23 Daily — According to itmedia.co.jp, the Japanese Personal Information Protection Commission announced on October 28, 2026, that between April 1 and October 16, 2026, there were approximately 2,094 reported incidents of unauthorized access causing personal information leakage or leakage risks. The total affected instances summed to about 260 million, exceeding twice Japan’s population at that time.

Rapid Increase in Incident Reports, October Accounts for 40% of Cases

The Commission's data shows that monthly reports stabilized around 160 cases in April and May, rose gradually to 235 by August, then jumped to 303 in September. Between October 1 and 16, cases surged to 830, nearly 2.7 times September’s volume in half a month. October's reports represented about 40% of all cases during the period. Daily reports increased from roughly 10 per day in September to 52 per day by mid-October.

Data Includes Risk Cases and Duplicate Counts

The reported 260 million affected instances include duplicated counts and do not represent unique individuals affected. The figure also includes both confirmed leakages and cases only at risk of leakage. The statistics solely encompass cases reported directly from private businesses to the commission, excluding those reported through government ministries or administrative agencies. The numbers are preliminary and may change with further investigation.

Editor's take: Serious cybersecurity gaps highlight the need for startups to prioritize data protection

With over 260 million reported instances of unauthorized personal data access in just over half a year, Japanese companies face a severe cybersecurity challenge. The sharp increase in monthly incidents underscores the urgency for startups and businesses to invest heavily in cybersecurity defenses, particularly to prevent unauthorized access and data leaks. Effective validation includes regular penetration testing and security audits to identify vulnerabilities promptly. Additionally, transparent and timely breach disclosure mechanisms are essential to preserving user trust and company reputation.