In September 2026, several Japanese organizations reported unauthorized access that may have exposed personal data. The most detailed official case is an intrusion into Government Solution Services (GSS), a service used by government agencies, which the Digital Agency estimated at about 246,000 potentially affected records. The largest figure in the coverage, about 6.6 million member accounts at Times Car, comes from an Associated Press report, and the available reporting does not include a company-level breakdown of it. Japan’s government and JPCERT/CC have asked organizations to run security checks. The available reporting does not establish that these incidents form one campaign or share one attacker.
The incidents at a glance
The table below keeps each organization’s own unit. Records, accounts and people are not interchangeable, and the figures should not be added together.
As an Amazon Associate I earn from qualifying purchases.
| Organization or service | Reported size (unit as stated) | Data reported as exposed | Technical cause | Status and attribution |
|---|---|---|---|---|
| Digital Agency, Government Solution Services (GSS) | About 246,000 potentially affected records: about 189,000 relating to personnel of GSS-using agencies and people who worked on their business, and about 57,000 relating to businesses and individuals involved in that work | Names, email addresses, phone numbers, and a smaller number of addresses. Not included: My Number, bank-account information, pension numbers. The estimate excludes members of the general public. | A third party entered by exploiting a vulnerability in a VPN network device, after access using a maintenance operator’s account was detected | Disclosed September 11, 2026 by the Digital Agency. Exposure described as possible; secondary misuse not confirmed at the time of the notice. |
| SB Creative Corporation, Business+IT service | 1,137 records concerning 1,132 business contacts | Names, company names, email addresses, telephone numbers. Not leaked, according to the company: member information, passwords, credit-card and other payment information, lead data. | Exploitation of a vulnerability in part of the service’s systems, which may have allowed unauthorized acquisition | Company follow-up dated September 14, 2026. Exposure described as possible. |
| Times Car | Approximately 6.6 million member accounts, as reported by the Associated Press on October 9, 2026 | Not stated in the available reporting | Not stated in the available reporting | AP describes it as an attack the previous month. No company disclosure with these details is established in the available reporting. |
| Lawson, Daiwa Securities, BookOff | Not stated | Not stated | Not stated | Named by AP among major Japanese companies that reported customer-data leaks. No dates or technical details are given for these three. |
The Digital Agency’s GSS intrusion
This is the clearest official example of how a September-period leak of this kind unfolded, because the agency published a timeline and a scope estimate.
Free tools Windows power users keep installed
One-click scans. No signup required.
Timeline
- June 25, 2026: The agency detected access to many files using a maintenance operator’s account.
- July 9, 2026: The agency determined that a third party had entered by exploiting a vulnerability in a VPN network device.
- September 11, 2026: The agency published its notice that files containing personal information may have been exposed.
The public notice came about two and a half months after the access was first detected.
#1 Best Overall
What the estimate covers, and what it does not
The roughly 246,000 figure is a count of potentially affected records. The agency noted that duplicate categories are possible, so the figure should not be read as a count of distinct people. The exposed fields were names, email addresses, phone numbers and a smaller number of addresses. The agency said the data did not include My Number, bank-account information or pension numbers, and that it did not concern members of the general public.
Immediate response
- Applied a patch to the VPN device.
- Suspended the affected account.
- Cut off external communications from the compromised device.
The agency said it would also review its vulnerability management and improve how external connections are made. These are actions taken in this incident and do not show that the same weakness caused any other breach.
SB Creative’s Business+IT service
SB Creative’s follow-up is a useful contrast in scale. Its 1,137 records relate to 1,132 business contacts, and the company describes the access as possible rather than confirmed. Exploitation of a vulnerability in part of the service’s systems may have allowed the records to be acquired without authorization. The company says the exposed fields were limited to names, company names, email addresses and telephone numbers.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsIts stated measures were:
- Fixing the vulnerability and reviewing related functions.
- Commissioning an external vulnerability assessment.
- Reviewing WAF settings and external access controls.
- Resetting passwords and adding one-time-password authentication for the relevant accounts.
Does “millions” hold up?
The headline’s “millions” rests on one figure: the approximately 6.6 million Times Car member accounts that AP reported. That number is not established in a company disclosure in the available reporting, and the exposed fields and cause are not described. The two incidents with detailed official or corporate disclosures are measured in hundreds of thousands of records (GSS) and in the low thousands (SB Creative). Lawson, Daiwa Securities and BookOff were named by AP without size figures, so the cluster’s total scale cannot be calculated from the reporting.
