Repeated Unauthorized Accesses: List of Companies Disclosing Personal Data Leaks (Updated As Needed)

Nikkei reports that “since September 2026, personal data leaks have occurred repeatedly due to unauthorized access to companies and organizations,” and it lists company names and summaries of the damage by date. The reported cases focus mainly on incidents from early to mid-October, and include large-scale cases such as Yamato Transport (about 5.31 million records), SOURCENEXT (possibility of about 22.52 million records), and Lawson (about 2.15 million records).

The list includes not only cases caused by unauthorized access but also incidents disclosed as having a “risk of leakage” due to causes such as mistaken transmission by contractors or system malfunctions, and the types of compromised data vary widely, including names, email addresses, addresses, credit card information, driver's license images, and passport information. Each item links to a separate article, where detailed disclosures and corporate responses can be checked.

This article organizes disclosures in chronological order and is characterized by its straightforward enumeration of factual details (company names, estimated numbers, causes). Because figures and causes reported at the time of disclosure may be updated or corrected by subsequent investigations, readers should also check the latest follow-ups and official announcements from the companies involved.

As guidance for readers, the article also links to explanatory pieces on “responses to data breaches” and “urgent corporate countermeasures.” The frequent incidents seen this time often involve outsourced vendors, cloud services, or third-party integrations, underscoring once again the importance of corporate governance and security management by contractors.