Confirmed
Ryobi Bus: 43,221 newsletter email addresses leaked via Arara breach
Ryobi Bus announced on November 2 that Arara reported unauthorised access to its repica service, used for newsletters, had leaked member email addresses.
Japan: Data Breach Incidents by Country / region
Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Confirmed
Fukui Shimbun: 11,084 Fukui Shimbun Passport member email addresses leaked via Arara breach
Fukui Shimbun announced on November 2 that unauthorised access to Arara, used for Fukui Shimbun Passport member email, leaked some members' email addresses.
Confirmed
Suntory group external-cloud data breach
An intruder downloaded files containing personal information.
Confirmed
Hokuriku Electric: about 550,000 Hokulink member email addresses leaked via mail-service breach
Hokuriku Electric said unauthorised access to the email service used by the operator it contracts for Hokulink member emails leaked members' email addresses.
Confirmed
Marui Group: customer data leaked via Securitize Japan digital-bond vendor breach (up to 9,086 people)
Marui Group announced on November 2 that Securitize Japan, which manages its digital bonds, was breached on October 29, 2026, and some applicant personal data leaked.
Confirmed
Bank of the Ryukyus: 96,477 customer email addresses leaked via Arara repica
The bank learned on November 2 that customer email addresses leaked in the repica breach and announced it that day.
Confirmed
Odakyu Travel: 63,006 member email addresses leaked via Arara breach
Odakyu Travel was told on November 2 that some member email addresses leaked through the Arara service used via a marketing tool.
Confirmed
istyle @cosme: data of about 3 million common-ID members leaked after unauthorised access
On October 28, 2026, istyle confirmed that part of its @cosme common-ID member data leaked through unauthorised access.
Confirmed
Kobe Shimbun: about 40,000 newsletter email addresses leaked via Arara breach
Kobe Shimbun was told on November 2 that unauthorised access to Arara, used for its newsletter, leaked recipient email addresses, and published a notice that day.
Confirmed
ENEOS: car-lease customer data leaked via Prestige Core Solutions vendor breach (up to 8,500 contracts)
ENEOS announced on November 2 that Prestige Core Solutions, which handles part of ENEOS Car Lease administration, was breached on October 29-30, 2026, and customer personal data leaked.
Investigating
Skymark: employee and former-employee personal data left viewable; possible leak
After inspecting servers following an earlier careers-form issue, Skymark found some employee and former-employee personal data had been viewable from outside or inside the company and announced a possible leak on November 2.
Confirmed
U Co-op: 210,495 email addresses leaked from Arara repica service
U Co-op said registered email addresses leaked from Arara's repica email service.
Confirmed
Prestige International: up to about 5.5 million roadside-service records taken
Customer names, contacts, vehicle, incident/breakdown details and some bank-account information were removed from a roadside-assistance operations system. The figure is up to about 5.5 million records including duplicates.
Investigating
Mizkan: recipient names, addresses and phones may have leaked via Sagawa Express tracking-service breach
Mizkan announced on November 2 that unauthorised access to Sagawa Express's package-tracking service may have leaked shipping-label data for parcels the Mizkan group or its contractors shipped via Sagawa between June 21 and September 30, 2026.
Confirmed
Tochigi Bank: about 1,000 customer email addresses leaked via Arara mail-server breach
Tochigi Bank announced on November 2 that part of its email-delivery service ran on Arara servers that were breached, leaking some customer email addresses, and gave the count in a November 3 second report.
Confirmed
Zaif: 380,536 customer email addresses leaked via Arara contractor breach
Zaif announced a possible leak on November 2 and, in a November 4 second report, confirmed that customer email addresses registered with Arara Message had been exfiltrated.
Confirmed
TKC: customer email addresses leaked via Arara email-delivery breach (up to 2,230,812)
TKC was informed that unauthorised access to Arara Message, its outsourced email-delivery service, leaked email addresses and names of users of TKC systems.
Confirmed
Fanplus/Ticketplus: about 4.43 million user email addresses leaked via Arara breach
Fanplus and Ticketplus announced on November 2 that unauthorised access to Arara Message leaked email addresses of their services' users.
Confirmed
Nojima Online: about 7 million member records leaked after member-system intrusion
On November 1, 2026, Nojima detected unauthorised access to the member-management system of its Nojima Online e-commerce site and confirmed member data of that site and its used-smartphone buy-back site had leaked.
Investigating
Kagome: data of 109 digital-bond purchasers may have leaked via application-platform breach
Kagome announced on October 31 that unauthorised access to the digital-securities platform used for its 2023 perk-bearing bonds may have leaked purchaser personal data.