Japan has recorded approximately 260 million cumulative personal-data exposure entries in cyber incidents reported between April and October, as a fresh series of disclosures by major companies raises concerns about the scale of attacks against businesses.
The latest disclosures involve consumer brands and service providers including MUJI, Matsuya Foods, Yakult and apparel group World. Their announcements on October 30 revealed possible exposure of millions of customer records through unauthorised access to company applications, websites and internal systems.
The figures reflect the cumulative number of affected-person entries reported across incidents, not a verified count of 260 million unique individuals. The government has said the number of reported incidents has also increased sharply in recent months.
MUJI And Matsuya Disclose Millions Of Potentially Affected Records
Ryohin Keikaku, the company behind MUJI, said unauthorised access to its official MUJI app may have exposed information belonging to up to 27.26 million current and former users.
The potentially exposed information includes email addresses, dates of birth and gender. The company said credit card details, names, addresses and telephone numbers were not included in the affected data.
MUJI said it detected the unauthorised access, blocked the affected entry point and applied corrective measures. As of its October 30 announcement, it had not confirmed that the information had appeared on dark-web platforms or been misused. The company warned that attackers could attempt impersonation emails using the exposed details.
Matsuya Foods Holdings separately disclosed unauthorised access to the management system of its official app, which supports services including Matsuben Net, mobile ordering and delivery.
The incident affected information relating to 2,377,127 users of these services, including member IDs, delivery addresses, names, telephone numbers and Matsuya points. A separate group of approximately 2,000 app accounts, potentially rising to 3,000, involved additional information such as email addresses, dates of birth and encrypted passwords.
Matsuya said it did not hold customers’ credit card information. It suspended related app and website services while investigating the incident and working towards restoration.
Yakult And Apparel Group World Also Report Data Exposure
Yakult Honsha reported that approximately 40,000 records containing customer and other personal information had been affected by unauthorised access to its website.
The information included names, gender, age groups, addresses, telephone numbers, email addresses and password-related data, including encrypted items. The company suspended affected website functions on October 26 and began investigating the incident.
Apparel group World also disclosed a possible data leak involving its consolidated subsidiary Tinpan Alley. The company said information relating to approximately 1.2 million membership records may have been exposed.
The potentially affected data included names, addresses, telephone numbers, dates of birth, gender and email addresses. World said no credit card information had been identified as leaked and that the affected server had been isolated.
The incidents were disclosed separately. There is no publicly established evidence that they involved the same attackers or a shared technical vulnerability.
Japan’s Reported Data Breach Figures Rise Sharply
According to figures compiled by the government’s Personal Information Protection Commission, the cumulative number of people affected by reported data leaks reached approximately 260 million between April 1 and October 16.
The figures cover businesses handling personal information but exclude financial and telecommunications companies.
The number of reported incidents increased from 303 in September to 830 during the first 16 days of October. The government has also reported a rise in large-scale cases involving at least one million affected people.
The scale of the reported exposure is significant, but the cumulative total should not be interpreted as 260 million separate people. A person may appear in more than one incident, and the figures aggregate reported exposure across different organisations.
Government Prepares Emergency Cybersecurity Measures
Japan’s government has begun coordinating a broader response to the increase in cyberattacks and data leaks.
The National Cybersecurity Office launched a dedicated website on October 30 to bring together consultation channels and security advisories from government departments and other organisations.
Prime Minister Sanae Takaichi had also convened a ministerial meeting on cybersecurity on October 26. She called for stronger support for affected businesses, improved information-sharing, greater cooperation with private-sector security specialists and more attention to supply-chain vulnerabilities.
The government said it would prepare an emergency countermeasure package by the following week. The planned measures are intended to improve prevention, incident response and recovery, including support for smaller businesses that may lack specialist cybersecurity resources.
What This Means For You
The incidents show how customer information held by everyday consumer services can become a target for cybercriminals. Email addresses, birth dates, phone numbers and delivery addresses can be used to make phishing messages and impersonation attempts appear more convincing.
Customers of affected services should follow official company updates and watch for unexpected emails, SMS messages or phone calls claiming to be from the companies.
They should avoid clicking unfamiliar links or sharing passwords, one-time passwords and payment details in response to unsolicited messages. If a company confirms that a password was exposed, users should change it wherever it has been reused and enable additional account protection where available.
The disclosures also underline that data security is not limited to banks and technology companies. Retailers, restaurants, manufacturers and service providers all hold personal information that can be exploited when their systems are compromised.
