The company said unauthorized access to its systems exposed personal information of up to about 300,000 customers, according to reports. Counts and details vary between reports. |
| SMBC Consumer Finance | Loan guarantee | About 320,000 people reported affected, and other banks that use its guarantee system also reported impact. |
| e-Tax | Government tax system | Suspended for about a day after suspicious traffic. The agency says taxpayer information was not leaked, but part of the program was copied. See our report. |
These are reported figures. Details can change as investigations continue, so check each company's own notice.
Read the numbers with care
Headline totals can mislead. Figures are "up to" estimates, they come from company statements and the media, and the same person can appear in several breaches. One analysis on Nippon.com put the total of exposed records in Japan in 2026 at roughly 260 million, but a record is not a person, and many people are counted more than once. A tracking site counts dozens of breaches of a million records or more this year. Use these numbers as a sign of scale, not as a count of separate victims.
The pattern: shared vendors and platforms
Not every incident has the same cause. But several share one feature: the data was held not by the brand you deal with, but by a vendor or platform behind it.
- A bulk email vendor sends messages for hundreds of companies, so it holds all their address lists.
- A cloud data service stores customer data for a retailer.
- A loan-guarantee system sits behind many banks.
When such a service is breached, many brands are affected at once, and you may hear about it from a company you had forgotten you used. That is why "I do not use the vendor" is not a defence. You may use a brand that does.
What it means for residents and visitors
The most likely harm is not the leak itself, but what follows:
- Phishing that names a brand you really use. After the Arara incident, reports described fake messages posing as a credit card company.
- Fake text messages and emails in Japanese or English, claiming a problem with an account, a delivery, or a payment.
- Credential reuse attacks, where a password from one site is tried on others.
- Calls or messages pretending to come from a carrier or a bank.
Visitors are not exempt. If you booked tours, shopping, or leisure activities through Japanese platforms, your address may sit in a list that attackers can use, long after you have gone home.
A ten-minute response plan
- Do not tap links in texts or emails that mention accounts, payments, deliveries, or tax. Open the official app, or type the address yourself.
- Use a unique password for every service, with a password manager. See password manager in 20 minutes.
- Turn on two-factor sign-in for email, banking, and card accounts, preferably with an authenticator app or passkey. See new phone and two-factor codes if you will change phones.
- Check your card statements and enable transaction alerts.
- Read the notice from any company you use that appears in the news, to see what data it held about you.
- If you clicked, follow what to do in the first hour. If an account looks taken over, see account hacked.
For Japan-specific scams, see fake delivery texts in Japan, why Japanese sites reject foreign cards, and Japanese phone numbers and SMS verification.
What businesses can learn
- Know where your customer data lives, including in vendors.
- Ask vendors hard questions about admin access, multi-factor authentication, exports, and logging.
- Limit what you send to third parties.
- Prepare to notify customers quickly, and in the language they read.
- Remember the law: Japan's privacy law requires reporting certain breaches to the regulator and informing the people affected.
Sources
- Nippon.com / Jiji Press: 77 M. Email Addresses Leak from Arara Message
- Nippon.com: NTT Docomo Chief Says Personal Info Breached in Cyberattack
- BleepingComputer: Iris Ohyama data cloud breach exposes info of 7.7 million customers
- Japan Cyber Watch: Japan's 2026 Data Breaches by the Numbers
- Jiji Press: e-Tax operation resumes; part of program leaked (Japanese)
Reported as of November 8, 2026. Figures are reported estimates and may change. Check each company's own notice.