Last modified 2026-10-24
What we include
- Data breaches, unauthorized access, ransomware, misdirected mail, and lost data announced by organizations in Japan.
- Facts come from the organizations’ own announcements, regulators, and news reports. Each incident page lists its sources, which are in Japanese.
How severity is calculated
Severity has five levels, from 1 (Minor) to 5 (Critical). It is the higher of two levels: the data leak level and the operational impact level.
The data leak level is the sum of three scores: sensitivity, scale, and certainty.
| Factor | Score | Rule |
|---|---|---|
| Sensitivity | 3 | Includes plaintext passwords, payment details, health information, ID documents, or My Number |
| 2 | Includes hashed passwords, credentials, or dates of birth | |
| 1 | Contact details only, such as names, email addresses, phone numbers, addresses, or IDs | |
| Scale | 3 | The largest announced count is 1 million or more |
| 2 | 10,000 or more | |
| 1 | Fewer than 10,000, or not disclosed | |
| Certainty | 0 | Leak or access confirmed |
| −1 | Possible leak, under investigation, or not stated | |
| −2 | Confirmed that no data leaked |
A total of 6 gives level 5, 5 gives 4, 4 gives 3, 3 gives 2, and 2 or less gives 1. Incidents with no data listed are level 1.
Sensitivity uses the most sensitive data in the incident, and certainty is 0 if a leak is confirmed for any row. We do not score each row separately.
The operational impact level is 3 when core operations, shipping, or all sites stopped, and 2 when some services stopped. Operational impact alone never raises severity to 4 or higher.
How we handle counts
Counts are the figures the organization announced, including words such as “about” and “up to”. Because the same person may appear in several rows, we never add rows together. Scale uses the largest count, not a total.
If you find an error
Please tell us through the contact page. We will check it, fix it, and update the date.