Japan Data Breaches, October 2026: Rakuten Travel, Furusato Choice and a Month of Leaks

Updated October 30, 2026. This is a live story: several companies are still investigating, and the figures below may change.

The Japan data breach list for October 2026 reads like a tour of the country's best-known consumer brands. Furusato Choice, a hometown-tax donation portal, lost 4,454,097 member records. Rakuten Travel said up to about 2.6 million users of its overseas hotel pages were caught up in a break-in. Sony's internet provider So-net, together with NTT Docomo's plala, exposed up to 2,585,481 records. None of those was even the biggest number of the month.

By October 26 the run of leaks was serious enough that Prime Minister Sanae Takaichi chaired the first ministers' meeting on the attacks and ordered an emergency package of cyber measures. Here is what each breach exposed, why Japan keeps getting hit, and what to do now.

Japan data breaches: the short version

• Three big new ones in about a week: Furusato Choice (4,454,097 records, announced October 20), Rakuten Travel (up to about 2.6 million, October 26) and Sony's So-net and plala (up to 2,585,481, October 27).
• Even bigger ones earlier in the month: Sourcenext (up to 22,519,960 records), Capcom (more than 11.7 million CAPCOM ID email addresses) and Burger King Japan (11.18 million app members).
• What leaked: mostly names, email addresses, phone numbers and home addresses. Furusato Choice also lost hashed passwords and each donor's estimated tax-deduction amount. Rakuten Travel lost partial card details for up to about 36,000 bookers, but no full card numbers.
• How attackers got in: where companies have said, an abused API (Sourcenext), stolen logins (Nikkei), ransomware at a cloud host (IDC Frontier), malware at a contractor (Daiichi Kosho) and a rogue program on rented servers (GMO). Furusato Choice, Rakuten and Sony haven't said.
• Who: nobody has publicly named the attackers, and no single group has been tied to the whole wave.
• The government: a first ministers' meeting on October 26, an emergency package due by the end of the following week, and new "active cyber defence" powers that took effect on October 1.
• What to do: expect scams that know your name and address, change reused passwords, and check card statements if you booked overseas on Rakuten Travel.

Which Japanese companies were hacked in October 2026?

The ranking below lists nine notices published or detailed in October that each cover a million or more records. It isn't the full list: the Financial Times counted more than 20 major Japanese companies disclosing attacks within a few weeks, according to The Next Web.

Two cautions: these are records, not people, so one person can appear in several leaks, and "up to" figures are ceilings that may fall.

Furusato Choice data breach: 4.45 million donors

Furusato nozei, or hometown-tax donation, lets people in Japan give to a town of their choice and get most of it back as a tax deduction, usually plus a thank-you gift. Furusato Choice, run by a company called Trust Bank (トラストバンク), is a portal listing those towns and gifts.

According to Trust Bank, unauthorized access took place on Saturday, October 17. On October 19 staff noticed unusual access patterns and shut the service down at 15:50. On October 20 the company announced that 4,454,097 member records had leaked, a count it says may change.

The leaked fields are name, email address, home address, phone number, hashed password and the donor's estimated donation-deduction amount. A hashed password is stored as a scrambled fingerprint rather than the password itself, though weak ones can sometimes be cracked. The deduction estimate is the unusual field: because furusato nozei limits rise with income, it can hint at what a donor earns, exactly the detail that makes a fake "refund" call sound real.

Trust Bank hasn't said how the attacker got in, mentioning only a vulnerability it's fixing with outside experts. It reported the leak to the Personal Information Protection Commission (PPC), Japan's privacy regulator, and planned a police report.

Towns felt it too: Izumiotsu in Osaka said it couldn't take donations through the site. On October 26 Trust Bank began restarting the back-office system towns use, warning that gift deliveries could be late, but the donor website stayed offline with no restart date.

Rakuten Travel data breach: up to 2.6 million overseas-site users

Rakuten's October 26 notice describes two separate break-ins.

