Japan is facing an extraordinary wave of personal information leaks.

According to Tokyo Shimbun, citing cybersecurity company Macnica, more than 187 million records of personal information may have been exposed through unauthorized access between January 1 and October 19, 2026.

Four days later, Sagawa Express disclosed that up to another 53.23 million records may have been exposed through unauthorized access to its package-tracking service.

Adding those reported figures gives approximately 240 million records. This is an illustrative calculation, not a verified national total. The figures include duplicates and may overlap, and they do not represent 240 million individual people or records confirmed stolen.

For context, Japan’s population is approximately 123 million.

The number of incidents is also climbing. According to Jiji Press, reported by The Japan Times, Macnica had tracked 216 publicly disclosed incidents involving information leaks or possible leaks in 2026, approximately 2.6 times its total for all of 2025. Of those, 101 were disclosed in October alone through October 26. The tally covers a defined category of web-system incidents, not every cyber incident in Japan.

The numbers matter. But understanding what they mean for people’s safety matters even more.

What happens when criminals use exposed personal information to contact you? And how can you protect yourself?

A suspicious phone call that knew too much

Tokyo Shimbun reported a troubling experience involving a man living in Tokyo.

In September, he received a call from someone claiming to represent the post office. The caller said an illegal item had been discovered in a package he supposedly sent and that he would be connected to the police.

What made the call unusual was the information the caller appeared to have.

The caller correctly identified the man’s nearest post office and police station, and suggested that he also knew his name and age.

The man had received fraudulent calls before, but this one was different. The caller seemed to know much more about him.

He later received a notice from car-sharing service Times Car warning that personal information, potentially including driver’s license images, had been exposed. He wondered whether the incidents were connected.

There is no confirmed connection between the data breach and the fraudulent call. But the experience illustrates an important risk: a scammer with accurate personal information can sound far more convincing than a stranger making a random call.

How personal information can make the next scam more convincing

Consider the information people routinely provide to companies: names, addresses, telephone numbers, email addresses, dates of birth and details about services they use.

On their own, those details may seem ordinary.

But in the wrong hands, they can become tools for fraud.

A fake delivery message can use your correct name and address, making a fraudulent link seem legitimate.

A caller pretending to represent your bank can mention accurate personal details before asking you to confirm account information or transfer money.

A phishing email can refer to a real company relationship or recent activity, making it harder to distinguish from genuine communication.

AI creates another possibility. Criminals can impersonate familiar voices, making a phone call or voice message appear to come from someone the recipient knows. The FBI has documented criminal schemes involving AI-generated voice impersonation.

These examples are not confirmed consequences of the Sagawa incident or other specific breaches discussed here. They illustrate how personal information, whether obtained through breaches or other sources, can be misused.

The more a scammer knows about you, the more believable the next scam can become.

AI makes this even harder to spot. It can turn personal details into polished, natural-sounding Japanese emails and messages, without the awkward language that once helped people identify scams. Combined with AI-generated voices and impersonation, fraudulent communications can appear far more genuine.

In its official June 2025 report, Information Security 10 Major Threats 2025 (Individual Edition), Japan’s Information-technology Promotion Agency (IPA) explains that phishing emails can disguise their senders and links, and that AI is making their Japanese wording sound less unnatural.

That is why the enormous volume of potentially exposed personal information across Japan deserves attention.

Japan’s Prime Minister calls for stronger public protection

On October 26, Prime Minister Sanae Takaichi addressed Japan’s first Ministerial Meeting on Cybersecurity, warning about the growing risk of further harm from the misuse of leaked personal information.

Her response went beyond strengthening cybersecurity systems.

She called for better support for affected organizations, faster analysis of cyber threats and clearer communication about emerging risks, specifically directed at business leaders, cybersecurity specialists and the general public.

She also instructed the government to prepare an emergency package of cybersecurity measures.

Her remarks recognize that the consequences of cyberattacks extend beyond the organizations affected, and that different audiences need information relevant to the risks they face.

For individuals, the practical question is how to recognize and respond when exposed information is used in a convincing scam.

Source: Prime Minister’s Office, full October 26 remarks.

What people can do to protect themselves

Companies must continue strengthening their cybersecurity systems, protecting customer information and fixing vulnerabilities.

But once personal information has been exposed, fixing the original vulnerability cannot erase information that may already be circulating.

People need to know how to recognize and respond to scams that use accurate personal details.

Be cautious of unexpected messages, even when the information is correct. A delivery text containing your real name and address is not necessarily genuine. Check the company’s official app or website rather than following an unexpected link.

Verify who is contacting you. If someone calls claiming to represent your bank, employer or another institution, independently contact that organization through a trusted number or channel.

Be especially careful with urgent requests. Scammers often create pressure to act immediately. If someone asks you to transfer money, share a password or provide sensitive information, take the time to verify the request.

Don’t rely on a familiar voice alone. AI-generated voice impersonation makes it important to confirm unusual requests from friends, family members and colleagues through another trusted method.

Japan’s Consumer Affairs Agency issued guidance on October 29 reinforcing these precautions. It advises consumers to avoid suspicious links, use official websites and apps, strengthen account security through safer passwords and additional authentication, and regularly check financial transactions for unauthorized activity.

The goal is not to make people fearful of every message or phone call. It is to help them recognize suspicious situations and respond with confidence.

The SAYA perspective: Education and protection must be part of the response

In our first article, Sagawa Express: The Breach Is Only the Beginning, we examined why the potential exposure of delivery information creates risks beyond the original cyberattack. Read the original SAYA Sagawa article.

Sagawa is just one example. Personal information exposed in breaches across Japan could be used to make fraudulent calls, messages and scams more convincing.

At SAYA, our purpose in reporting these incidents is not to highlight one breach after another or criticize the organizations affected. It is to help people understand the risks, recognize how they may encounter them in everyday life, and learn how to protect themselves.

The danger is not simply that someone may have your personal information.

It is what they may persuade you to do with that information.

AI makes this challenge more urgent. Fraudulent emails can now read like genuine Japanese communications, and an impersonated voice can sound remarkably real. People can no longer rely on poor grammar, unnatural language or an unfamiliar voice to recognize a scam.

This is why practical digital safety education matters.

SAYA provides Japan-native digital safety education that helps employees, families, children and older adults recognize fraud, verify suspicious communications and make safer decisions online.

Our focus is on preparing people for situations they may actually encounter, including scams, identity impersonation, phishing and emerging AI-enabled threats.

Education cannot prevent every data breach, nor does it replace the technical controls needed to protect information. But it can help people recognize the risks that follow a breach and take practical steps to avoid becoming victims.

Japan must continue strengthening its cybersecurity defenses. At the same time, we have an opportunity to strengthen how people understand digital risks and protect themselves.

The breach may make the headlines. Helping people stay safe from the scams that follow is where our attention must turn.

Editorial clarification: Reported record totals describe potential exposure, may include duplicates and are not counts of unique individuals or confirmed criminal misuse. The Tokyo Shimbun account does not establish a causal link between the Times Car incident and the suspicious telephone call.