Over about three weeks in October 2026, more than 20 Japanese companies disclosed leaks of customer data. The combined count passed 160 million records, more than the country’s population of roughly 124 million. For readers in Asia, where the same app-based sign-ups and legacy back-end systems are common, the episode is a useful stress test of what happens when the data is gone and the penalties are small.
Who was hit
The list reads like a traveller’s checklist. Sourcenext, a software company, lost 22.52 million records and the flight booking site skyticket 14.64 million. Burger King Japan reported 11.18 million, Yakiniku King 10.79 million and Times Car 6.6 million. Bookoff, JR East, Yamato Transport, Lawson, the Nikkei newspaper and JR Kyushu followed, with JR East at 6.09 million, Yamato at 5.31 million and Lawson at 2.16 million.
Separately, a ransomware attack on IDC Frontier, a SoftBank subsidiary, knocked 495 companies and local governments that used its cloud services offline. A member of the ruling party described the situation as a “cyber-space state of emergency”. GMO Cybersecurity is tracking a group it calls TAG-217, which it suspects of attacks on about 80 Japanese firms using a Chinese-built AI penetration-testing tool.
A 3,000 yen apology
The Times Car case drew the sharpest public reaction. The car-sharing service had asked users to upload driver’s licence images at registration, and 1.6 million of them leaked. A licence carries a photo, address, date of birth and legal name, enough to impersonate someone. Times Car offered affected customers a Quo Card worth ¥3,000, about $20. The Japanese term is “mimai-kin”, sympathy money, a goodwill gesture rather than legal compensation.
The comparison with other markets is stark. After the 2017 Equifax breach, which touched 147 million people, victims were offered $125 each along with free credit monitoring, and the settlement with the US Federal Trade Commission reached $700 million. Under the EU’s GDPR, fines can reach 4% of global annual turnover, and Meta was fined €1.2 billion in 2023. Japan’s personal information law caps fines at ¥100 million, roughly $670,000, which is under 0.05% of the Meta penalty. Breach notification became mandatory in 2022 but requires only that companies act “promptly”, with no fixed deadline such as the EU’s 72 hours.
Class-action suits rarely fill the gap. A Japanese-style system was set up in 2016 but is seldom used, and lawyers say almost nobody sues even where damages of ¥10,000 to ¥50,000 per person are plausible.
Trust as a weak point
Japanese commentators link the weakness to culture. “Seizensetsu”, the idea that people are innately good, shapes a society where the murder rate is about 0.2 per 100,000, roughly a thirtieth of the US figure. That trust, the argument goes, carried over into digital systems. The Ministry of Economy, Trade and Industry estimates the country is short about 110,000 cybersecurity workers, and many firms still run old core systems and leave mobile app interfaces poorly secured. The Digital Minister’s remark that he wanted people to protect their own information drew angry responses online.
What the dark web is, and is not
Stolen records of this kind often end up for sale on the dark web. Robeson Jennings, senior vice president of global services and intelligence at ZeroFox, whose team watches these spaces, said they see “a lot of trading of stolen data”.
The dark web is a set of overlay networks, Tor the best known, that need special software to reach. Tor sites use .onion addresses, and traffic passes through layers of encryption and several relays, so sites cannot see a visitor’s location or IP address and visitors cannot see the host’s. The regular web is called the clearnet by its users. None of this is the same as the deep web, which only means content that search engines do not index.
The same tools have honest uses. ProPublica publishes on Tor, and newsrooms use SecureDrop so sources can pass on documents more privately. “The need for privacy is not evidence of wrongdoing,” said Pavel Zoneff, director of strategic communications at the Tor Project.
For anyone who used Lawson’s Ponta app, Yamato’s Kuroneko Members or skyticket while in Japan, the practical step is to check the email address against Have I Been Pwned, change any reused password and review card statements for the past three months.
Sources
- $125 in America, ¥3,000 in Tokyo. The price of a leaked driver's license｜Yui Works -美しく生きたい
- Dark web
- The Dark Web Is Hiding in Plain Sight. That's a Problem for All of Us – CNET
Photo: NOIRLab/NSF/AURA/T. Slovinský (CC BY 4.0)
