Japan cybersecurity brief · Updated 1 November 2026

Breaches, new rules and security leadership in Japan.

The major breaches disclosed in Japan over the past year, what they cost, the rules that start now, and what it means for hiring. Every figure is linked to its source, most of them published only in Japanese.

123
ransomware reports to police in the first half of 2026, the most for any half-year since 2020
警察庁 (National Police Agency) via @IT
30.64M
people affected by personal data leaks at listed companies in 2025, up 93.1% on 2024
Tokyo Shoko Research via Web担当者Forum
¥586B
security software market in 2024, up 14.6%, forecast to pass ¥1 trillion by 2029
IDC Japan, May 2025
42%
of Japanese security professionals say their organisation can't get the people it needs, against 29% worldwide
ISC2 workforce study, December 2025

Breaches

Major breaches disclosed in Japan, November 2025 to October 2026.

Eighteen incidents, newest first, taken from the companies' own disclosures and the reporting on them. Figures are the latest each company has published. Disclosures rose sharply in September and October 2026, so for those two months the table lists leaks of ten million records or more, ransomware attacks and updates to earlier rows.

CompanyDisclosedWho was affectedHow it happenedWhat followed
Ryohin KeikakuMUJI app · company noticeOct 2026Up to about 27.26 million app records, including former members: email address, date of birth and gender. Card details, names, addresses and phone numbers were not included.Unauthorised access from outside.Investigation continuing. App and online store still running.
CapcomCAPCOM ID · company noticeOct 202611,774,247 accounts worldwide: email address and login records. 196 accounts had their passwords changed by the attacker.Unauthorised access by a third party.Reported to police and the Personal Information Protection Commission.
Ymir LinkCuenote email delivery · company noticeOct 202651,628,280 email addresses (cumulative) across 49 client systems. 16 more systems were still being checked.An attack through a vulnerability in a software library. The attacker also obtained support staff credentials.
Third party		All systems at one data centre stopped as a precaution, then restarted from 20 October.
SOURCENEXTcompany noticeOct 202622,519,960 customer records, including email, password, name, address and phone number. No card data.Unauthorised use of a member information API between 9 and 13 October.Passwords reset. Reported to the Personal Information Protection Commission and police.
BK JapanBurger King app · ITmediaOct 2026About 11.18 million app member records.Unauthorised access to the official app.Investigation continuing.
Adventureskyticket · company noticeOct 2026About 14.64 million customer records, about 4.13 million of them with hashed passwords, plus 17,780 records with refund bank account details.Admin functions were misused to reach other servers and data held in the cloud, between 2 and 4 October.Payment with saved cards stopped.
IDC FrontierIDCF Cloud · @ITOct 2026495 companies and local governments using the cloud service.Ransomware, starting 7 October in its East Japan Region 1.Network cut and systems stopped in that region. Some customer data hard to recover.
Monogatari CorporationYakiniku King app · ASCIIOct 202610,788,963 app members: name, email and phone number. Passwords and payment data were not exposed.Unauthorised access, found 2 October. Cause still under investigation.Investigation continuing.
Sagawa ExpressImpress WatchOct 2026Up to about 53.23 million items of personal data, including duplicates, so not a count of people: names, addresses and phone numbers on waybills from 21 June to 30 September.Unauthorised access by a third party.Several online booking and enquiry services stopped.
Times Mobility (Park24)Times Car · company noticeSep 20266,628,007 records sent out, including name, address, date of birth and driving licence details. 1,464,800 ID document images were sent out, revised from about 1.6 million.A vulnerability in the Times Car web system.Reported to the Personal Information Protection Commission and the transport ministry. ¥3,000 offered to people whose ID images were accessed or sent out.
Keio CorporationScanNetSecuritySep 2026Sales systems at some group companies disrupted. Rail services unaffected.Ransomware on group servers, found 26 September.Recovery under way.
HelpfeelGyazo · company noticeSep 2026About 23.62 million user records, plus about 490 million image metadata records.A vulnerability in the image upload server, exploited on 11 September.Service suspended from 24 to 27 September.
E-StoreShopserve · final reportAug 2026About 23,356,000 shoppers across 7,858 online shops, about 2.1 million of them with partial card numbers.An application vulnerability on its servers, exploited from 21 May to 1 August.Final report October 2026. Reported to the Personal Information Protection Commission and the Kanto telecommunications bureau.
Aflac Life InsuranceScanNetSecurity · Kumamoto NichinichiJun 2026About 4.38 million customers, about 230,000 of them with bank account details.Unauthorised access between 15 and 25 June, including the policyholder portal. Aflac later said it lacked controls to detect bulk data queries.Financial Services Agency report order under the Insurance Business Act, 30 June.
Regulator acted
KDDIISP email platform · @ITJun 2026Up to 14.22 million email addresses and passwords across six ISP brands, including BIGLOBE, @nifty and J:COM NET.A vulnerability in third-party software used by the system.
Third party		Users asked to change passwords.
Anabuki Housing ServiceScanNetSecurityMar 2026207,773 records, the final count in June. The first estimate was about 496,000.Ransomware.Final report June 2026.
Washington HotelScanNetSecurity · final report summaryFeb 2026Some servers encrypted. No confirmed theft of data.Ransomware, through a device connecting the network to the outside.
Network edge		Card terminals down at some hotels. Restored from backups. Final report September 2026.
Nissan MotorScanNetSecurityDec 2025About 21,000 customers.Unauthorised access at a contractor (Red Hat).
Third party		Customers notified.
3 of 18
came in through a contractor or third-party software: Ymir Link, KDDI and Nissan.
4 of 18
were ransomware: IDC Frontier, Keio, Anabuki and Washington Hotel.
226
ransomware reports to police in 2025, about 60% of them at small and mid-sized companies. (警察庁 2025)