Incident 1: overseas hotel pages run by a subsidiary, Rakuten Travel Xchange. Rakuten noticed something wrong on September 10 and finished fixing it on September 16. Up to about 2.6 million logged-in customers' names, emails, phone numbers and internal IDs were involved, plus booking details for up to about 40,000 bookers. Up to about 36,000 bookings also exposed partial card data: the issuer number (the first digits, which identify the bank), the last four digits, cardholder name, expiry date and card brand. The pages covered parts of Europe, the US and Canada, and Asia and Oceania. Bookings for Korea, Taiwan, Hong Kong, Singapore, Macau and some other areas were excluded.

Incident 2: the multilingual booking site. Rakuten spotted possible unauthorized access on October 20 and fixed it the next day. Up to about 860,000 logged-in customers' emails and internal IDs were involved, plus up to about 40,000 hotel staff accounts.

Rakuten says full card numbers, security codes, passwords, passport details and addresses were not included, that this data alone can't be used for fraudulent payments, and that no secondary damage has been confirmed. Note the gap: the overseas break-in was found on September 10 but announced on October 26, which Innovatopia counted as 46 days later.

Sony's So-net and plala: 2.58 million records

Sony Network Communications said on October 27 that an intrusion on October 19 exposed up to 2,585,481 records: 2,141,986 from So-net and 443,495 from Docomo's plala (S Course). They include contact details and birth dates, plus 54,401 email passwords and 16 bank account records. Our Sony data breach explainer covers it in full.

The rest of October's list

How the rest happened (tap a ranking row for what each exposed):

• Sourcenext (up to 22,519,960 records): attackers abused a member-lookup API (an interface that lets apps ask a server for data) from October 9 until it was cut off on October 13. Passwords are among the possibly exposed fields, so customers must reset theirs at their next login.
• Capcom (more than 11.7 million): unauthorized access to CAPCOM ID was confirmed on October 19. Attackers changed the passwords on 196 accounts, which Capcom has reset.
• Burger King Japan (11.18 million): the app member server was accessed October 2–7.
• Daiichi Kosho (8,631,000 customers): malware turned up on a PC at contractor Nippon Columbia Group on October 5. Daiichi Kosho says no theft is confirmed.
• Yamato Transport (5.31 million) and Nikkei (1.83 million): Yamato first announced its deferred-payment breach on September 29, with details reported on October 16. Nikkei's attackers used stolen credentials on a cloud development system from October 7.
• GMO Internet Group: a rogue program was planted on customers' servers in its Onamae.com Desktop Cloud service, used by several foreign-exchange (FX) brokers. CEO Masatoshi Kumagai wrote that the attacker demanded $50 million in cryptocurrency, which GMO refused. Five FX firms reported customer damage, and Kyodo reported that leaked passwords were used in fraudulent trades. GMO says it will repay those losses.
• IDC Frontier: ransomware hit SoftBank's cloud subsidiary on October 7, affecting 495 companies and local governments, according to the Asahi Shimbun as cited by The Next Web. JR East warned that member email addresses might have leaked through it, but later concluded they hadn't.

What leaked: names, addresses, passwords and card fragments

The pattern matters more than any one row. None of these notices lists full card numbers. What leaked instead is raw material for convincing scams: someone holding your name, phone, address, hotel booking or donation amount can write a message that sounds exactly like your travel site, ISP or town hall.

Why is Japan being hit by so many cyberattacks?

There's no single answer, but the evidence points to sheer volume plus a few repeated weak spots. Macnica researcher Yutaka Sejiyama had logged 119 incidents this year involving stolen or exposed personal information by mid-October, BleepingComputer reported. Japan's National Police Agency recorded a record 123 ransomware incidents in the first half of 2026, according to the Japan Times as cited by The Next Web.

How the attackers got in: the hacking methods

• Weak web apps and APIs. Sejiyama found attackers probing websites and APIs for weak access controls, misconfigurations and poor login checks, and exploiting known bugs that already had fixes (so-called n-day vulnerabilities). Sourcenext's abused lookup API fits that description.
• Stolen passwords. Nikkei's attackers simply logged in with credentials stolen earlier.
• Suppliers. One break-in at a shared provider spreads: IDC Frontier's ransomware touched 495 organizations, a contractor's PC put Daiichi Kosho's members at risk, and GMO's servers led to losses at five FX brokers.

