Japan Data Breaches, Early November 2026: A Summary

Since the start of November 2026, large organisations in Japan have been disclosing unauthorised access one after another. On 6 November alone, NTT DOCOMO, Rohto Pharmaceutical, Aioi Nissay Dowa Insurance, Mitsui Sumitomo Insurance, TeamSpirit and the Japan Network Security Association (JNSA) made disclosures in succession.

This article sets out the facts based on each organisation's official announcements and summarises what you should check at your own company. It is not meant to criticise any particular organisation. The content is as of 8 November 2026, and because investigations are continuing, it may change.

Main incidents disclosed

※ The unit of count differs by organisation (people, records), so the figures are not suited to adding up or comparing.

NTT DOCOMO: online shop and My docomo

NTT DOCOMO announced that on 4 November it had confirmed unauthorised access from outside to docomo Online Shop and My docomo, and that it had suspended various procedures from around 1:05 a.m. on 5 November. According to its third report, as of 6 p.m. on 6 November, up to about 300,000 records are subject to the leak. Regarding the press conference on the 6th, the figure has been reported as up to 294,839 records (204,157 for individuals, 90,682 for corporate customers).

For everyone concerned, the information includes name, date of birth, address, phone number, email address, identity document numbers, contract details and more. For some people, it also includes the name of their financial institution, their account number and so on.

On the cause, the third report says "unauthorised access from outside", and that the investigation into the route of intrusion and other points will continue. According to press reports, the company explained at the press conference that it was "not a vulnerability in the system itself, but misuse of a mechanism linking multiple systems", and stated that it was "not a so-called API attack". The outlook for restoring service after the emergency maintenance is undecided. It has also been reported that the company is considering making consolation payments.

Rohto Pharmaceutical: call recordings and customer information

On 6 November, Rohto Pharmaceutical published the results of its investigation into unauthorised access it confirmed in September 2026. It says that, through unauthorised access to the telephone system and customer management system used for mail-order customer support, the names, addresses and phone numbers of 2,797,545 people (the items differ by person) were illicitly obtained.

In addition, call audio data from certain periods between 10 September 2025 and 5 September 2026 was also obtained, and of this, the data for 9,715 people contained credit card numbers and expiry dates. The company says it does not obtain or store security codes, and that these are not included.

On the cause, the company says it has confirmed that telephone system account information was misused by a third party, and that information in the customer management system was also obtained via the telephone system. The company has stopped taking card numbers over the phone and has switched to paper-based procedures. It has asked card companies not to charge customers for reissuing cards. As of 6 November, no secondary damage has been confirmed.

Aioi Nissay Dowa Insurance and Mitsui Sumitomo Insurance: policyholder pages

On 6 November, the two MS&AD Insurance Group companies each disclosed unauthorised access to their "policyholder-only page" and a leak of information. Both say they detected it on the night of 2 November and stopped the service late at night on the following day, 3 November.

In both cases, the cause and the scope of the impact are being investigated by an outside specialist organisation, and the companies say that no misuse of the information has been confirmed.

TeamSpirit: starting from a development server

TeamSpirit, which provides services such as attendance management, announced on 6 November that on 27 October a third party logged in illicitly to a development server and obtained data from its cloud environment using credentials stored on the server. The personal information leaked, within what could be confirmed, is 28,824 records after removing duplicates, of which 35 are sensitive personal information.

On the cause, it says it was "not due to an unknown vulnerability" and that "shortcomings in configuration and information management overlapped". On the other hand, it says that unauthorised access to the attendance and man-hour data that customers run on the service has not been confirmed at this time.

JNSA: security understanding check

JNSA, which works to raise awareness of information security, stated in its first report on 6 November that it had confirmed on 4 November unauthorised access to its "Information Security Understanding Check Service". Up to 15,128 records of personal information may have been leaked. The data concerned includes administrators' names, company names and email addresses, and users' IDs and hashed passwords. It says the unauthorised access may have been carried out from around the night of 30 October, and that the detailed route of intrusion is under investigation.

What these cases teach us

Because the cause has not yet been made public in many cases, the following points are organised from what could be confirmed.

Seven things to check at your company

1. Can you detect unusual activity on member pages?

   It has been reported that NTT DOCOMO noticed through an alert about a large volume of access. Check whether you have a way of noticing when a lot of information is viewed in a short time.

2. Are you storing identity document numbers?

   Store only information that is truly necessary, and if you keep it, limit who can see it.

3. Review recordings and transcription data

   Measures include setting things up so that numbers are not asked for over the phone, and deciding how long recordings are kept.

4. Don't keep production keys in development environments

   Look for production passwords or cloud keys left on development servers or in repositories.

5. Protect accounts for outside services

   Set up multi-factor authentication on telephone systems and cloud services, and delete the accounts of people who have left.

6. Inspect APIs and what is inside your apps

   JPCERT/CC has reported methods that analyse public apps to target APIs. Don't embed secret keys in apps, and check permissions on the server side. No connection between this and the individual cases here has been announced.

7. Decide in advance how you will make announcements

   Decide how to issue first and follow-up reports, the contact point for enquiries, and the procedure for reporting to the Personal Information Protection Commission.

For earlier cases and common points, see "Cyber Incidents in Japan, October to November 2026", and for follow-up news, see "Follow-up on the Unauthorised Access at Arara Inc.". For updating the foundations of your systems, "Securing Legacy Systems: Where to Start" may help.

How Digi Dinos can help

Digi Dinos is a company that supports DX, security, and the operation and maintenance of systems. We are ISO 27001 certified, and our team works in Japanese.

• Review of your current systems: we sort out where what information is held and who manages it.
• Responding to vulnerabilities and updating: when a new fix comes out, we assess the impact and apply it.
• Operations and monitoring: we provide monitoring of servers and clouds 24 hours a day, 365 days a year (NOC).
• System takeover: even for systems with no documentation, we read and investigate the code and take them over.

Frequently asked questions