For scale: the two largest leaks in 2025 were Kaikatsu Club (AOKI Holdings) at 7.29 million people and Sompo Japan at 7.27 million, both through unauthorised access to internal servers. Tokyo Shoko Research counted 180 leak incidents at listed companies in 2025, 64.4% of them from unauthorised access or malware (via Web担当者Forum). The Personal Information Protection Commission counts about 260 million people whose data was or may have been leaked through unauthorised access reported since 1 April 2026, with some double counting (via ITmedia). Figures checked 1 November 2026.

AI attacks

Attackers are now using an AI tool against Japanese companies.

ARTEX is an open-source tool, built in China, that runs a penetration test on its own using large language models. It was first linked to attacks on South Korean banks. On 19 October, GMO Cybersecurity by Ierae said it found it on servers attacking Japanese companies.

About 20
Japanese companies targeted from one attack server. Nine were sites in the same industry.
ScanNetSecurity · Business+IT
8
of those had already disclosed data leaks in September and October. GMO has not named them or said all 20 were breached.
Security Measures Lab
6
more AI attack servers aimed almost only at Japanese companies, each focused on a different industry. GMO has not said ARTEX was on all six.
Business+IT
16
South Korean financial firms with confirmed hacking incidents and about 100,000 leaked records as of 14 October. Regulators are still checking whether AI was used.
Reuters via The Star

CrowdStrike's report on Korea says the tool let one attacker run several intrusions in a short time (The Hacker News). The developer has since made ARTEX closed source, but an English fork is still public (explainx.ai). Figures checked 24 October 2026.

What changes now

Two sets of rules arrive this financial year.

One started on 1 October. The other is due in the second half of FY2026.

From 1 October 2026

Active cyber defence law

The main obligations of Japan's new active cyber defence law started on 1 October 2026.

Trend Micro on the law (Japanese)
Second half of FY2026

Supply chain security ratings (★3 and ★4)

The government's supply chain security ratings are due to start once their evaluation guides are published. Three of the eighteen breaches above came in through a contractor or third-party software.

