> JapanHacked_

How to use

An incident means an event such as a cyberattack or data leak. Choose a task in Start here or jump to a numbered section in Contents. Common questions helps with things that may be confusing, and the glossary explains unfamiliar words.

1. Start here

  • Check a service you use

    1. Use the Services link below, then enter the service name.
    2. Tick Pick next to the services you use.
    3. In Your services above the list, open an incident title to read its details.
    → to “Services”

  • Check a company or organization

    1. Use the Organizations link below, then enter a name or Japanese reading.
    2. Choose the organization’s name in the list to open its page.
    3. Open an event in its Incident history.
    → to “Organizations”

  • Find a particular incident

    1. Use the Incidents link below, then enter a company or service name.
    2. Narrow the list by disclosure date or method if needed. On a phone, open Filters.
    3. Open a title for the details, then follow Sources to the original notice.
    → to “Incidents”

  • Explore regional counts and trends

    1. Use the Statistics link below, then choose a Range.
    2. Choose a prefecture on the map. On a phone, tap it, then tap View incidents.
    3. Open an incident from that list. Return to Statistics for the monthly and method charts.
    → to “Statistics”

2. Home

→ to “Home”
  • The question buttons at the top lead to the incidents, services, organizations, statistics and About pages.
  • Spotlight shows major incidents picked by the operator, with the organizations affected, the latest source and a link to the details.
  • Latest disclosures and updates lists newly disclosed incidents (New) and incidents with a new official or regulator report (Update), newest first; within a day, the most severe come first.
  • The map shows incidents per prefecture over the past 12 months. Click a prefecture to list its incidents; on a phone, tap it, then tap View incidents. Prefectures with activity in the last 7 days pulse.
  • The chart shows incidents disclosed per month over the past 12 months. More statistics opens the statistics page.

4. Incident search

→ to “Incidents”
  • Each row is one incident. Click a title to open its details.
  • Filter by disclosure date, method, impact, status, severity and leak size.
  • You can also filter by the affected organizations’ location, industry/type, kind and employees. To choose a municipality, pick a prefecture first.
  • Press Clear filters to remove the conditions.
  • Click a column heading to sort by it, and again to reverse the order. The newest disclosures come first at the start.
  • The list shows 50 incidents at a time; switch pages above or below the table.
  • Filters and sorting are part of the page address (URL). Save or share it to reopen the same conditions; the results can change as entries are updated.
  • On a phone, every filter except the text search is behind the Filters button, and a select sets the order.

5. Incident details

  • The tags at the top show the status, severity, methods and impacts. Choose a tag to open the glossary page explaining it.
  • Incidents written up in detail show their text below the summary in sections such as What happened. Choose a number such as [1] in the text to jump to that source.
  • Words with a dotted underline in the summary and text are glossary terms. Choose one to see its meaning, and open its page from there. Only the first place of each term is underlined.
  • Organization, brand and service names in the summary and text link to their pages.
  • The page shows the disclosure date, the number of organizations involved, the leak size and the downtime (Unknown when not published), the timeline (started, detected, disclosed, resolved), the attack or cause, and the data exposed or at risk. Other published counts, such as affected accounts or files, have separate labels and do not establish how many people’s personal data leaked.
  • Services hit and Organizations involved show each one’s role (breached, through a supplier, precautionary halt) and impact level. Choose a name to open its page.
  • Long lists of services, organizations and sources show their first 10. Choose Show all, beside the heading or below the list, to see them all, and Show first 10 to fold them again.
  • When an incident involves more than one service or organization, Open in service search and Open in organization search show them in the list pages.
  • When the harm spread through a supplier, the Supply chain diagram shows which supplier reached which organizations.
  • Sources link to the official notices and news reports. Last updated is when the entry last changed.

6. Services

→ to “Services”
  • Service search finds services such as online shops, travel booking and payments by name, reading or other name, and filters them by operator name, category and who they are for (people or businesses).
  • Pick an incident involving many organizations under Large-scale incident to list only its services, the hardest hit first.
  • Tick Pick for the services you use: Your services appears above the table with the incidents that hit them in one list. You can pick up to 50.
  • Your services shows 50 incidents at a time. Press Show more below it to load the next set; wait while the button says Loading. Choose a title to read the details.
  • To remove a service, untick it or press × next to its name above the list. Clear all removes every pick.
  • Your picks are saved in this browser and are still there next time. Other browsers and devices do not see them.
  • Press Share to copy a link that opens the same picks. If copying fails, select and copy the displayed link.
  • Save this selection on a shared link replaces this browser’s existing picks; it does not add to them. Choose Back to my selection to return without saving.
  • Choose a service name to see its other names, operators, included services and incidents. Add to my services adds it to your picks.
  • On a service’s page, open Other incidents of the operator to see the operator’s other incidents.
  • A service that includes other services also shows their incidents.

7. Organizations

→ to “Organizations”
  • Organization search finds organizations by name, reading, short name, brand or a service they run, and filters them by location, industry/type, kind and size. Only organizations involved in an incident are listed.
  • Pick an incident involving many organizations under Large-scale incident to list only its organizations, the hardest hit first.
  • An organization’s page shows its profile (short names, brands, the services it runs, parent and so on), public figures with their sources, and its incident history.

8. Statistics

→ to “Statistics”
  • Under Range, pick this year, the past 12 months, the past 3 months, all, or a start and end month; every number, the map and the charts then count that period.
  • The period follows disclosure dates, which may differ from when an attack or leak happened.
  • Hover over a prefecture on the map to see its incidents and affected organizations; click it to list its incidents in the period.
  • On a phone, tap a prefecture to see its counts, then tap View incidents to open its incidents in the selected period.
  • The charts show incidents per month and per attack method or cause.
  • Prefectures count by registered office, so an incident that involves several prefectures counts in each.

