An email arrives from your service provider on Friday evening

It is 5 p.m. on Friday. The company behind the service you use to manage customer information sends this email:

“Our systems have been accessed without authorization, and your customers’ information may have been disclosed outside the service. We are investigating the details.”

Are your customers affected? Should you stop using the service? What should your support team say if inquiries arrive on Monday? Decisions keep coming while you wait for the investigation results.

One easily overlooked point is that even when a breach occurs at a contractor, your company, which entrusted it with customer information, generally also has duties to report to the Personal Information Protection Commission (PPC) and notify affected individuals if the incident is reportable. In principle, these duties apply to both the commissioning business and its contractor. A contractor that makes the prescribed notification to the commissioning business can be exempt from its reporting and individual-notification duties.

This takes more than IT. Management, operations, legal, and customer service need to decide what to stop, what to communicate, and what to fix first.

The 584 entries tell us more about routes than totals

Catorce’s Security Incident Database 2026 organizes 584 information-leakage and security incidents publicly disclosed in Japan from June 3 to October 21, 2026. Disclosures by different customer organizations can appear as separate rows even when they stem from the same contractor’s incident. Three points stand out:

  • Over half involve a chain of affected organizations: Of the 584 entries, 303 concern incidents at contractors or shared platforms, such as cloud services and SaaS, that led to disclosures by customer companies or local governments. Consolidating these chains leaves 328 underlying incidents.
  • The aggregate is concentrated in a small number of entries: The sum of the maximum disclosed quantities is approximately 264 million. However, 94% of that total comes from 32 entries that the database classifies as involving one million or more.
  • One in four also affected operations: There were 155 incidents involving operational impacts, such as service or shipment suspensions.

This concerns more than large corporations or companies holding vast amounts of customer information. An incident at a single service you use can put your company in the position of making announcements and responding to customers.

The 264 million figure needs care. It is a simple sum of maximum disclosed quantities, including possible exposure, mixing records, people, and accounts, with some overlapping counts. It also includes 24 entries for which the database could not verify a source. It is neither a complete statistical account of incidents in Japan nor a count of distinct affected people. When reviewing your own preparations, look at where exposure can originate as well as the size of the numbers.

Extend the objective from preventing incidents to limiting harm

Keeping systems updated and strengthening authentication remain essential. Even so, no company can promise zero possibility of an incident when new vulnerabilities, configuration errors, and incidents at contractors are all considered.

A company that knows where its customer information is stored and who manages it, and can promptly investigate and restrict access, has very different options from one still trying to find those answers.

Extend the objective beyond preventing incidents to being able to limit the harm when one occurs. That is this article’s starting point.

Initial response: contain the spread and preserve records

If exposure is suspected, first contact the response lead and record these three things, with times:

  • When the problem was noticed: the time of discovery.
  • What has been established: the facts.
  • Who did what: actions taken.

For a corporation, statutory reporting periods are measured from when any department learns of a reportable situation, rather than from the day it reaches senior management. This record also provides a foundation for the subsequent report.

Management should make clear who can authorize a service interruption or engage outside specialists.

Technical staff should assess operational impacts while isolating suspected devices, accounts, or connections. Preserve the logs needed for investigation at the same time. Resetting systems or deleting logs before understanding the cause can remove evidence of what happened and make it impossible to determine the affected scope.

If a contractor or cloud service is involved, ask about the investigation and preservation of logs. Separate what your company can investigate from what requires the provider’s cooperation. Assigning one person to coordinate communication makes the exchanges easier to manage.

Outside help is available when you are unsure how to proceed. On October 16, Innovation Platform Agency, Japan (IPA) opened a dedicated unauthorized-access helpdesk. It offers advice on immediate response and a list of specialist providers to companies and organizations that have suffered, or suspect, an incident. Telephone hours are weekdays from 9:30 a.m. to 5:30 p.m., excluding noon to 1 p.m. Email replies may not arrive until the next business day or later. Alongside identifying outside contacts, decide who can make decisions internally outside those hours.

IPA’s October 9 advisory also strongly recommends checking logs and accounts for publicly accessible applications and external services such as cloud platforms. If anomalies are found, treat them as an incident and engage specialists for a detailed investigation.

The initial-response process described here is our suggestion. Make actual containment and recovery decisions according to the incident and the characteristics of your business.

Put information customers can use to protect themselves first

Customers need to know more than that the company is investigating. They want to understand how they may be affected and what they should do now.

Even before the cause is established, you can apologize for the anxiety and inconvenience. If the incident occurred at a contractor, your own support team should still bring together the findings and keep customers informed.

Organizing the explanation into four parts can make it easier to understand:

Category What to include
What is known What happened, which information and scope are affected, and what action has been taken
What is being investigated Questions that remain open, such as whether exposure occurred and how many individuals are affected
What customers are asked to do Advice matched to the information involved, available assistance, and a contact point
The next update Where further information will appear and when the next communication is planned

Example wording for an initial notice

This example assumes names and email addresses may be affected. Replace the information fields, statement about whether card information is held, contact details, and deadline for the next update with verified facts and arrangements your company can deliver.

Subject: Important notice and apology regarding unauthorized access to an external service we use

Thank you for using [service name].
We have learned that an external service we use for customer management was accessed without authorization, and your name and email address may have been disclosed outside that service. We sincerely apologize for the concern and inconvenience this has caused.

What we know at this point

  • Information that may be affected: names and email addresses, as of [month and day].
  • The service does not hold credit card information.

What we are investigating

  • Whether information was actually disclosed and which customers are affected.

What we ask you to do

  • Please be alert to suspicious emails exploiting this incident. We do not ask for passwords or card numbers by email.

