List of Domestic Data Breaches and Unauthorized Access Incidents (as of October 22, 2026)

The LegalAgent AI Legal Lab list organizes incidents and estimated impact by month based on each company’s official announcements. As of October 22, 2026, 159 incidents are listed, of which 72 are classified as confirmed breaches, 75 as potential breaches or under investigation, and 60 as service outages. For 84 incidents included in the aggregation (excluding image metadata), confirmed breaches are reported as approximately 146,726,509 records and potential exposures as approximately 89,826,540 records.

Major developments since mid-October include reports that Recruit (カーセンサー/C-match) may have up to 3,709,551 records at risk of exposure, a confirmed leak of 4,454,097 records related to トラストバンク’s ふるさとチョイス, and 26,739 servers at potential risk in GMO Internet’s お名前.com Desktop Cloud, among many other follow-up disclosures. Additionally, Helpfeel, NTTソルマーレ, PingCAP, ユミルリンク, NEC, and others have published investigation results or announced additional impacted scopes.

Each incident in the list is labeled—based on the status of investigations at the time of disclosure—as "confirmed breach," "potential breach," or "breach unconfirmed," and the number of affected records is presented with notes such as "total records," "unique individuals," or "including duplicates." LegalAgent specifies its aggregation method and notes, and explains that duplicate counts arising from the same incident are not summed together.

This list is compiled and organized principally from companies’ official announcements; for details of each incident and future updates (such as service resumption timing or the presence of additional leaks), users should continue to check the respective companies’ announcements.