Japan Cyberattack Wave Exposes 14 Million Records as Data Breaches Spread Across Companies

Japan’s cybersecurity crisis is widening beyond individual companies, with more than 14 million citizens potentially caught up in a wave of cyberattacks and customer data breaches, as Yamato Transport, Nikkei, Park24, Keio, Fancl and Attenir disclosed fresh details.

The latest disclosures highlight how ransomware, compromised cloud services and stolen identity documents are turning interconnected business systems into a growing national security risk.

Yamato, Nikkei Among Latest Companies Reporting Breaches

Yamato Transport said 5.31 million sets of personal information belonging to users of its deferred payment service were compromised in a breach first announced on Sept. 29. The affected data, including names, addresses and phone numbers, was collected over roughly eight years from Oct. 1, 2018, Japan Times reported.

Business daily publisher Nikkei said about 1.83 million sets of personal information, including names, addresses and email addresses, were compromised after a cloud service used for system development was fraudulently accessed.

Park24, parent of Times Car, said it will finish deleting images of identity verification documents, including driver’s licenses, by the end of October and revise its internal rules so such images are deleted immediately after verification. About 1.6 million of the 6.6 million sets of personal information affected in the Times Car cyberattack included images of driver’s licenses and other documents.

Railway operator Keio said attackers had claimed to publish its information after a system disruption late last month. Outside experts believe Keio was targeted in a ransomware attack by international hacker group Qilin.

Cosmetics maker Fancl and affiliate Attenir reported a breach affecting about 830,000 customers, while Japan Post said information on about 600 users of its online service for investigating undelivered international mail may have been compromised.

One Cloud Attack Shows How Far the Damage Can Spread

The broader crisis intensified after ransomware struck IDC Frontier, a SoftBank-owned cloud provider, on October 8, disrupting access to data held by 495 client organisations.

JR East and View Card said up to 6.09 million records may have been accessed through email services hosted on the affected infrastructure.

JR Kyushu reported another 1.3 million potentially exposed email records, while Tokyo Metro disclosed access to email addresses of 59,000 Metpo loyalty-program members.

Japan recorded 86 cyber incidents in September alone, while its 2026 tally has already crossed 500. Masaaki Taira, head of the National Cybersecurity Strategy Headquarters, described the emerging threat as “saturation attacks”, warning that AI can allow attackers to target far more systems.

“When AI takes over part of the process, a small group of hackers can target significantly more systems,” he noted.

Cybersecurity Minister Toshiharu Furukawa described conditions as “extremely critical” at an October 9 meeting, as Tokyo ordered ministries to strengthen their defences. Japan also activated its Active Cyber Defence framework on Oct. 1.

The expanding breaches show that Japan’s cyber problem is no longer simply about stopping individual break-ins. Shared infrastructure, interconnected suppliers and AI-assisted attacks are allowing one compromise to potentially ripple across transport, finance, retail and other sectors.