9. Severity and impact levels

→ to “About”
  • Each organization involved gets an impact level: Minor, Moderate, Major or Critical. An incident’s severity usually follows the highest of them.
  • A Major incident is raised to Critical when it has at least one million records or 50 organizations breached or hit through a supplier.
  • Organizations that only halted services as a precaution do not count as affected.
  • The criteria are under Severity levels on the About page.

10. Other

→ to “About”
  • JA/EN at the top right switches between Japanese and English; this browser remembers the choice.
  • To report an error or send more information, use the link on the About page.
  • The data license (CC BY 4.0) and the disclaimer are on the About page.
  • The Analytics section on the About page explains how Microsoft Clarity measures browsing, searches, service selection, sharing and other interactions.
  • Feed readers can subscribe to the 50 most recently disclosed incidents with the Atom feed linked in the footer.

11. Common questions

What if a search finds nothing?
Use Clear filters, then try part of a name or a Japanese reading. This site records selected incidents from public sources and does not cover every incident. No matching entry does not establish that a service or organization is safe.
Why have my picked services disappeared?
Check that you are using the same browser and device. Picks are stored in the browser and may be lost if its saved data is cleared or storage is restricted. If you kept a share link, you can reopen that selection.
Why does a shared link show different picks from mine?
It shows the selection of the person who made the link. Opening it does not change your saved picks. Back to my selection returns to them. Save this selection replaces your saved picks with those in the link.
Why do prefecture counts not add up to the national total?
An incident involving several prefectures counts in each one. The map uses organizations’ registered or main offices, so it does not show the exact places where attacks happened.
Does an unknown leak size mean zero?
No. It means the number is not established or published. Stated leak sizes may include records only at risk. A count of records is not necessarily a count of people.
Why do I see different results from a saved URL?
Reopening the URL applies your filters and sorting to the current entries. New entries and follow-up reports can change counts and information.
Can I check whether my own personal information was leaked?
This site cannot look up an individual’s email address or card number. It lists public information about organizations and services. Open the relevant incident and follow Sources to the operator’s official information.

12. Glossary: look up a word

Plain-language explanations of words used on this site and in incident reports. Enter a word or narrow the list with the topic buttons. The page address keeps the chosen topic, so you can share a link to it. Each term’s left border has the color of its topic button. Select a term to open its page. Some pages also explain how it works, how to prevent it and what to do if it happens, with real incidents and sources. You do not need to learn the whole list.

Terms are listed alphabetically, A–Z.

Glossary topics

Showing 14 of 100 terms

Access key / API key
A string that tells a cloud service or API which application or user a request comes from. Some keys allow access on their own; others work together with separate credentials. What someone can do depends on the permissions and restrictions assigned to that key, rather than everything its owner can do. A stolen key may let an attacker copy information, use paid services or send email within those limits. Publishing a key that should be secret in source code or settings files can also start an incident. If such a key leaks, it needs to be cancelled at once and replaced.
Account / ID
An account is a user's registration with a service. An ID identifies the user, often using an email address or membership number.
Backup
A separate copy kept so information can be restored if the original is damaged or lost.
Credentials / password
Information that proves who you are when you sign in: usually an ID and a password, sometimes together with a code sent to your phone.
Digital forensics
Examining computers, phones and the records on them to establish what happened and how far the effects reached, like crime-scene investigation for computers.
EDR (endpoint detection and response)
Security software installed on an organization's computers that watches for signs of an attack. It raises an alarm and helps to cut off and examine a computer that harmful software (malware) has got into.
Encryption
Turning information into a meaningless jumble of characters by a secret rule, so that only someone who holds the matching secret (the key) can turn it back. It protects information, but criminals also use it to lock other people's files and demand money to unlock them (ransomware).
Hashing
Turning information such as a password into a fixed jumble of characters by a calculation that cannot be run backwards. Sites store passwords this way so that a stolen list does not show the passwords themselves. Simple passwords can still be found, though: attackers put common passwords through the same calculation and compare the results.
Login / authentication
Logging in opens a service under your account. Authentication is the process of checking that you are who you say you are.
Logs / access history
Records of activity, such as when someone signed in or what a system did. Investigators use them to understand an incident.
Multi-factor / two-factor authentication (MFA / 2FA)
A way to check at sign-in that it is really you, using two or more different kinds of evidence; with exactly two kinds it is called two-factor authentication (2FA). There are three kinds: something you know (a password or PIN), something you have (a phone, an IC card or a small device called a security key) and something you are (a fingerprint or your face). Typical examples: after the password, you enter a verification code sent to your phone by SMS or shown in an authenticator app, tap Approve on a notice on your phone, or use a passkey, which you unlock with your fingerprint, face or the phone's screen lock. A stolen password alone is then no longer enough to sign in. Some phishing sites, however, also ask for the code and use it at once; passkeys resist this kind of attack too. Two-step verification means checking in two steps; when both steps use the same kind of evidence, such as a password and a secret question, it is not multi-factor authentication.
One-time password / verification code
A verification code that works once or for a short time, often used when signing in or confirming a payment.
Permissions / administrator
Permissions define what someone can view or change. An administrator has broader permissions, such as changing system settings.
SMS / text message
A short message sent to a phone number, using a different system from email sent to an email address.