Our next update

  • We will publish a further update on our website [website] by [month and day].
  • Inquiries: [support contact], telephone [number], opening hours [hours].

The accompanying advice depends on the information involved. For email addresses, warn about scams exploiting the incident. For IDs and passwords, carry out necessary resets and session invalidation on the company’s side and explain exactly which actions customers need to take. Fraudulent messages can also impersonate the incident notice itself, so make the contact point accessible through the official website or app customers normally use.

When writing that no misuse has been identified, state how far the investigation has reached and the time of that assessment. While parts remain unexamined, avoid wording that suggests safety has been established.

Consider the burden of any change or check you ask customers to make. Keep the steps short and provide a way to speak to someone if help is needed. Communicate compensation or cost-coverage policies after deciding what can actually be provided. Honesty shows in these details.

Check statutory reporting and individual notification alongside the investigation

Review legal duties early, alongside the communication plan. For private-sector businesses, leakage or related incidents involving personal data, including suspected incidents, generally require a report to the PPC and notification to affected individuals if any of the following applies:

  • The data includes special care-required personal information, such as medical history.
  • Unauthorized use could cause financial harm, for example through credit card numbers or IDs and passwords for services that allow payments.
  • The incident results from acts suspected of having an improper purpose, such as unauthorized access.
  • The number of affected individuals exceeds 1,000.

The first three categories can apply even when just one person’s data is involved. An incident can also be reportable when exposure is suspected, without confirmation that a leak occurred. Exceptions exist for measures such as advanced encryption. The improper-purpose category also covers certain personal information, including information intended to be collected. Check the precise scope and exceptions in the PPC’s guidance.

Reporting has two stages:

Stage Timing or deadline Content
Initial report Promptly after learning of the situation; approximately three to five days is the general indication What is known at that point
Final report Within 30 days of learning of the situation, or 60 days for incidents resulting from acts suspected of having an improper purpose Prescribed information, including the cause and number of affected individuals

The initial-report system does not require waiting until every fact is known. Matters that remain unclear can be reported as under investigation. If reasonable investigative efforts still leave matters unresolved by the final-report deadline, report what is known at that point and supplement it as soon as the remaining facts become known. Notify affected individuals promptly in light of the circumstances as well. See the PPC’s leakage response resources and General Rules Guidelines, section 3-5 for details.

A website announcement, individual notification, and a report to the PPC are separate actions. An announcement alone does not constitute notification to individuals, except in cases such as when individual notification is difficult and necessary substitute measures are taken to protect their rights and interests. Review case-specific decisions, including sector rules and outsourcing arrangements, with legal staff or specialists.

The amended Act on the Protection of Personal Information, promulgated on July 17, 2026, includes changes to individual notification and leakage reporting. Except for certain provisions, it will take effect on a date specified by Cabinet Order within two years of promulgation. Do not apply the new arrangements solely because the amendment has been promulgated; check the laws and rules in force when responding.

Prioritize prevention by harm to customers and operational impact

After an incident, updates, access reviews, training, and monitoring can all become urgent tasks. If you cannot complete everything at once, prioritize by potential harm to customers and operational impact. However, respond to an active compromise without waiting for an improvement plan.

1. Stop harm through the same route

Investigate the weakness or unauthorized connection and address it through fixes, invalidation of credentials, and removal of unnecessary public access. After applying a fix, check that it works through the actual path people use. Go beyond staff warnings and consider controls that prevent one mistaken action from exposing large amounts of information.

2. Reduce the scope of information and access

Review where customer information is stored, why it is retained, and for how long. Check statutory and contractual retention obligations and preservation needs for the investigation before reducing unnecessary collection and long-term retention. IPA’s October 9 advisory also calls for keeping retained data to the minimum necessary.

Check who can retrieve data in bulk and whether former staff or contractors still have access. Prioritize information with a high potential impact if misused, such as medical histories and identity documents, even when quantities are small.

Include generative AI in this review. The database cited above also includes publicly disclosed incidents in which employees or contractors entered personal information into generative AI. If AI tools or agents have access to customer data, that is another access permission to review.

3. Test whether recovery and communication can continue

Testing restoration reveals what a backup can recover and how long it takes. Check whether a compromised account could also delete backups and whether logs can help identify a safe recovery point. IPA’s lessons from ransomware incidents also identifies consistency between backups and logs as a lesson.

Customer updates and support continue while systems are unavailable. Include alternative communication channels, the person responsible for updates, and whoever authorizes business resumption in an exercise. Restoring systems does not guarantee retrieval of information already exposed. Continue customer assistance separately from recovery.

What you can do in 30 minutes this week

Choose one workflow that handles customer information, such as order processing or membership administration. Set aside around 30 minutes with its operational owner, IT, and the manager who makes consequential decisions. Try answering this question:

If we learned tomorrow that information might have leaked from this workflow, who would restrict access, investigate the scope, and explain the situation to customers?

Choose one point where the answers stall, and assign an owner and a deadline. For example:

  • Confirm emergency contacts for contractors and services you use.
  • Prepare your company’s first notice using the example above.
  • Assign a person and a date to test backup restoration, and carry out the test.

Use that step to inform the next exercise and improvement.

Behind large numbers are individuals asking, “What has happened to my information?” To reduce their uncertainty and harm, continue prevention while preparing to act after an incident.

U-Rec supports security for companies bringing AI into their business. Please get in touch about information management when adopting generative AI or AI agents. Contact us

References and scope

Accessed October 30, 2026. Dates refer to 2026 unless stated otherwise. Catorce’s aggregate is based on public disclosures; U-Rec has not independently verified every incident in the underlying compilation. The response examples and priorities are our practical suggestions, not legal conclusions about an individual incident.