Confirmed
Nihon Shisan Soken: customer personal data published on leak site after ransomware
Ransomware disclosed May 14, 2026; a later report confirmed credential theft, exfiltration and leak-site publication as of Aug 26, 2026.
Japan: Data Breach Incidents by Country / region
Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Confirmed
Kagawa Prefecture: 474 public-housing resident records leaked via Anabuki Housing ransomware
After Anabuki Housing’s Feb 3, 2026 ransomware event, a May 12 notice confirmed 474 public-housing resident records leaked; the prefecture posted May 13.
Investigating
Hokuyo: investigating possible personal-data leak after ransomware
Possible data leak: A March 26, 2026 ransomware outage was disclosed May 11; personal-data exfiltration remained under expert investigation.
Confirmed
Himi Shakyo: CC blast exposed name/email of 955 disaster-volunteer registrants
On May 8, 2026 a volunteer-recruitment mail was CC’d to Noto earthquake registrants, exposing names and emails; disclosed May 9.
Investigating
Osaka Prefecture: student data may have leaked after temporary loss of Nishinari HS trip manual
Possible data leak: A Nishinari HS lodging-training teacher manual was briefly lost at an airport toilet on Dec 11, 2025 and recovered as airline lost-and-found; after parent briefings a May 8, 2026 press release followed.
Investigating
Hokkaido Gas: 296 records may have leaked after LNG order-system intrusion at subsidiary
After external intrusion into subsidiary Hokkaido LNG’s order system, staff/partner data may have leaked; disclosed May 7, 2026.
Investigating
Nikkei: data of 291 people may have leaked after Microsoft 365 breach at US subsidiary
Unauthorised Microsoft 365 logins at Nikkei America may have exposed staff and partner data after spoofed mails were noticed; disclosed by the parent.
Investigating
Kagoshima City: personal data may have leaked after water-meter reading device theft
A meter-reading device was stolen on April 15, 2026 with possible personal-data exposure; disclosed May 7. District withheld for investigation/security.
Confirmed
Nagoya City: NPO officer/member addresses readable via flawed portal redaction
On May 3, 2026 Nagoya found redacted addresses on Cabinet Office NPO-portal filings readable with certain operations; first notice May 7, final May 21.
Confirmed
Tochigi Prefecture: addresses of 2,653 NPO officers readable via flawed portal redaction
On April 23, 2026 it was found that redacted officer addresses on the national NPO portal for Tochigi filings could be read with certain operations; disclosed May 1.
Investigating
Money Forward: 370 business-card related records may have leaked after GitHub intrusion
After GitHub credential leakage enabled intrusion, a May 1, 2026 first notice said some personal data in repo files may have leaked. No production-DB exfiltration confirmed.
Confirmed
Gunma Prefecture: 100 tour-application records became viewable via Ota Flex HS form misconfiguration
An external tip on April 24, 2026 found class-tour application summaries viewable via the Ota Flex HS form; disclosed May 1.
Investigating
Tohoku University: hospital clinical-trial NAS patient data may have leaked after server intrusion
Server intrusion was confirmed April 16, 2026; on April 23 a hospital trial-document NAS was also found accessed with possible patient-data leakage; disclosed May 1.
Investigating
Okinawa General Bureau: data of 15,091 people may have leaked after FileZen intrusion
Unauthorised access to a FileZen high-volume transfer server used by the bureau was identified in January 2026; possible exfiltration of stored personal data was disclosed April 28.
Investigating
Alps Alpine: employee data may have been viewed after external-VPN intrusion
Possible data leak: After a April 3, 2026 report of external-VPN abuse, an April 13 review could not rule out access to internal servers holding some employee records; disclosed April 27. No customer/partner exfiltration confirmed.
Confirmed
Okayama Prefecture: 413 business email addresses leaked via misaddressed Plastic 3R notice
On April 24, 2026 the circular-society section sent a Plastic 3R business mail with mutually visible addresses; noticed the same day and disclosed April 27.
Investigating
Asahi Jutaku: 2,092 customer records may have leaked via ielove CLOUD intrusion
Possible data leak: After the ielove CLOUD intrusion, a April 25 first notice and May 2 second notice confirmed 2,092 leaked customer records and field list.
Confirmed
Kitakyushu City: data of 4,135 teacher-exam applicants became viewable via flawed disclosure file
A March 2026 teacher-exam FOI electronic file had a flaw allowing personal data to be viewed with certain operations; noticed April 20 and disclosed April 24.
Investigating
Canet: login data of 10,981 customers may have leaked after my-page intrusion
Possible data leak: After confirming third-party access to the site my-page from April 20, 2026 onward, Canet acknowledged external leakage of login credentials and disclosed April 24.
Investigating
Co-op Ishikawa: member and gift-recipient data may have leaked via gift-shop contractor ransomware
Possible data leak: The gift-catalogue e-commerce contractor detected anomalies on April 10, 2026, confirmed ransomware, reported April 16 and the co-op disclosed April 24.