Is AI behind Japan's cyberattacks?

Possibly, but it isn't proven. Japan's National Cybersecurity Office told the October 26 meeting there is a high possibility AI is being used in the attacks, the Yomiuri Shimbun reported. Experts told the Japan Times there's no firm evidence AI guided them, though Paul Ziegler of the security firm Reflare said large language models are sharply cutting the cost of skilled hacking, The Next Web reported. Either way, the methods companies have described, such as abused APIs, stolen logins and infected contractor PCs, are old problems.

Who is behind it?

No government or company has publicly named the attackers, and nothing public ties the October breaches to one group. GMO's $50 million ransom demand suggests money was at least one motive there. The National Cybersecurity Office has also warned that attackers have impersonated cyber defenders, according to The Next Web.

What Japan's government is doing

• October 1: a new law took effect allowing "active cyber defence": police and the Self-Defense Forces can find and neutralize servers used in attacks. GMO asked for it to be used, though the law isn't designed to be triggered by companies. Chief Cabinet Secretary Minoru Kihara said the government will decide on the law's terms, whether or not a company asks.
• Early October: the National Cybersecurity Office told ministries, local authorities and companies to update security software, use strong passwords and tighten supply-chain security. The ruling Liberal Democratic Party's (LDP) cyber chief, Masaaki Taira, said Japan was in a state of emergency in cyberspace.
• October 20: the LDP proposed a cyberattack countermeasures headquarters under the prime minister's office and better pay rules to hire skilled "white hackers".
• October 26: Takaichi chaired the first ministers' meeting on the attacks, joined by ministers including Toshiharu Furukawa (cybersecurity) and Shinjiro Koizumi (defence). "This is a serious situation that requires us to urgently strengthen our countermeasures," she said, according to Kyodo. She ordered an emergency package by the end of the following week and set three tasks: support for affected companies, faster threat alerts, and working with allies to identify the attackers.

Background: the KDDI breach

The wave didn't start in October. On June 17, KDDI, Japan's second-largest mobile carrier, found that attackers had used an unknown flaw in third-party software (a zero-day) to break into an email platform it runs for internet providers including JCOM, Nifty and Biglobe, BleepingComputer reported. In July KDDI said more than 12 million people were affected, with email addresses and passwords involved.

What should people in Japan do now?

• Assume scammers know your basics. A caller or email that knows your name, phone number and address proves nothing.
• Go direct, don't click. Sourcenext, Capcom and Rakuten are contacting affected customers, and scammers will copy those messages. Type the company's address yourself or use its app.
• Change reused passwords. Trust Bank asks Furusato Choice members to change any other account using the same email and password. Sourcenext forces a reset at your next login.
• Turn on two-step sign-in for your email, Rakuten ID and any shopping or game accounts that offer it. It stops a leaked password alone from opening your account.
• Check card statements if you booked overseas on Rakuten Travel. Rakuten says the partial card data can't be used for payments on its own, but a scammer can quote your last four digits and expiry date to sound like your bank.
• Furusato nozei donors: watch only Trust Bank's own announcements for the restart, and ignore messages about "refunds" or "deduction errors". If you want to donate before year-end, check your chosen town's official website.
• FX traders: if your broker used GMO's server service, check with the broker directly. GMO says it will repay losses from unauthorized transactions.

Japan data breach FAQ

Which Japanese companies had data breaches in October 2026?

The biggest notices came from Sourcenext (up to 22.5 million records), Capcom (11.7 million), Burger King Japan (11.18 million), Daiichi Kosho (8.6 million), Yamato Transport (5.31 million), Furusato Choice (4.45 million), Rakuten Travel (up to about 2.6 million), Sony's So-net and plala (2.59 million) and Nikkei (1.83 million). GMO Internet Group and IDC Frontier were also hit.

