About

• It covers security incidents of every kind: cyberattacks, and data leaks from misconfiguration, misdelivery, lost devices or insiders. System failures unrelated to attacks are left out.
• It holds selected incidents from public sources, not every incident in Japan. Counts by region or month do not show how often incidents really happen or the risk in a region.
• Every incident cites at least one source: an official notice, a news report or a research report, always from a site run by an identifiable company or organization.
• Entries rest on facts the sources published, with nothing filled in by guesswork; anything not published is shown as unknown. Classifications such as attack method and industry or type are ours, based on the sources.
• Dates in lists and counts are disclosure dates, not necessarily when the attack or leak happened.
• Leak sizes are the largest number of leaked items the sources stated, including items only at risk. An item can be a person, an account or a document, and the same person can appear more than once. Incidents with no stated number are left out of the total and shown separately.
• Location is the organization’s registered office (the main office for bodies without a corporate number), not the site where the incident happened. An incident that spans prefectures counts in each, so prefecture counts do not add up to the national count.
• “Through a supplier” means the organization was hit by an attack or leak at a contractor or cloud provider, not in its own systems.
• “Precautionary halt” means the organization took its own services offline to prevent harm, with no breach confirmed. These organizations are not counted as affected.
• Public figures such as employee counts carry their date and source.

Each organization in an incident gets one of four levels for how hard the incident hit it: the highest level whose criteria a source states. Attacker claims count only when a news outlet reports them.

• Critical: personal data of 100,000 or more people leaked or at risk; My Number, payment card, bank account, health data, ID images or passwords leaked or at risk in a breach; core operations (such as production, patient care, logistics, a public service or a provider's own service) or the main service stopped by an attack for 1 day or more; money lost to fraud or theft, or a ransom paid
• Major: personal data leaked or at risk in a confirmed breach; data the attackers published, as a news outlet reports
• Moderate: unauthorized access with no personal data leaked or at risk; site defacement; personal data sent to the wrong people or lost on a device; a precautionary stop of an essential service (disaster and emergency alerts, emergency reporting, payments and balances, medical care and booking) or of the main service for 1 day or more
• Minor: a precautionary stop of websites, forms or secondary features; an outage under 1 day with no data affected

An incident's severity is the highest level of its organizations. A major incident is critical with 1,000,000 or more records, or with 50 or more organizations breached or hit through a supplier; precautionary stops never raise it, however many there are.

The levels apply these criteria to published facts and describe the effect of an incident. They do not judge how an organization responded.

• Entries are based on sources such as official notices, news reports and research reports. We cannot guarantee that what the sources say is accurate.
• We work to keep the information accurate, complete and up to date, but we do not guarantee it. Entries reflect what was known when they were published and may differ from the facts after later investigations or follow-up reports. Check the organizations’ official notices for the latest status.
• Most listed organizations were on the receiving end of an attack or incident. A listing does not indicate that the organization was negligent or broke any law.
• The site is for information only and is not advice on security measures, law or investment.
• Aawa Technologies is not liable for damage arising from the use of this information, except in cases of willful misconduct or gross negligence.
• We are not responsible for the content of linked external sites.
• Entries may change without notice.
• Names of organizations, products and services are trademarks or registered trademarks of their owners. The site is not affiliated with the organizations listed.
• As a rule, we do not publish the names of individuals.

The incident summaries, classifications, compiled figures and the structure of the database are available under the Creative Commons Attribution 4.0 International license (CC BY 4.0). You may copy, adapt and share them, also commercially.

• Credit “JapanHacked (Aawa Technologies)”, link to the page you used and to the license, and say if you changed anything.
• Not covered: the source articles and notices and their titles (they belong to their publishers), the map data (under the National Land Numerical Information terms), and the JapanHacked name and logo.

The services you pick on the services page are saved in your browser. The site has no accounts and keeps no profile of your selection. To list the matching incidents, the page includes the ids of the picked services in its requests to the site.

Map: processed from MLIT National Land Numerical Information (administrative areas)

Aawa Technologies

To report an error or new information, contact us through the Aawa Technologies site. A corrected entry shows the date in its “Last updated” line.