Tokyo, Oct. 31 – The Personal Information Protection Commission disclosed that the cumulative total of personal data compromised in Japan since the start of the current fiscal year has reached about 260 million, according to the commission’s latest reporting. The figure, which represents about twice Japan’s population, compiled from 2,094 incidents reported between April 1 and Oct. 16, indicates that many individuals were affected more than once across separate breaches.
The commission’s data, which excludes financial and telecommunications firms, shows a rapid increase in breach incidents. In October alone, 830 unauthorized‑access cases were reported during the first half of the month, a stark rise from the 303 incidents recorded for the entire prior month of September. Across the whole 2025 fiscal year, the commission logged 1,256 incidents. Six of the largest incidents each involved the exposure of personal information for more than 10 million people.
Among the affected organisations are a range of high‑profile companies and institutions. Sony Life Insurance Co. detailed a breach that may have exposed employee data. Retailers such as Don Quijote and the Muji brand operator Ryohin Keikaku Co. reported that customer information may have been accessed illegally. Video‑game publisher Bandai Namco Entertainment Inc., airline All Nippon Airways Co., and food‑chain operator Matsuya Foods Holdings Co. also confirmed possible leaks. In the public sector, Kyushu University and its affiliated hospital said personal data might have been compromised following unauthorized website access.
Because the report does not cover breaches in the financial and telecommunications sectors, analysts warn that the true scope of compromised data could be significantly larger. The commission’s findings raise concerns about data security across Japan’s corporate and public‑service institutions, with potential implications for privacy rights, consumer confidence, and the integrity of services that rely on personal data.
Chief Cabinet Secretary Minoru Kihara addressed the crisis on Friday, stating,
"The number of large‑scale leaks is increasing rapidly, and the government is taking the situation very seriously. We will compile a package of emergency countermeasures quickly."
The government’s plan, as announced by Kihara, will focus on tightening data‑protection protocols across public and private entities, enhancing enforcement mechanisms, and providing clearer guidance to organisations on breach reporting and response. The commission’s data also signals the need for stronger accountability mechanisms to ensure that breaches are detected, addressed, and prevented in a timely manner, safeguarding citizens’ trust in Japan’s digital infrastructure and the public institutions that serve them.
