Japan data breach: what to do if your information leaked

If a Japan data breach may include your details, first read the company’s notice and find the list of leaked items. Then act only on those. The large 2026 leaks below exposed names, addresses and phone numbers, not full card numbers, so the main risk is convincing phishing. If an ID image leaked, you can get a new driver’s license or a new residence card (¥1,900). Your My Number is changed only if it leaked and may be misused.

Which recent data breaches in Japan affect foreign residents?

These are recent cases that hit services many residents use. The figures come from the companies’ own notices.

Aflac says the leak started on 10 June 2026 and that it reported to the Financial Services Agency (金融庁) and the police. It finished mailing letters to affected customers on 30 July 2026.

Times Car’s count includes former members and some Times Business Service customers. Its ID images were stored encrypted. For another 891,602 accounts, the attacker accessed the encrypted images but no trace of sending them out was found. The company says it can’t fully rule out future decryption of the images that were sent out, and it will give those 1,464,800 customers ¥3,000 in cash or vouchers (details to follow). Since 23 October, your My Page on the Times Car site shows which of your items leaked. Former members can check through a form on its site. It will delete all ID images it holds by the end of October 2026. The ID types it lists don’t include residence cards (在留カード).

Not every “may have leaked” notice ends as a leak. JR East said on 9 October 2026 that email addresses of Eki-net members might have leaked through an outside email service. It later updated the notice to say no leak had happened, as ScanNetSecurity reported on 19 October. So follow the company’s updates, not only the first headline.

Will a company tell me if my data leaked in Japan?

Usually, yes. Since 1 April 2022, Japan’s privacy law requires a business to report to the Personal Information Protection Commission (PPC) and notify you when a leak may harm your rights and involves any of these:

• sensitive personal information (要配慮個人情報)
• a risk of financial harm
• a wrongful purpose, such as unauthorized access
• more than 1,000 people

The PPC expects a first report within about 3 to 5 days. The notice to you should say what happened, which items leaked and why. It usually comes by letter or email. If a company can’t reach everyone, it can publish the notice on its website or set up an inquiry line instead, so check the company’s news page too.

What should I do first after a data breach?

How do I spot phishing after a leak?

Leaked names and phone numbers make fake messages look real. The National Police Agency (警察庁) and the Financial Services Agency give the same advice:

• Don’t open links in emails or SMS, even from a sender you know. Open your bank or broker from a bookmark you saved yourself.
• Use different passwords for each service, and turn on multi-factor login and passkeys where offered.
• If you typed details into a fake site, call the company right away: your bank for transfers, your card company for card charges. Then change the password on every service that uses it.
• Report it to your local police station or the police online cyber-incident window. Report the fake site’s URL to the Internet Hotline Center (フィッシング110番).

The FSA has warned since April 2025 about unauthorized access and trading on online securities accounts. If you hold a securities account, check it and turn on login alerts. Our guide to scams targeting foreigners covers fake police, immigration and bank calls.

Should I get a new driver’s license after a leak?

You can. Shizuoka Prefectural Police, for example, accepts reissue applications from people whose license images leaked in the Times Car case. Its fees:

Bring your license (or your My Number Card for a My Number license) and the fee to a license center or the police station for your address. Rules, fees and hours are set by each prefecture, so check your own prefectural police page.

Can I get a new residence card after a data leak?

Yes. The Immigration Services Agency (出入国在留管理庁) lets mid- to long-term residents request a new card even when the old one isn’t damaged (交換希望による在留カードの再交付申請). As of October 2026:

• Fee: ¥1,900 in revenue stamps (収入印紙)
• Where: the regional immigration office for your address
• Bring: application form, one photo, passport and your current residence card
• When: any time; the card is issued the same day in principle

The agency’s page doesn’t say whether the new card gets a new number. Ask at the counter if that matters to you. Its information center is at 0570-013904.

If your card was lost or stolen rather than leaked, the process is different: see lost residence card.

What do I do if my My Number leaked?

Don’t panic about the number alone. Minato City says a My Number on its own won’t be misused.

A My Number is meant to stay the same for life. You can ask for a new one only if it leaked and may be misused, for example if your My Number Card was stolen. Ask at your city office (市区町村役所):

• Bring: evidence of the leak or risk of misuse (such as the company’s notice), your My Number Card or notification card, and original photo ID such as your residence card.
• Police first if the card was lost or stolen. Setagaya asks for the police report number.
• New number: you can’t choose it. It comes by registered mail (簡易書留) that isn’t forwarded, about 3 to 4 weeks later in Koto City.
• Old cards are collected, and you apply for a new My Number Card after that.

If a card is lost or stolen, stop it first. Call the toll-free foreign-language line 0120-0178-27. Suspension runs 24 hours in English, Chinese, Korean, Spanish and Portuguese. Thai, Nepali, Indonesian, Vietnamese and Tagalog run 9:00 to 18:00. More on the card is in our My Number Card guide.

Can someone take out a loan in my name with a leaked ID?

The Zenginkyo credit bureau (全国銀行個人信用情報センター) lets you register a self-declaration (本人申告) when ID documents, or their images, are lost, stolen or leaked. Lenders see it when they check your credit and can screen more carefully.

• Cost: ¥500 online, with a My Number Card and an NFC smartphone. By mail it costs ¥2,403: you buy a ticket (本人開示・申告手続利用券) at a convenience store and send it with the form.
• Covers: ID used for borrowing, such as a driver’s license. Cash cards, credit cards and membership cards are excluded.
• Limits: it isn’t a guarantee, and banks don’t check it when you open a deposit account. Processing is much slower than usual because of demand, and slower still by mail.

CIC says the three bureaus share lost or stolen ID declarations through their CRIN network. How bureaus work is in our credit score guide.

Who can I contact about a data leak in Japan?

The PPC can advise you and, under conditions, mediate with a company. It doesn’t handle claims for compensation or apologies. For a claim for damages, talk to a lawyer (弁護士).

More guides: scams targeting foreigners, My Number Card for foreigners, lost residence card, credit score in Japan, emergency numbers in Japan.