Japan Data Breaches, Oct–Nov 2026: What Companies Should Check

From October into November 2026, a series of major cyber incidents has been disclosed in Japan. Where the damage occurred varies: e-commerce member data, an email delivery service, a cloud platform and a university's systems.

This article sets out the facts based on each organisation's official announcements and summarises what you should check at your own company. It is not meant to criticise any particular company. Many of the figures and causes are still under investigation. The content is as of 4 November 2026 and may change.

Main incidents disclosed

Nojima: about 7 million e-commerce member records

Nojima announced on 2 November that it had detected unauthorised access to the member management system of "Nojima Online" on 1 November, and had confirmed a leak of personal information the same day. The sites concerned are "Nojima Online" and its "used smartphone buyback site", with about 7 million records (excluding former members).

The information concerned is name, date of birth, gender, address, phone number, email address, login ID and encrypted password. Nojima says that it does not hold credit card information on these two sites. The cause and any secondary damage are under investigation, and the sites concerned are suspended.

Arara: from an email delivery service out to its client companies

Arara disclosed unauthorised access to its email delivery service "Arara Message" on 29 October. In a second report on 2 November, it revealed that the scope of the damage had grown.

• Client company environments: 97 servers, up to about 380 companies (estimated). About 77 million email addresses. This figure includes those possibly taken and is under review, and it does not indicate the number of users.
• Shared environment: 61 client companies. 3,386,187 email addresses, and up to 411,827 customer data records from 5 companies.
• The service was abused to send up to about 7.13 million suspicious emails posing as credit card companies.
• All services were stopped on 31 October, and no date has been set for restarting them. Arara says it does not hold credit card numbers.

On the cause, Arara cites "a web server vulnerability and problems in the system environment". The route of the intrusion and when it began are under investigation.

IDC Frontier: ransomware damage to a cloud platform

IDC Frontier disclosed that part of East Japan Region 1 of "IDCF Cloud" was hit by a ransomware attack in the early hours of 7 October. The attack has affected 495 companies and local governments.

According to its seventh report on 27 October, the cause was a vulnerability in open source software used in the management portal's authentication system. The attacker illicitly obtained administrator privileges on the virtualisation platform and encrypted virtual servers. No trace has been found of data inside the virtual servers leaking outside. On the other hand, the registration information of up to 71 companies was illicitly viewed on the management portal. 206 customer companies were able to retrieve data from backups, and the company says it has neither paid a ransom nor negotiated.

Osaka Metropolitan University: a subcontractor's account misused

At Osaka Metropolitan University, a large-scale failure of the information infrastructure system occurred on 2 October, which also affected classes. On 21 October the university published what NEC had reported to it. A business to which NEC subcontracts system development and maintenance suffered a cyberattack in late September, and that business's legitimate account was used to gain unauthorised access to the university's systems.

A leak of personal information and other data relating to the university, held in cloud storage that NEC was using, has also been reported. The content and number of items are still being confirmed, and the investigation continues into whether anything leaked from the university's virtualisation platform.

JPCERT/CC's alert

On 8 October (updated on the 23rd), JPCERT/CC published an "Alert on the recent string of unauthorised access at organisations in Japan". It does not explain the four cases above. It summarises the methods confirmed in the information leaks that have continued in Japan since around September 2026.

What stands out is that the damage reaches beyond services for general customers to systems that only people inside the company should be using, such as analysis tools and management systems for staff.

What the four cases have in common

Eight things to check at your company

1. Make a list of outside services

   Write down the services that hold your customer information: email delivery, e-commerce, booking, cloud, accounting and so on.

2. Review the information you entrust to them

   Does email delivery really need postal addresses and dates of birth? The best protection is not to register fields you don't use.

3. Delete old data

   JPCERT/CC also recommends deleting data past its retention period and data whose purpose has ended.

4. Check your contractors and subcontractors

   Ask who holds maintenance accounts, whether any work is subcontracted, and whether accounts of people who have left are still active.

5. Protect admin screens

   Turn on multi-factor authentication and restrict where connections can come from. Stop exposing admin functions you don't use.

6. Inspect internal systems and APIs too

   Check whether analysis tools and internal systems can be opened from the internet, and whether APIs have permission checks and rate limits.

7. Keep backups in a separate location

   Store them not only in the same cloud but in a different environment as well, and test that you can actually restore them.

8. Decide your contact procedure in advance

   Decide who makes the call and how you will contact customers and the relevant bodies. A leak of personal data may require a report to the Personal Information Protection Commission and notification of the individuals concerned.

Questions for your contractors

• Which servers or clouds is our information stored on?
• Do you have subcontractors? Can they also get into our systems?
• Do you use multi-factor authentication on maintenance accounts?
• How do you check for vulnerabilities in the software you use?
• If an incident happens, within how many hours will you contact us?

For what to do about specific software, see "What to Do About the WordPress Vulnerability", "What to Do About the Ivanti Vulnerabilities", "What to Do About the PHP Vulnerability" and "What to Do About the GitLab Vulnerability". If you can't reach your contractor, see "Taking Over a Legacy System With No Documentation".

How Digi Dinos can help

Digi Dinos is a software company with offices in Vietnam and Japan. Over 8 years we have delivered more than 150 projects. We are ISO 27001 certified, and our team works in Japanese.

• Review of your internal systems: we sort out which systems hold what information and who maintains them.
• Taking over maintenance of existing systems: PHP, Java, Node.js, Python, .NET and more.
• Responding to new vulnerabilities: when a fix comes out, we assess the impact and apply it.
• No documentation? No problem: even when the original vendor is gone and nobody understands the system, we read the code, rebuild the documentation and propose a complete plan.
• Lifetime warranty: if a defect turns up in work we did, we fix it, with no time limit for as long as the maintenance contract continues.

Frequently asked questions