Between late September and mid-October, four well-known Japanese companies told customers that attackers had reached their data. Times Car, karaoke operator Daiichi Kosho, the Nikkei newspaper group and chipmaking supplier Advantest each issued a breach disclosure or update, and these Japan data breaches differ sharply in what was actually confirmed.
Where it stands: Nikkei’s figures date from its October 16 status, and Daiichi Kosho still says it has not confirmed that anything was stolen. Advantest is the only one of the four where a ransomware attack is confirmed, and its letters set a January 4, 2027 deadline to enroll in free monitoring.
The cluster arrives on top of other recent Japanese incidents. Burger King Japan separately reported attackers reaching a server with 11.18 million app-member records, which we cover in our Burger King Japan breach explainer, and KDDI previously disclosed an exposure across six internet providers, covered in our KDDI breach report.
Japan data breaches at a glance
| Company | Scale as reported | Theft confirmed? |
|---|---|---|
| Times Car (car sharing) | About 6.6 million accounts | Accessed, per company |
| Daiichi Kosho / Nippon Columbia | 8,631,000 customer and 93,000 employee records | No, exposure only |
| Nikkei (media) | 1.83 million records | Yes, per Nikkei |
| Advantest (chip testing) | Not disclosed | Yes, in October notice |
These are counts of records or accounts, not people. One person can hold several accounts, and some records contain almost nothing identifying, so the totals cannot simply be added together.
Times Car: identity documents in the mix
Times Car is a car-sharing service run by Times Mobility, part of the Park24 group. According to Hackread, the company detected unauthorized access to its web systems on the morning of September 25 and blocked the route the next day. BleepingComputer reports that “approximately 6.6 million user accounts were compromised,” covering current and former members.
The detail that matters most for customers came in a September 29 update. Identity-verification data tied to about 1.6 million accounts had been accessed, including “driver’s license images, utility bills used to verify addresses, student identification cards for student-plan users, and family verification documents.”
Some protections held. Times Car said passwords were kept in “a form that cannot be restored,” and that card details were not touched. The police and Japan’s privacy regulator, the PPC, have been told, and the company is reaching out to affected users in stages.
Daiichi Kosho: a contractor’s infected computer
The karaoke giant’s problem started outside its own walls. Its contractor, record label Nippon Columbia, told Daiichi Kosho on October 5 that it had found malware on an employee’s computer and isolated the machine the following day. BleepingComputer says the exposed files cover “93,000 employees and 8,631,000 customers.”
The brands named include BIG ECHO, MEGA BIG and Karaoke CLUB DAM, along with Banana Club, B-GARAGE and DK Dining. Daiichi Kosho stresses two limits: passwords were not in the data, and it sees no sign that loyalty points were misused. Most important, it “has not confirmed any data theft or leaks,” though it still tells customers to stay alert. Treat this one as an exposure, not a proven theft.
Nikkei: big total, smaller identifying core
Nikkei’s headline number needs unpacking. Per SecurityWeek, attackers used previously compromised credentials to get into a cloud service used for development work on the morning of October 7. The company says 1.83 million records were taken, but roughly 1.68 million of them hold nothing that identifies a person.
The rest is where the risk sits. About 150,000 records pair a name and home address with contact details and a birth date, while another 120,000 contain email addresses. Nikkei says no card data was involved. How the credentials were first stolen has not been explained.
Advantest: ransomware data theft confirmed months later
Advantest, which makes equipment for testing semiconductors, first disclosed a ransomware incident in February. Its February 19 statement said it noticed unusual activity on February 15 Japan time and that an outside party “may have gained access to portions of the company’s network and deployed ransomware.” In March the company said its experts had seen no sign that related data had been published.
The picture changed in October. In a notice dated October 6, Advantest confirmed that data was stolen in that attack. BleepingComputer, which reviewed the letter, says it is unclear whether the data belongs to customers, employees, partners or a mix, and that it found no public claim from any ransomware gang. Recipients are offered 18 months of Kroll identity, credit and web monitoring, and must activate it by January 4, 2027.
What customers of these companies should do
Times Car and Nikkei both say card data was not involved, and Daiichi Kosho says passwords were not in its files. For most people the realistic threat is targeted fraud that uses real personal details to look legitimate.
- Expect lookalike messages. Times Car says it will not ask for passwords or card details by email, text or phone. Apply that rule to all four companies: a message that knows your membership or order history is still not proof it is genuine.
- Take license-image exposure seriously. A copied driver’s license can support identity fraud long after a password is changed. If you were a Times Car member, be wary of any new account, loan or phone contract you did not open.
- Check your credit file. In Japan you can request a disclosure from credit bureaus such as CIC and JICC. Hackread notes CIC had trouble issuing reception numbers for online disclosures on September 29, though neither agency linked the demand to Times Car. If a site is slow, try again later rather than using an unofficial service.
- Enroll before deadlines. If an Advantest letter reached you, the Kroll enrollment window closes on January 4, 2027.
- Change reused passwords. Even where passwords were protected or absent, any login you share across sites deserves a unique replacement.
Daiichi Kosho is the case to watch: if its investigation moves from exposure to confirmed theft, more than 8.7 million customer and employee records would be in play. More incidents from this period are listed in our October 2026 breach roundup.
Frequently Asked Questions
Which Japanese companies had data breaches in fall 2026?
Among the largest disclosed between late September and mid-October: Times Car (about 6.6 million accounts), Daiichi Kosho through its contractor Nippon Columbia (more than 8.7 million customer and employee records), Nikkei (1.83 million records), Burger King Japan (11.18 million app records), and Advantest, which confirmed that data was stolen in a ransomware attack from February.
Were passwords or credit cards stolen in the Times Car breach?
Times Car says card data was untouched and that passwords were kept in a non-restorable form. Identity documents were a different story: identity-verification data linked to about 1.6 million accounts was accessed, including driver’s license images.
Was data actually stolen from Daiichi Kosho karaoke customers?
Not confirmed. Daiichi Kosho says malware on a contractor’s computer exposed the records, but that it has not confirmed theft or leaks. It still advises customers of brands such as BIG ECHO and Karaoke CLUB DAM to stay cautious.
How do I check my credit file in Japan after a breach?
Japan’s credit bureaus, including CIC and JICC, let you request a disclosure of your own credit information. Look for loans or card applications you did not make. Demand at CIC spiked around the time of the Times Car disclosure, though no agency tied the surge to it.
Sources
- Hackers Steal 1.8 Million Records From Nikkei — SecurityWeek (Ionut Arghire), not shown on cached page (after October 16, 2026)
- Nippon Columbia malware incident exposes 8.6 million karaoke fan records — BleepingComputer (Bill Toulas), October 11, 2026
- Times Car confirms data breach affecting 6.6 million user accounts — BleepingComputer (Bill Toulas), September 28, 2026
- Japanese Car-Sharing Site Times Car Data Breach Affects 6.6M Accounts — Hackread (Deeba Ahmed), October 1, 2026
- Advantest confirms personal information stolen in ransomware attack — BleepingComputer (Bill Toulas), October 7, 2026
- Advantest Responds to Cybersecurity Incident — Advantest Corporation, February 19, 2026
- IT System Incident Update — Advantest Corporation, March 4, 2026
- Burger King Japan data breach exposes 11 million customer records — BleepingComputer (Sergiu Gatlan), October 16, 2026
This article is news reporting and general security information based on the public sources listed above, as they stood on the dates shown. Incident details often change as investigations continue; check the affected company’s own status page and notices for the latest. Data Breach Radar is not affiliated with any company named here.