IPA, SCS ratings (Japanese)

What it means for hiring

Security vendors

Selling security into Japan

  • ¥586 billion security software market in 2024, up 14.6%, forecast to pass ¥1 trillion by 2029.IDC Japan, May 2025
  • Your buyers now have a law in force and supply chain ratings their own customers will ask about. In our searches, that is when vendors move from a sales lead to a Country Manager who can sit with the buyer's executives.
Most of our security work is the Country Manager seat. The track record is below.
Consulting firms

Running a security practice

  • ¥882 billion to ¥1.41 trillion: IDC's forecast for the business consulting market from 2025 to 2030, across all consulting work, with enterprise AI the main driver.IDC Japan, June 2026
  • 6.57 job openings for every consulting and finance job seeker on doda in September 2026, up from 5.86 a year earlier.doda 転職求人倍率
Hiroshi Torobu runs our consulting searches, including Partner appointments at a Big 4 firm in Japan.
CIOs and security leaders

Running security at a Japanese company

  • 42% of Japanese security professionals say their organisation can't get the people it needs, against 29% worldwide.ISC2, December 2025
  • At Askul the way in was a contractor's administrator account without multi-factor authentication. Aflac received a report order from the Financial Services Agency within days of its breach.
We map the security leaders in Japan who could run your function and score them against your current leader, on a private page. Nobody is approached.

Track record

Country Manager searches for security vendors, and Partner searches in consulting.

Most of our security work is the top seat in the country. These are completed searches.

Recorded Future
Country Manager

A confidential replacement to stabilise the team, then the leader who took the business through the merger into Mastercard.

Splunk
Country Manager

A confidential replacement at the top of the country. The team grew from fifty to 120 people and contract sizes got much larger.

Fastly
Country Manager

A confidential replacement. A cloud-native sales leader hired out of a hyperscaler's Japan cloud business.

SUSE
Country Manager

Hired out of a sitting country president role, then a senior partner executive into the same business.

Chainalysis
Country Manager

Selling into Japanese law enforcement and financial regulators. The leader placed now hires the team beneath him.

Zenity
First Country Leader

An early-stage US vendor with no entity, no brand recognition and no reference customer in Japan. Run exclusively.

Rapid7
Country Sales Leader, then Sales Engineer

Placed twice. The sales engineer came out of a consulting firm rather than from a competitor.

Big 4 consulting firm
Partner, several appointments

Partner placements into a Big 4 firm in Japan. We don't name the firm, because at Partner grade that identifies the person.

Also in enterprise technology

Glean First Country ManagerGitHub First Country ManagerCelonis Country ManagerZendesk Country ManagerNutanix Exclusive agent, five to fiftyWorkday Embedded team buildFivetran First enterprise seller

Searches led by Murray Clarke, including work at the firms he built before Aspiring Partners, and by Hiroshi Torobu in consulting. We hold back candidate names because the people are identifiable. Every client listed will take a reference call. Full track record

References

What our clients say.

Eighteen regional leaders and global heads of talent who have run searches with us. Every one of them has agreed to take a call.

“I've worked with the team for many years now and they helped me hire the key leader to scale our Japan business, and the one to take us through the merger into Mastercard. Great work.”

DQ Li
VP Asia Pacific, Recorded Future

“Instrumental in hiring key people, including Country Manager, and delivering RPO. Their network in Japan is significant.”

Goh Hattori
Global Talent, Splunk and Dell EMC

“Helped build our presence in Japan during a difficult time of year and for a very niche sector. Diligent, up front, and focused on delivering.”

Anwar McEntee
APJ Region Head, Rapid7

“Impressive research and a job well done. Thanks for the great work. Happy to be a reference.”

Josep Garcia
VP Asia-Pacific, SUSE Software

“We almost exclusively found Murray to be our go-to recruiter. I highly recommend him.”

Matt Young
Asia Pacific VP, Nutanix

“One of the top recruiters VMware has worked with, not only in Japan, but across the whole of Asia Pacific. He is exceptional.”

Kate Berkeley
Global Talent, VMware

“Murray has been a tremendous help in hiring dozens of individual contributors as well as key managers for us.”

Jon Robertson
Japan President, VMware

“Great job Murray. Thanks so much for this. We are really happy with this key hire.”

