Comparison of 71 Domestic Incidents Announced in Sept–Oct 2026

This article collected and compared the announcement texts for 71 incidents that were publicly announced by October 19, 2026, and for which the official announcement texts by the announcers themselves were obtained. The aggregation, classification, and day-count calculations are treated as findings aided by automation (Claude Code), and descriptions in the texts are quoted as factual. This is not a complete survey; cases for which official texts could not be obtained are not included, which is a limitation.

By classification, of the 71 incidents 58 were categorized as "leakage (including possible)" and 11 of those were reported as involving service outages in addition to leakage. Thirty-four initial announcements did not state a cause; of the 37 incidents with identified causes, they were divided into categories such as "vulnerability/specification flaws" and "from contractors, related companies, or infrastructure providers," but this is an observation based on the announcement texts and does not represent the overall distribution.

Items for companies to check, as inferred from the announcements, include: (1) boundaries with external parties including contractors and infrastructure, (2) verification when changing public-facing surfaces, (3) follow-up to confirm that an issue has been fixed after discovery, (4) channels for receiving external reports, (5) the amount of data held and retention periods, and (6) recovery procedures when services stop. Public organizations (the Personal Information Protection Commission, JPCERT/CC, IPA, the National Cybersecurity Office, etc.) issued advisories in the same period, commonly calling for management of external outsourcing, scrutiny of externally exposed applications, and deletion of unnecessary data.

There were multiple examples where later reports revised the scale or impact of damage (such as corrections to skyticket's card information and finalizing GMO Research's case counts), indicating that conclusions should not be drawn from initial figures alone. For users, basic cautions are repeatedly emphasized: do not open suspicious messages or enter authentication credentials. The article is based on fixed data for a specific time frame and concludes that further follow-up on subsequent reports and reaggregation will be necessary.