If you work in security, IT, or risk in Japan, someone in leadership has probably asked you a version of the same question this month. Is our company safe?
It’s a fair question. Since late September, Japanese companies in transport, retail, logistics, and entertainment have disclosed incidents that may have exposed tens of millions of customer records. Read the announcements one at a time, and they look like a run of bad luck. Read them together, and a pattern appears.
The honest answer is that no company can rule out an incident. But most of these breaches didn’t start with a brilliant, unstoppable attack. They started with something an attacker could see from the outside, like a database left open to the internet, a server that missed a patch, or a password that leaked months ago. In several cases, that door belonged to a contractor, a subsidiary, or a cloud provider.
That makes Japan’s breach wave one of the clearest third-party risk case studies of the year, and the lessons apply far beyond Japan. This article examines how attackers gained access, what to check in your own systems, and how to assess whether the vendors that handle your data are exposed to similar risks.
What happened in Japan’s 2026 breach wave?
More than 40 breach announcements were made in about a month, according to broadcaster TV Asahi. Security firm Trend Micro found that 600 Japanese companies and organizations reported cyber incidents or unauthorized access between January and the end of September.
On October 7, the Personal Information Protection Commission reminded businesses to review whether they still need the personal data they hold.
A selection of the disclosures, with organizations described by sector.
Different industries, different sizes. Look at the last column, though, and the same few entry points keep coming back.
How are attackers getting in?
Often, through vulnerabilities in internet-facing systems. In an October 8 alert, Japan’s national CERT, JPCERT/CC, warned that attackers were systematically probing websites and their APIs for weaknesses they could exploit to access data. Researchers reported 119 incidents involving personal data leaks from web systems operated by organizations in Japan between January 1 and October 6 this year.
Three entry points stand out:
- Exposed systems and APIs. Databases, admin panels, and mobile app back ends that can be reached from the internet when they shouldn’t be, or that don’t properly check who is asking for data.
- Known vulnerabilities that haven’t been patched. JPCERT/CC linked recent leaks to known software flaws, including an actively exploited SQL injection bug in a widely used data analytics tool. When a fix exists but isn’t applied, attackers move fast.
- Ransomware. The largest single incident in this wave was a ransomware attack on a domestic cloud provider, which reportedly affected hundreds of companies and local governments that hosted systems there.
Stolen passwords deserve a mention too, even where they haven’t been named in these disclosures. Government guidance during the wave urged organizations to strengthen authentication, and for good reason. A valid username and password lets an attacker walk in without setting off most alarms.
What should you look for in your own company?
Start by looking at your company from the outside, the way an attacker would. Attackers don’t begin with your internal network diagram. They begin with whatever anyone on the internet can reach.
You won’t be able to address every finding at once, and you don’t have to. Start with the vulnerabilities attackers are most likely to discover and exploit. Then keep checking. A database accidentally left exposed on a Tuesday shouldn’t go unnoticed until the next annual audit. Our guide to continuous monitoring explains how to keep track of changes and catch new risks as they emerge.
Leaked credentials deserve special attention. Major data breaches can put stolen email addresses and passwords into the hands of criminals, who trade or share them on underground forums and marketplaces. Because people often reuse passwords across services, credentials exposed in one breach could give attackers access to other accounts, including those at your organization. With so much personal data exposed in Japan this autumn, regularly checking for leaked employee and customer credentials should be part of your security routine. Catching compromised credentials early gives you a chance to reset passwords and secure accounts before attackers can use them.
Why do so many of these breaches trace back to third parties?
The company named in a breach announcement isn’t always the one responsible for the system that exposed the data. As the table above shows, one organization suffered a data leak through a system managed by an external contractor, while another was affected through a subsidiary responsible for managing membership data. Two transport operators were hit after their cloud provider suffered an attack.
In each case, the company faced the consequences: damaged customer trust, reputational fallout, and the responsibility to disclose the breach. Yet the vulnerability that allowed attackers in lay within a third party’s systems. That’s what makes third-party risk so difficult to manage. A company can secure its own systems and still be exposed through the vendors and partners it relies on.
Can You Run the Same Checks on Your Vendors and Business Partners?
Yes. You don’t need access to a vendor’s internal systems to assess its exposure. The same external checks you run on your own company can help you identify weaknesses in the organizations you rely on.
Start with a few key questions:
- Does a vendor that handles your customer data have a database exposed to the internet?
- Is your cloud or hosting provider running services affected by actively exploited vulnerabilities?
- Have a contractor’s employee credentials surfaced on the dark web?
Not every partner poses the same level of risk. A small contractor that manages your membership database may present a greater risk to your business than a large supplier with no access to customer data. It’s also worth looking beyond your direct vendors to understand which third parties they depend on. Yet many organizations still overlook these relationships. In the Panorays 2026 CISO Survey, only 41% of security leaders said they monitor these fourth parties.
Japan’s latest regulatory requirements add another reason to keep a close eye on third-party exposure. Mandatory incident reporting for designated critical infrastructure operators took effect on October 1, 2026. When an incident occurs, organizations need to quickly identify which partners may be involved, what systems or data those partners can access, and how the incident could affect their own operations.
This is where Panorays helps. The platform continuously monitors the external cyber exposure of vendors and business partners, identifies relevant cyber events through news and dark web sources, and maps the third parties behind them. By putting these findings in the context of each business relationship, Panorays helps security teams prioritize the vendors and partners that pose the greatest risk to their organization.
What should you check this month?
If leadership is asking whether you’re safe, these five checks give you a concrete answer.
- Find anything exposed that shouldn’t be. Databases, storage, admin panels, and test servers first.
- Patch actively exploited vulnerabilities on public-facing systems. Start with the flaws attackers are already using, not the full backlog.
- Lock down remote access. Confirm remote desktop and VPN gateways are updated and protected with multi-factor authentication.
- Search for leaked credentials. Check whether employee and customer logins connected to your company are circulating on the dark web, and reset what you find.
- Run the same checks on your critical vendors. Start with partners that hold customer data or run systems on your behalf, and ask where your backups are stored.
No checklist makes a company breach-proof. But every item above closes a door an attacker could have used, and that’s how “Is our company safe?” becomes a question you can answer with evidence.
If one of your vendors announced a breach tomorrow, would you know what data they held and what to do next?
Frequently asked questions
Why are there so many data breaches in Japan in 2026?
There’s no single cause. Disclosed incidents point to exposed web systems and APIs, unpatched known vulnerabilities, a ransomware attack on a cloud provider, and systems managed by contractors and subsidiaries. JPCERT/CC has warned that attackers are systematically probing Japanese websites for flaws.
How can I check whether my company’s data is exposed?
Start from the outside, the way an attacker would. Look for databases and cloud assets reachable from the internet, public-facing systems with actively exploited vulnerabilities, exposed remote access services, and company credentials circulating on the dark web.
Does this apply to vendors and business partners?
Yes. Several incidents in Japan’s 2026 wave came through a cloud provider, a contractor, or a subsidiary. The same outside-in checks can be applied to the partners that handle your data, without needing access to their internal systems.