Rank #3
The wider trend in case counts
AP also reported counts from a study released in 2026 by the Yomiuri newspaper and Trend Micro. According to AP, the study recorded more than 500 cyberattack cases so far in 2026, compared with 473 in 2025 and 503 in 2024, and AP said 2026 was on course to set a record. These figures come from a news report summarizing the study, not from the study itself or a government census, and they should be attributed to AP and the study’s publishers.
What JPCERT/CC is warning about
JPCERT/CC’s alert, published October 8, 2026 and updated October 9, says the technical information it has received is limited and fragmented. It also cautions that the attack methods it describes do not mean every incident used the same method. The alert describes a potentially growing type of attack that results in large personal-information leaks, distinct from the sporadic ransomware incidents it says continue to occur. It lists these patterns:
- Scanning for known vulnerabilities across different software.
- Attempts involving configuration or backup files.
- Unauthorized administrative API requests.
- A newly described case of a web shell on an application server that is reachable from a public web server.
JPCERT/CC also tells organizations to include systems that are not designed for access by an unspecified number of users, such as business-intelligence tools and employee-management systems, because internal information held in them can be exposed.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →What the government is asking for
AP reported an October 9 government call for increased vigilance. The instructions included keeping security protection up to date, using strong passwords, and strengthening cybersecurity across supply chains. The government also warned that attackers had impersonated people claiming to guard against cyberattacks. The call is a request to check systems. It is not evidence that every organization that received it was breached.
Best Value
AP attributes two English sentences to Toshiharu Furukawa, Japan’s Minister for Digital Transformation, speaking to reporters during the week of the October 9 report: “The attacks are getting increasingly sophisticated,” and “Everyone must become vigilant about protecting your own information yourself.” This is AP’s English text, not an independently verified transcript of the original Japanese remarks.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Checks to run now
The following checks follow from the patterns and incidents above. They are a practical checklist, not a replacement for JPCERT/CC’s full guidance.
- VPN and remote-access devices: Confirm that VPN appliances are patched and that accounts used for maintenance are individually identified, suspended when not in use, and monitored.
- Known vulnerabilities: Inventory software across public and internal systems and check for unpatched known vulnerabilities.
- Configuration and backup files: Check that configuration and backup files are not reachable from the web.
- Administrative APIs: Review logs for unauthorized administrative API requests.
- Application servers: Look for web shells on application servers that a public web server can reach.
- Internal tools: Identify business-intelligence and employee-management systems and confirm they are not exposed beyond their intended users.
- Accounts: Enforce strong passwords and use one-time-password authentication for sensitive accounts, as SB Creative did for the affected accounts.
- Supply chain: Review the security of contractors and maintenance operators who have access to your systems.
- Phishing and impersonation: Warn staff and customers that leaked contact data can be used for phishing, and that people claiming to be security officials should be verified through known channels.
Where AI fits, and where the headline goes further than the evidence
AI is an officially recognized risk, but the available evidence does not tie it to the named September incidents. AP reported that Japan’s government warned AI was making vulnerabilities more complex. IPA’s September 30, 2026 summary of its Information Security White Paper 2026 says AI misuse is associated with more sophisticated ransomware and targeted attacks affecting supply chains. It also describes national policy organized around AI safety, responding to cyberattacks that misuse AI, and using AI to strengthen cybersecurity.
The available reporting does not show that AI was used in the GSS, SB Creative or Times Car incidents. No source quantifies how much AI lowers the cost, skill or time needed for these attacks, and the minister’s quoted sentence does not mention AI. The phrase “as AI lowers hacking barriers” in the original headline therefore overstates what is established. The accurate framing is that AI is a broader concern for the authorities, not a documented cause of these cases.
Quick Recap
Open questions
- Whether Times Car, Lawson, Daiwa Securities and BookOff have disclosed sizes, exposed fields or technical causes.
- Whether any of the GSS data has been used for phishing or impersonation, since the Digital Agency had not confirmed secondary misuse when it published its notice.
Sources
- JPCERT/CC, 「直近で相次いでいる国内組織における不正アクセスに関する注意喚起」, published October 8, 2026 and updated October 9, 2026.
- Digital Agency, 「ガバメントソリューションサービスへの不正アクセスによる職員等の個人情報の漏えいの可能性について」, September 11, 2026.
- SB Creative Corporation, 「「ビジネス＋IT」への不正アクセスに関する調査結果および再発防止策について」, September 14, 2026.
- Associated Press, “Japan warns for increased vigilance against cyberattacks,” October 9, 2026. Includes the Times Car, Lawson, Daiwa Securities and BookOff references and the Yomiuri/Trend Micro study counts as reported by AP.
- IPA, “Press release: Information Security White Paper 2026 PDF made available,” September 30, 2026.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
