Japan's data breach wave grows as Yamato and Nikkei confirm customer records were taken

Imagine a text about a parcel that uses your real name, your address and the last thing you bought. That is the quiet risk behind the latest Japan data breach news: on 16 October, Yamato Transport and the Nikkei newspaper group both confirmed that customer data had been taken.

They follow Burger King Japan, which disclosed a leak from its app a day earlier. By media counts, more than 20 large Japanese firms have reported attacks in recent weeks. No link between the cases has been shown, but together they show how much personal data ordinary companies hold, and for how long.

Three notices in two days, from parcels to burgers

Yamato Transport, Japan’s largest parcel firm, found unauthorised access to its “Kuroneko Daikin Atobarai” pay-later service on 28 September and stopped it that night. Its parcel deliveries ran normally. After an outside security firm investigated, Yamato said on 16 October that about 5.26 million buyer records were taken, covering users back to October 2018. About 50,000 delivery-recipient records and about 4,100 merchant records were also taken.

Yamato’s total of about 5.31 million is buyer and recipient records added together. The company says this does not mean 5.31 million people were harmed. The data includes names, addresses, phone numbers, items bought and, in about 490,000 records, an email address. Credit-card data and passwords were not taken.

Nikkei says someone used stolen login details to enter a cloud service it uses for system development on 7 October. About 1.83 million records were involved. Of these, about 150,000 hold personal details such as a name, email, address, phone number or birth date. The other 1.68 million or so are ID numbers only, which Nikkei says cannot identify a person on their own. No card data was involved, and the login details were disabled.

Burger King Japan said on 15 October that a system holding its app members’ data was accessed between 2 and 7 October. About 11.18 million member records were affected, including names, emails, phone numbers, birth dates and gender. The company does not hold card numbers, and no password leak has been confirmed. It reported the case to Japan’s Personal Information Protection Commission.

None of the three firms has confirmed misuse of the data so far.

Who is behind it, and why the “emergency” talk

No company, government body or police force has named an attacker. Yamato and Burger King have not said how the intruders got in.

The phrase behind the “Japan cyber emergency” headlines came from Masaaki Taira, who leads the ruling Liberal Democratic Party’s cybersecurity headquarters. At a party meeting on 9 October, he said the situation could be called a “state of emergency in cyber space”. That was his description. The government has not declared any formal emergency.

At the same meeting, the National Cybersecurity Office told the party that any link between the cases is not clear yet. That same day it urged businesses to assume an attack can come at any time, fix web-system weaknesses, use multi-factor sign-in, and keep only the data they need.

What to do after a data breach, wherever you live

The bigger danger now is not the stolen files themselves but the scam messages built from them. Yamato says customers are already reporting suspicious emails, texts and calls. The same habits help anyone, in any country:

• Treat any message about a parcel, order or account with care. Open the official app, or type the website address yourself, instead of tapping a link.
• Never give card or login details through a link in a message.
• Use a different password for each account. A password manager makes this easy.
• Turn on two-step sign-in, where a code or app prompt is needed as well as your password.

Fast disclosure is welcome; holding years of data is the harder problem

There is real good here. All three firms stopped the service or blocked access, warned customers about scams, and published detailed counts. Yamato and Nikkei were careful to explain what the record counts mean. Japan’s regulators also moved quickly, with notices from several agencies.

The harder lesson from this Japan data breach wave is about storage. Yamato’s buyer data went back eight years. The Personal Information Protection Commission has already told firms to delete personal data they no longer need. In our reading, that matters more than any single fix, because data that is not kept cannot be stolen.

On balance, the response so far looks steady and open. The lasting test is whether companies keep less, guard their logins better, and explain how attackers got in.

Watch for Yamato’s and Burger King’s findings on the entry route, and for the privacy regulator’s updated data-safety guidelines, due in April 2027. For more company news, see our business section.