Japan’s Data Breach Wave: Millions of Customer Records at Risk
Imagine signing up for a car-sharing service, ordering food through an app, or booking a train ticket. You share your personal information because you trust the company to protect it. But what happens when that information falls into the wrong hands?
Japan has recently faced a wave of reported data breaches affecting companies across different industries. From car-sharing and restaurants to retail and cloud services, these incidents highlight a growing problem: customer information can become a valuable target for cybercriminals.
For businesses and security teams, the lesson is clear. Protecting data requires more than securing the company network.
What Happened in Japan?
Several Japanese companies have reported incidents involving customer information, with the number of potentially affected records reaching millions.
Times Car: Park24, the company behind the Times Car car-sharing service, reported a breach affecting approximately 6.6 million accounts. Reports indicated that personal information was accessed, including identity document images associated with around 1.6 million accounts.
Yakiniku King: The restaurant chain reported an incident involving approximately 10.79 million member records. The reported information included customer contact details.
Lawson: The convenience store chain disclosed a data leak involving more than 2.15 million Lawson ID accounts. The information involved varied by account.
Other companies: Japanese media have also reported incidents affecting other businesses, including travel, retail and entertainment services. In some cases, information was confirmed to have been leaked. In others, the possibility of exposure was still being investigated.
Another concern involves third-party service providers. A security incident at a cloud provider can potentially affect multiple organisations that rely on its infrastructure.
These cases should not be treated as one coordinated attack. Each incident may have a different cause, and investigations can change the understanding of what happened.
Sources: The Japan Times | Associated Press
Why Are These Breaches Important?
Customer information is useful to attackers because it can support phishing, impersonation and fraud.
For example, if criminals obtain a customer's name, phone number and information about a service they use, they can create a convincing message pretending to be that company. A victim might then be tricked into revealing a password or verification code.
Identity document exposure can create additional risks because such documents contain information that cannot easily be changed.
Third-party incidents create another challenge. A company may have strong internal security controls but still depend on an external provider that stores or processes its data. This makes supplier security an important part of overall cybersecurity.
Is AI Responsible for These Attacks?
AI is increasingly being discussed in cybersecurity because attackers can use it to create convincing phishing messages, automate certain tasks and speed up parts of their operations.
However, there is no basis to assume that AI caused every breach reported in Japan. Each incident needs to be investigated individually to establish how access was obtained and what the attacker actually did.
We discussed a similar issue in our recent article about reported AI-assisted attacks targeting South Korean banks.
Read: AI-Assisted Attacks on South Korean Banks: What Actually Happened
The important point is that familiar security weaknesses can still cause serious damage, whether or not attackers use AI.
What Should SOC Teams Do?
Security operations teams can take several practical steps to reduce the risk and impact of similar incidents.
Monitor unusual database access: Investigate unexpected bulk queries, large data exports and access from unfamiliar systems.
Review privileged accounts: Look for unusual administrator activity, unexpected permission changes and suspicious service-account usage.
Monitor outbound traffic: Investigate unusual data transfers to unfamiliar destinations, especially when combined with suspicious account activity.
Improve third-party visibility: Understand which suppliers can access company systems or customer information, and confirm how they report security incidents.
Preserve logs and evidence: Maintain sufficient logging to establish when suspicious activity began, which systems were accessed and what information may have been affected.
Test incident response plans: Prepare for situations where a supplier is compromised or several business services become unavailable.
No single alert proves that data has been stolen. Analysts should correlate evidence from identity systems, endpoints, applications, databases and network security tools before drawing conclusions.
What Can Customers Do?
Customers should watch for official company announcements and take sensible precautions.
Use unique passwords for different services and enable multifactor authentication wherever possible. Be cautious with unexpected emails, text messages and phone calls claiming to offer account protection.
Never share one-time passwords or verification codes with someone who contacts you unexpectedly. If a company confirms that your information was affected, follow its official guidance and monitor your accounts for suspicious activity.
ZyberWalls Perspective
Japan's recent data breach wave highlights a basic but often overlooked security lesson: customer data needs protection wherever it is stored, processed or shared.
For organisations, this means reviewing access controls, limiting unnecessary data retention, monitoring suspicious activity and checking the security of third-party providers. For SOC teams, it means looking beyond individual alerts and understanding what an attacker could access if one account or service were compromised.
Not every reported exposure means confirmed data theft, and not every incident has the same root cause. Accurate investigation matters just as much as a quick response.
Stay Alert. Stay Human. Stay Safe.
- ZyberWalls Research Team
Sources
This article reflects publicly reported information available as of October 12, 2026. Details may change as investigations continue.