Was Rakuten hacked?

Yes. Rakuten Group said on October 26 that attackers got into some overseas hotel booking pages run by its subsidiary Rakuten Travel Xchange, and separately into its multilingual booking site. Up to about 2.6 million and 860,000 logged-in customers' details were involved respectively. Rakuten says no full card numbers, security codes, passwords or addresses were taken.

Was my Furusato Choice data leaked?

If you had a Furusato Choice account, assume so. Trust Bank says 4,454,097 member records leaked, including names, emails, addresses, phone numbers, hashed passwords and estimated deduction amounts. Watch Trust Bank's own announcements for updates, and don't rely on links in messages. Change any password you reused elsewhere, and treat calls about refunds or tax deductions with suspicion.

Were credit card numbers stolen?

Not in full, based on what companies have said. Rakuten Travel exposed partial card details (first digits, last four digits, name and expiry) for up to about 36,000 overseas bookings. Sourcenext, Capcom and Burger King Japan say card data wasn't affected. Trust Bank's notice doesn't list card data. Sony's So-net leak included 16 bank account records.

Why are so many Japanese companies being hacked?

Researchers point to attackers probing websites and APIs for weak access controls and unpatched known bugs, plus stolen passwords and attacks on shared suppliers such as cloud hosts. A Macnica researcher counted 119 personal-data incidents this year by mid-October. Several companies, including Furusato Choice, Rakuten and Sony, haven't yet explained how attackers got in.

What is Japan's government doing about the cyberattacks?

Prime Minister Sanae Takaichi chaired the first ministers' meeting on the attacks on October 26 and ordered an emergency package of measures by the end of the following week. The government can now use "active cyber defence" powers, in force since October 1, to neutralize attack servers. The LDP wants a dedicated countermeasures headquarters.

Who hacked Rakuten, Sony and Furusato Choice?

Nobody knows publicly. None of the three companies has named an attacker or explained how they got in, and the government hasn't attributed the wave to any group. In the separate GMO case, an attacker demanded $50 million in cryptocurrency. Treat any online claim naming a culprit as unverified until a company or the police confirms it.

Cleus is an uncensored AI agent that searches the web live, so it can tell you what's changed since this was written.

Sources

• Trust Bank: notice on the Furusato Choice data leak (Oct 20, 2026)
• Impress Watch: Furusato Choice restarts its donation management system in stages (Oct 26, 2026)
• ScanNetSecurity: Izumiotsu unable to accept donations after the Furusato Choice breach
• Rakuten Group: Rakuten Travel unauthorized access notice (Oct 26, 2026)
• Innovatopia: Rakuten Travel, up to 2.6 million records on overseas hotel pages
• Cleus: Sony data breach 2026, So-net and plala
• Sourcenext: notice on unauthorized access to member information (Oct 15, 2026)
• BleepingComputer: Capcom confirms data breach affecting 11.7 million accounts
• BleepingComputer: Burger King Japan data breach exposes 11 million customer records
• BleepingComputer: Nippon Columbia malware incident exposes 8.6 million karaoke fan records
• BleepingComputer: Nikkei discloses third data breach in a month
• Jiji Press via Nippon.com: More Japanese firms disclose details of data breaches (Oct 16, 2026)
• Jiji Press via Nippon.com: LDP urges government to address cyberattacks on companies (Oct 20, 2026)
• Kyodo via Bernama: Takaichi orders emergency cyber package (Oct 26, 2026)
• Kyodo via Bernama: GMO hacker threatens leak, five FX firms report damage (Oct 27, 2026)
• Yomiuri Shimbun via Asia News Network: Japan to finalise emergency measures for cyberattacks
• The Next Web: Japan steps up cyber warnings as data leaks hit millions of customers
• Innovatopia: JR East and View Card warn email addresses may have leaked via IDCF
• ScanNetSecurity: JR East concludes Eki-net and Otona no Kyujitsu Club members weren't affected
• BleepingComputer: KDDI says data breach affects over 12 million people