Data Breaches and Unauthorized Access in Japan (2026)

On September 11, 2026, a third party exploited a vulnerability in the image upload server of Helpfeel 'Gyazo', an image-sharing service, and executed arbitrary commands on the company's systems.

According to the announcement as of September 16, 2026, the investigation confirmed that the third party accessed the database and that about 23.62 million user records and about 490 million records of image metadata were leaked. The user data includes email addresses, password hashes and login session IDs, and payment information is stated not to have been leaked. The 23.62 million include anonymous accounts, and the number of people actually affected by personal data leakage is still under investigation.

The metadata includes information used in image URLs, so the images could be viewed without authorization, and the company temporarily disabled viewing of some images. A list of private image files was also obtained, and the company says it cannot completely rule out that some private images were viewed by a third party.

On October 2, 2026, unauthorized access by a third party was confirmed on the membership management system of the Yakiniku King official app, operated by Monogatari Corporation. The company cut off communications and put defensive measures in place, but confirmed on October 3 that member information had been leaked.

Of 10,808,784 registered users, 10,788,963 were leaked. The leaked information includes member numbers, names (registered names in the app), email addresses and phone numbers. The company says login passwords, dates of birth, genders, postal codes and store usage history including held points were not leaked, and that it does not hold payment information such as credit card data.

The cause and how the unauthorized access became possible are under investigation, and at this point the company has confirmed only that it was unauthorized access by a third party. It has not confirmed that the leaked information was made public to an unspecified number of people or misused.

On September 25, 2026 at 9:07, Times Mobility detected unauthorized access from outside to the Times Car web system and immediately began an investigation and response. In its second report, the company said it confirmed that some member information stored on the affected system was acquired by a third party.

The number of leaked accounts is about 6.6 million. Those affected are members of Times Car and people who have left it (including people who applied for membership but did not complete it), and members of Times Business Service and people who have left it. The leaked information differs by person and includes names, addresses, dates of birth, phone numbers, email addresses, driver's license information, identity document data (such as driver's license images), passwords and linked service IDs.

The company states that passwords were stored in a form that cannot be restored, and that it has not confirmed that the passwords themselves leaked in a form that a third party could recognize. It has confirmed that credit card information was not leaked, and has not confirmed that the information was made public to an unspecified number of people or misused.

Aflac Life Insurance Japan Ltd. announced that its systems were accessed without authorization by a third party and that some information, including customers' personal information, was leaked. In its second report of July 13, 2026, the company said the first information leak occurred on June 10, not on June 15 as stated in the first report.

The leaked personal information includes policyholder names, dates of birth, genders, addresses and phone numbers, insured person names, beneficiary names, policy numbers, coverage details and premium transfer accounts (account numbers, account holder names and more). My Number, credit card information and email addresses are not included. The number of customers is about 4.4 million, of whom about 220,000 include premium transfer account information. About 40,000 agencies are affected.

In light of the leak of account information, the company has begun coordinating with the relevant financial institutions. No misuse of the information has been confirmed at this point.

From May 21 to August 1, 2026, a third party ran a malicious program on servers of Estore 'Shoppu Sabu' and sent purchaser information outside, causing the leak, according to the company's second report of August 2, 2026.

The leaked information includes purchasers' names, addresses, phone numbers and email addresses, member IDs and passwords, card holder names, partial card numbers (the first 6 and last 4 digits) and expiration dates, the IDs and passwords of merchants' management screens, mail systems and FTP, and transfer account information. The company says member IDs and passwords were managed in an encrypted state. It does not hold security codes, so they are not included.

The announced count is 8,853,839, but it may include multiple registrations of the same customer and is not the number of affected customers. The cause is unauthorized access from outside, and the details are under investigation. No specific secondary damage has been reported.