Last updated: October 12, 2026

The quick answer

More than 20 major Japanese companies have disclosed cyberattacks in recent weeks, including Times Car, JR East and a SoftBank-owned cloud provider, and some leaks included photos of driver’s licenses. If you live in Japan or have used these services as a visitor, the main risks now are convincing phishing messages and identity fraud, so watch for official breach notices, ignore unsolicited links and keep an eye on any new accounts opened in your name.

What happened

Japan has been hit by an unusually dense run of attacks against well-known brands, transport operators, retailers and public services. The Financial Times counted more than 20 major companies that have disclosed incidents in recent weeks, and those firms have said tens of millions of pieces of customer data may have been exposed. At an emergency ruling-party meeting on Friday, October 9, Masaaki Taira, who led the session, described the situation as “a state of emergency in cyber space.”

Several incidents stand out for ordinary customers:

Company	What was reported
Times Car (Times Mobility)	About 6.6 million current and former member accounts affected. Exposed data includes names, addresses, phone numbers, email addresses and identity documents such as driver’s license images. The company says credit card details were not accessed.
IDC Frontier (SoftBank cloud unit)	Ransomware attack on October 7 disrupted services for 495 companies and local government bodies that use its cloud.
JR East and View Card	Customer records, mainly email addresses, may have been accessed through an email-delivery service hosted on IDC Frontier. The companies say credit card numbers, home addresses and phone numbers were not exposed.
Others	Second-hand retailer Bookoff and several other retail and financial companies have also reported customer data leaks.

The government has responded on two fronts. The National Cybersecurity Office sent instructions to ministries, local authorities and companies urging updated security software, strong passwords and tighter supply-chain security. And because the Times Car leak included large numbers of driver’s license photos, Japan’s Financial Services Agency told lenders to accept only identification that contains an IC chip when verifying identity.

What it means for you

For most people, the immediate danger is not the original hack but what criminals do next. Leaked email addresses and phone numbers feed phishing campaigns that look like they come from the breached company, a delivery service or your bank. Leaked ID images are more serious, because a clear photo of a license with your name, address and date of birth can be used to try to open accounts or pass identity checks. The new FSA guidance is designed to make that harder at banks, but other services may still accept photos.

What to do now

1. Find out if you are affected: check the official websites of companies you use for incident notices, and read any breach email carefully. Navigate to the company’s site yourself instead of clicking links in the message.
2. Treat unexpected messages as suspicious: Times Mobility has warned customers about emails, calls and texts pretending to be from the company, and says it will not ask for passwords or card details that way. Assume the same applies to every company on the list.
3. Change reused passwords: if you used the same password for an affected service and anything else, change it everywhere and turn on two-step verification, ideally with an authenticator app or passkey.
4. Watch for identity misuse: if you submitted a license or other ID photo to Times Car, keep an eye out for letters, cards or loan notices you don’t recognize. You can request your credit file from Japan’s credit bureaus, such as CIC and JICC, to spot accounts opened in your name.
5. Report problems quickly: if someone uses your ID, contact the company involved and the police, and tell your bank if financial accounts are touched.

The same playbook applies to most large breaches. Our guides to the ASOS data breach and the Oracle Health breach walk through similar steps. If you use an older Windows PC, also make sure it is still getting security fixes with our guide to Windows 10 updates through 2027.

Who is affected and who isn’t

• Most likely affected: residents of Japan who are current or former members of Times Car or Times Business Service, JR East and View Card customers, and customers of the other companies that have issued notices.
• Possibly affected: visitors who rented a car or signed up for a membership with an affected company during a trip, since sign-up data and ID uploads can sit in the same systems.
• Not directly affected: people with no accounts at the companies involved. Still, any phishing message referencing a “Japan data breach” should be treated with suspicion.

More disclosures are likely as businesses that rely on IDC Frontier finish investigating, so the list of affected services may grow over the coming days.

FAQ

Were credit card numbers stolen?

Times Mobility says card information was not accessed, and JR East and View Card say card numbers were not exposed. Other companies are still investigating, so check each notice and review your statements anyway.

Can I still use my driver’s license as ID?

The FSA guidance is aimed at lenders verifying identity, telling them to rely on IDs with an IC chip. Expect banks to change how they check documents, and follow the instructions your bank gives you.

Who is behind the attacks?

Authorities have not publicly attributed the wave to a single group, and in the IDC Frontier case no known ransomware gang has been identified. What you can control is how you respond to messages and protect your accounts.

Sources

• The Next Web: Japan steps up warnings as cyberattacks expose millions of records
• PYMNTS: Japan races to improve cybersecurity after hacks expose IDs
• Gizmodo: Japan warns of a wave of cyberattacks
• Cybernews: Cyberattack on Japanese cloud firm hits railways, police and food suppliers
• CPO Magazine: Times Car, Keio and Tokyo Metro incidents
• Beinsure: Times Car data breach exposes 6.6 million accounts