Double Trouble: Japan Data Breaches Expose 260 Million Personal Info Records

In Japan, hacking attacks against corporate computer systems have surged, primarily powered by artificial intelligence tools. Since April, approximately 260 million personal information records have been leaked, more than double the country's population. The rise in data breaches accelerated notably in October, with 830 incidents reported in just the first 16 days.

The Personal Information Protection Commission, an external body of the Cabinet Office, mandates businesses to report personal information breaches within three to five days of discovery. For the first time, the Commission released preliminary statistics on data breach incidents based on company reports. Between April 1 and October 16, the Commission documented 2,094 data breach incidents, surpassing the 1,256 incidents reported throughout fiscal 2025.

Monthly figures remained under 200 from April to June before surging beyond that threshold in July and continuing to rise in subsequent months. In October, the Commission received reports of 830 incidents. Of these, 588 affected fewer than 100,000 individuals, 18 breached between 1 million and 10 million, and four impacted more than 10 million.

Cyberattacks on businesses are on the rise, with many incidents believed to be facilitated by AI tools. AI's effectiveness in probing systems, identifying vulnerabilities, and exploiting them has contributed to the increasing number of data breaches. Furthermore, with companies relying on both in-house systems and cloud services, a single cyberattack on a cloud provider can have cascading effects, affecting multiple organizations. These types of incidents are becoming increasingly common in Japan.