Every morning, I wake up in Tokyo, open my phone over coffee, and find another polite apology from a company I gave my address to four years ago: "Thank you for your continued patronage. It has come to light that our entire server of unencrypted driver’s license data was leaked… We deeply apologize for causing you tremendous inconvenience and anxiety. Please change your password and remain on the alert!!"
And I am definitely not alone…
Data breaches in Japan have become so routine that an online ranking - the 2026 Japanese Data Breach Tier List - is now going viral across the country:
The tier list has every publicly reported data leak and cyberattack in Japan this year, and has ranked them from SSS at the top down to D at the bottom.
Let me just say, it is worse than you could even imagine:
494 breaches tracked across Japan so far in 2026 (1 in SSS, 9 in SS, 132 in S, 145 in A, 191 in B, 14 in C, 2 in D)
250 disclosed in October alone, up from an average of 20 a month between January and July
Around 64.36 million people exposed, more than half of Japan’s population
Around 104.20 million accounts hit across telecoms, car-sharing, insurers, city halls, and fast-food apps
7.6 million passwords stored in plaintext inside a single telecom breach (KDDI - SSS tier ranked)
If you’ve been working in Japanese IT like me, this was horribly predictable.
Why Japanese IT is uniquely helpless
When you look at Japanese websites that still look like they haven’t been updated since 1998, it is easy to assume the country simply doesn't understand software. The truth is actually worse: Japan's digital infrastructure is the product of an incentive structure that has rotted from the inside for forty years.
Japanese boardrooms treat software like office plumbing. It is dirty work you outsource to a giant general contractor, who then squeezes a chain of underpaid plumbers while management ignores the pipes as long as the fax machine still works. Let me explain why this is a huge problem:
Five layers of subcontractors and zero engineers
Say a Japanese retailer needs a new loyalty app. Unlike their counterparts in tech-savvy markets like the US or Sweden, executives don’t hire an in-house engineering team. Instead, they hand ¥500 million to an System Integrator (SI) giant like NTT Data, Fujitsu, or NEC. The prime contractor skims 30% to produce some awful looking powerpoint slides, then delegates the actual work down a chain of second- and third-tier vendors, all the way down five layers of so-called tajuu shitauke (multi-tiered subcontracting).
In fact, roughly 72% of all IT engineers in Japan work inside external IT vendors rather than regular companies (Information-technology Promotion Agency (IPA)), against roughly 35% in the United States.
At the bottom of that chain sits a burned-out 24-year-old making $23,000 a year. Working off a beat-up $200 laptop from his shitty staffing firm, he takes the fastest shortcut possible by hardcoding the master API key into the app, leaves the database wide open, and moves on to his next gig. Nobody in the chain ever looks at the code.
Because these subcontractors serve so many companies, hackers only need to breach a handful of them to access massive amounts of sensitive data.
For example, when the platform Commune got breached in early October, 20 separate companies were compromised, from LINE, Yahoo, Sansan, and Mazda to Calbee’s potato-chip fan club and or the cat fan-community “Cat Wall Plaza” (猫壁ひろば).
Even more scary, when emergency-alert vendor Arcadia got hit on October 13, disaster and tsunami warning emails stopped working across Hakodate, Shimonoseki, Okayama, Yokosuka, Fukui, and Oita, alongside NET119 (the emergency 119 text system for deaf citizens) and police roll-call systems covering 13,000 officers in Saitama.
On October, 20 hacks a month suddenly turned into 250
From January through July, the tier list logged about 20 incidents a month. August ticked up to 36, and September hit 68.
Then October arrived.
In the first 25 days of October alone, 250 breaches hit the board. More than half of the entire year’s list happened in the last three and a half weeks.
Why did all of these apps break in the exact same month?
On October 21, Japan’s computer emergency response team (JPCERT/CC) abd Asahi Shimbun released a report detailing what investigators found on the servers behind the attacks. The hackers were using Anthropic’s Claude Code, CyberStrikeAI, and ARTEX - a Chinese multi-agent tool released in July that hunts down software flaws automatically.
To make matters worse, most of these 250 hacks didn’t happen in October. JPCERT/CC just uncovered them then, triggering a classic Japanese PR stampede where companies rush to dump their bad news in the same week to hide in the crowd. Your personal data was likely sitting on the dark web for months before you got that polite October apology email. Unlike in Europe, where hiding a breach triggers massive GDPR fines, dragging your feet in Japan carries almost zero consequences.
The Tier-List of Shame:
When you combine autonomous AI hacking tools with forty years of neglected office plumbing, you get the 2026 Japanese Data Breach Tier List. Here are the standout inductees from top to bottom:
SSS Tier: KDDI with 7.6 million passwords in a text file
Only one company on the entire board earned the “prestigious” SSS rank.
Between May and June, hackers broke into KDDI’s email platform for internet service providers through an unpatched flaw in third-party software. They walked out with 12,231,954 email addresses. Inside that haul sat 7,616,173 passwords stored in PLAINTEXT.
Why on God’s green Earth would KDDI store plaintext passwords?!
KDDI admitted why in its own press release: It didn’t want to inconvenience customers who still use “old email software” that couldn’t handle encrypted authentication. Rather than force grandpa to update his 2003 email client, KDDI left 7.6 million passwords sitting in a plain text file.
