By asahifile 
Five separate breach notices landed in Japan on 22 and 23 October, and the arithmetic is blunt. Sagawa Express said up to 53.23 million records may have leaked from its parcel-tracking systems. Capcom put its worldwide figure at 11,774,247 accounts. Times Car, run by Park24, said 6.62 million accounts were touched, about 1.46 million of them with identity-document images exported. The disaster-alert vendor Arcadia reported up to 3.136 million email addresses and the Niigata Nippo newspaper up to 253,000. Summed, that is just over 75 million records in about 48 hours, 71% of it with one logistics company. That sum is my own addition of five announcements, not a government figure, and several remain maximum-possible estimates. The window is the story: Japan is not having a bad week, it is working through a pipeline that has been filling since the summer.
The series behind the headlines
Macnica’s Security Research Center counts public disclosures of personal-data theft from corporate web systems: 62 cases in all of 2024, 84 across 2025 and 119 by 6 October 2026, with 81 of this year’s published after July. That is 68% of 2026’s disclosures inside three months, or one new disclosure every 29 hours over 98 days. The National Police Agency counted 13,687 vulnerability-probe attempts per day per IP address in the first half of 2026 against 9,085 a year earlier, a 1.5-fold rise mostly from overseas, and Tokyo’s police report that sensors at their network access points logged suspicious traffic about once every nine seconds in 2025, 99% of it from abroad.
What the attacks have in common
JPCERT/CC’s 8 October advisory sorted the activity into three patterns: scanning for known vulnerabilities across many products rather than exploiting one shared bug; misuse of internal APIs that apps call behind the login screen; and SQL injection in Metabase, a widely used analytics tool. NICT said on 22 October that it reconstructed a campaign using a public-facing application as its entry point and varying its payload server by server, work it believes was automated with AI. Microsoft said a China-linked group had used a Chinese AI tool, AR-TEX, against hundreds of organizations since September. Caution belongs alongside that: the chief technology officer of the security firm Lac told ITmedia that the late-September clustering may simply reflect companies finishing investigations at once. No lone attacker has been proven.
Why the response looks improvised
On 22 October Tokyo’s police summoned rail, telecom and other critical-infrastructure operators to an emergency meeting, asking them to encrypt data, delete personal information they no longer need and detach backups from live systems. On 23 October Prime Minister Sanae Takaichi received an LDP proposal for a central “cyber response headquarters” and said the government would move under the Kantei’s leadership, while economy minister Ryosei Akazawa told the IPA to stand up a white-hat hacker team within a month. Police consultations reached 623 between August and 22 October, around 450 of them in the first ten days of October alone, roughly one every 32 minutes. The Bank of Japan warned the same day that frontier models are accelerating attacks and urged board-level ownership of the risk.
The costs land outside the breach notices
Some damage shows up in public services rather than disclosure statements. SoftBank suspended its emergency alert mail, which carries earthquake early warnings, tsunami warnings and evacuation notices to SoftBank, Y!mobile and LINEMO subscribers, while it patched systems affected by this month’s PHP vulnerability; ministries including education, health and consumer affairs took pages offline as a precaution. Park24 is offering 3,000 yen in cash or vouchers to members whose identity documents were exported, and affected users are preparing a class action. TBS reported that a breach at an outsourced IT vendor may have exposed data on 13,000 Saitama prefectural police employees and 16,000 in Kanagawa, with Fukuoka, Aichi, Tochigi and Gunma checking.
What to watch
- Whether the proposed cyber headquarters gets money and legal authority, or stays a label.
- Whether Sagawa’s 53.23 million figure is confirmed, and how many records carried addresses and phone numbers.
- Whether police and municipal casualties keep growing through shared IT contractors.
- Whether the national ransomware count for the year passes last year’s total before December.
- Whether the supply-chain security evaluation scheme due in fiscal 2027 changes procurement or becomes another checklist.
Sources: Jiji Press (breach and policy coverage, 22-23 October); Nippon TV (police emergency meeting); Impress Net Shop Watch (police guidance); Macnica Security Research Center (disclosure counts); National Police Agency (H1 2026 threat report); JPCERT/CC (advisory, 8 October); ITmedia (Lac CTO interview); TBS with Bloomberg (police vendor exposure).