TJ Chandler
Asia Pacific VP, Fivetran

“Excellent work to hire a key sales lead for our new all-flash product in Japan.”

Barry Kent
Flashblade VP, Pure Storage

“Murray helped us lock in a key leader for our Japan business. He did an excellent job.”

Mathew Fleming
Global Sales Director, Fusion-io (now Sandisk)

“If you need someone to assist as you try to enter the Japanese market, don't look any further.”

Gerry Sillars
Asia Pacific VP, CommVault

“Thanks for your work. Nice job. I appreciate you running at a very intense pace.”

Anthony Palladino
CRO, mabl

“I see Murray as the only recruiter that really understands the markets he recruits into.”

Brian Burns
VP, Hortonworks

“Murray was invaluable. His advice, cultural guidance, and results were outstanding.”

Stephen Beck
Global Services VP, VMware

“Murray can build a strong relationship and he drives things very passionately.”

Keita Nozaki
Technical Services Head, VMware

“Murray helped build our Japan team, securing high quality sales and engineering hires.”

Sung Hae Kim
Global HR Head, Pivotal

“His business sense and creativity helped fill a high level executive position in a short period of time.”

Matt Thatcher
International Sales Director, DoubleTake Software

“Murray has done outstanding work for PARC in a difficult talent space. Thank you.”

Patrick Cook
Global Head, Xerox PARC

Every name above agreed to be listed and to take a reference call. See the full track record on aspiringpartners.jp.

Further reading

More from our Japan research.

Market brief

Why Japan in 2026

Japan's software, cloud, AI and security markets, the hiring market, and our placements in five segments, with every figure sourced.

Read the brief →Research · Leadership

Japan Head Appointments Register

Every new head of Japan at a non-Japanese enterprise technology company from 2024, by month, with the source for each appointment and the share held by women.

Open the register →Research · Leadership

Women in Leadership in Japan 2026

How many of Japan's new tech country heads are women, and where the few come from. With national data and sources.

Read the article →Case study · Cloud security

Wiz in Japan

Wiz launched its Japan business in November 2024, named a former president of VMware Japan to lead it and began hosting customer data in Tokyo and Osaka. About a year later it had 80 new customers and 60 partners in Japan.

Read the case study →

Next step

Talk to the partner who would run the search.

Thirty minutes on the role, the market for it and what it will take to hire well. You leave with our view of that market whether or not it becomes a search.

Murray Clarke
Murray Clarke
Founding Partner · Security vendors and enterprise technology
  • Placing Country Managers and presidents in Japan since 2003
  • More than 70 leadership appointments, including Country Managers and go-to-market leaders
  • ManpowerGroup (NYSE: MAN) bought his last search firm and made it Experis Executive
  • Recorded Future, Splunk, Fastly, SUSE, Chainalysis and Zenity among his security searches

murray@aspiringpartners.jp · +81 90 8383 9025

Book with Murray →
Hiroshi Torobu
Hiroshi Torobu
Partner · Consulting and professional services
  • Eleven years recruiting in Japan, on executive and senior appointments across consulting, technology and manufacturing
  • Partner appointments into a Big 4 consulting firm in Japan
  • Country Manager appointments for overseas firms setting up in Japan

Partner, Managing Director and Director searches inside consulting firms.

Book with Hiroshi →

How this page was researched. We produced this page with AI under Murray Clarke's direction. Figures were checked against their original sources on 1 November 2026, and the AI attacks section on 24 October 2026. Each source is linked beside its figure. Most are Japanese-language company disclosures, National Police Agency figures, IDC Japan and Tokyo Shoko Research. Murray Clarke is accountable for what the page says. If you find an error, tell us at hello@aspiringpartners.jp and we will correct it.

Aspiring Partners K.K. Licensed by the Ministry of Health, Labour and Welfare for fee-charging employment placement, licence 13-ユ-318925. Company names in the breach table describe public incidents and are not clients. Where we ran a search for a company, we say so. Nothing on this page is legal or security advice. aspiringpartners.jp