SS Tier: When a hack stops the beer trucks
While I luckily don’t do business with KDDI, the SS Tier hit me personally.
Like most Tokyoites, I don’t own a car. Whenever I need to drive, I rent a Times Car from the nearest parking lot. To sign up, you have to upload a photo of your driver’s license into their app. And expectedly, on September 29, Times Mobility admitted that hackers stole 6.6 million member records and shipped 1.5 million encrypted driver’s license images to an outside server. Their apology for losing my driver’s license? A ¥3,000 gift voucher for “special” customers.
Right next to Times Car sits Asahi Group, Japan’s largest brewer. An attacker slipped in through network equipment at a group site, exploited a password weakness to grab administrator rights, and detonated ransomware across Asahi’s Japanese servers. Asahi had to process orders and ship Super Dry by hand for more than two months! It couldn’t even close its books on time, filing a formal Material Weakness in internal controls after admitting its access-rights rules weren’t actually enforced.
Joining them on October 7 was SoftBank subsidiary IDC Frontier, which took a ransomware hit that knocked out cloud services for 495 companies and local governments in a single afternoon - freezing everything from Nissui’s 17 fish-shipping hubs to course registration at Cyber University (yes, a place literally named Cyber University got hacked).
S +Tier: GMO gets fact-checked by its own hackers
If KDDI won the prize for password stupidity, internet giant GMO Internet Group takes the crown for the most embarrassing PR backfire of 2026.
On October 21, GMO’s Onamae.com Desktop Cloud (a virtual server service heavily used by FX traders) landed in S Tier after hackers hijacked 27,000 virtual private servers (VPS), forcing GMO to pull the plug on the entire service and offer ¥5,000 apology payouts.
On October 25, GMO founder and CEO Masatoshi Kumagai published a dramatic statement revealing that the hackers had demanded ¥7.9 billion ($50 million) in ransom. He then went on to blame the breach on “the explosive evolution and malicious abuse of AI technology” and called on the Japanese government to pass emergency national cyber-defense laws.
There was just one problem: The hackers decided to reply to his statement.
Here is the translated highlight reel from the hackers’ official rebuttal:
How did we breach all 27,000 VPS servers? “Every single server was connected together through a single Windows update server. Even worse, that critical server could be accessed using the exact same admin account (
dc\ops) used for regular VPS management. It is a textbook rookie mistake.”How long does it take to fix the vulnerability? “Simple. Just delete one line of text from the RDP file and type a single command (
net localgroup administrators ops /delete). It won’t even affect your live service.”Did this have anything to do with ‘the explosive evolution and abuse of AI’? “Everything above is an elementary mistake that even a beginner engineer would notice. It has zero to do with AI. Why he felt the need to use such grandiose phrasing is beyond our comprehension.”
Think about how retarded this situation is. A self-proclaimed cybersecurity expert leaves their master key in the open for 27,000 servers. The CEO then tries to tell investors that ultra-sophisticated AI attacked them, but end up getting publicly lectured on basic IT hygiene by the criminals currently extorting them…
That’s Japan’s IT-security landscape in a nutshell!
S & A Tier: No app is safe!
This tier might actually be the most interesting because most of Japan uses these apps every week:
Sourcenext (Oct 15 - 22,519,960 records): Exposed over 22.5 million customer records through a flawed member API. Sourcenext is famous across Japan for selling its antivirus software named “Zero Super Security”. Fitting name, if you ask me. 🥁
Capcom (Oct 22 - 11,774,247 records) & Burger King Japan (Oct 15 - 11,180,000 records): Over 22 million gamers and Whopper fans exposed in a single week, right alongside Yakiniku King (Oct 5 - 10,790,000 barbecue app members).
Furusato Choice (Oct 19 - 4,454,097 records): Japan’s biggest hometown-tax donation portal got cleaned out, which means whoever took that database now knows exactly how much Kumamoto horse meat I ordered for my tax deduction last December 🐴
BookOff Group (Oct 9 - 6,383,279 records): Leaked over 6.3 million second-hand bookstore members, including 212,371 people who had already canceled their accounts.
That last one annoys the hell out of me. Why did BookOff still have the data of 212,371 people who had already deleted their accounts?! Because Japanese databases treat “delete” as flipping a status flag from 1 to 0 and keeping your home address until the sun burns out, knowing there are almost zero consequences for hoarding data.
“Send us a fax if you get hacked”
While digging into the October 21 breach report from Japan’s top national cybersecurity agency JPCERT/CC, I noticed a detail that is both deeply worrisome but oh so Japanese.
Scroll down to the very last line at the bottom of their homepage where the agency leaves its contact information:
JPCERT/CC, 8F Tozan Bldg, Nihonbashi-Honcho, Tokyo. FAX: +81-3-6271-8908.
You see, while hackers have autonomous AI agents that sucks out all your sensitive data while you sleep, the guys defending Japan’s internet are ready to take your report by fax… 📠
Sources:
Data from the 2026 Information Leak and Unauthorized Access Tier List (Sekayasa AI Blog, as of 25 to 26 October 2026), JPCERT/CC’s October 2026 alerts and attack-server investigation, KDDI’s July 2026 incident report, Asahi Group Holdings’ July 2026 internal control filing, and reporting from The Asahi Shimbun and Nikkei Asia.