Information current as of October 24, 2026 (JST). This is a developing incident. SAYA will update this analysis as additional facts are confirmed.

Sagawa Express first disclosed unauthorized access to its package-tracking service on September 30. On October 1, the company said its investigation had found that customer personal information may have been exposed. Japanese media, including ITmedia NEWS, reported at the time that the potentially affected data included roughly 100 days of sender and recipient information, while the number of affected records was still under investigation.

The significant new development came on October 23. In its fifth report, Sagawa disclosed for the first time that as many as approximately 53.23 million records may have been exposed. ITmedia’s October 23 follow-up likewise identified the record count as the new information in the latest update.

That figure needs to be described carefully. Sagawa says it is the current maximum number of records that may have leaked after some duplicate information was consolidated. Significant duplication still remains, particularly in shipping-label data, so the figure does not represent 53.23 million individual people. Sagawa also makes clear that this is not a count of records confirmed to have actually left its systems.

Tokyo Shoko Research says the 53.23 million-record disclosure is the largest personal-information leak or loss in its survey of listed Japanese companies and their subsidiaries since the survey began in 2012.

Sagawa says its package inquiry service resumed on October 23 after system inspections, security measures and safety checks carried out with support from a third-party specialist. The company says its work to identify affected customers and determine the actual number of people involved is continuing.

What happens after the data is exposed?

According to Sagawa’s October 1 and October 23 updates, the potentially affected information includes shipping-label data covering roughly 100 days, from June 21 through September 30. Depending on the record, that can include the names, addresses and telephone numbers of senders and recipients.

Information associated with contracted customers may also be involved. For members of Sagawa’s Smart Club service, potentially affected information includes names, addresses, telephone numbers, email addresses and member IDs.

Sagawa says credit-card information and passwords are not included in the affected data. It has also said that, as of its latest update, it had not confirmed secondary misuse of personal information related to the incident.

Those are important facts. They do not mean the risk to individuals has disappeared.

A large breach changes the information environment around the people whose data may have been exposed. If someone knows your name, address, telephone number or email address, a fraudulent communication can become more convincing. If that information is connected to something as familiar as receiving a package, the message can feel even more credible.

And many successful scams do not begin with information that looks suspicious. They begin with information that appears to be correct.

“They knew my name” is no longer enough

Imagine receiving a text about a delivery. It includes your name. It appears to know something about your address. You may actually be waiting for a package. The message asks you to confirm a delivery time, update an address or pay a small fee.

None of those details proves that the message is genuine. But they can make it feel genuine.

Sagawa has been warning customers since its October 1 disclosure to be cautious about suspicious emails, SMS messages and telephone calls impersonating the company. It advises customers not to access URLs or provide personal information in response to suspicious communications. That warning remains in its latest update.

This distinction matters. Sagawa is not saying that follow-on misuse from this incident has been confirmed. SAYA’s analysis is that once personal information may have been exposed, people need to be prepared for the ways that accurate information can make future impersonation and social engineering more persuasive.

Technical security and human understanding solve different problems

Most analysis after a major cybersecurity incident understandably focuses on the technical questions: how the attacker gained access, whether a vulnerability was exploited, whether access controls were sufficient, and what needs to be patched, isolated or redesigned. Those questions matter.

Security education does not replace technical security, and it would be wrong to suggest that stronger awareness training prevents every breach.

But technical controls cannot make every decision for a person receiving a convincing message on a phone. Security literacy addresses that different problem.

People need to understand that accurate personal information does not establish legitimacy. They need to recognize urgency and impersonation. They need to know when not to follow a link, how to verify a request independently and when something simply does not make sense. Those are learnable skills.

Japan now faces the risk beyond the original incidents

The Sagawa disclosure is not happening in isolation. Japan has experienced an exceptional series of cybersecurity incidents in 2026. Much of the discussion around them has rightly focused on vulnerabilities, legacy systems, cloud environments, third-party risk and other technical weaknesses.

But as more personal information is potentially exposed across more incidents, another question becomes increasingly urgent: What happens when information from those incidents is later used against people?

The next risk may have nothing to do with getting back into Sagawa’s systems. It may arrive as an email, SMS message or phone call impersonating a trusted company — the same channels Sagawa has been warning customers to treat with caution since October 1.

That is the point where the security problem changes. The decision in front of the person becomes part of the defense.

This is the security-literacy gap

Telling people to “be careful” is not enough. Useful security education needs to explain why an interaction feels believable and what someone should do next.

Why does knowing your address make a message more persuasive? Why does urgency interfere with judgment? Why should someone independently open an official app or website instead of using the link in a message? What should a parent teach a child about an unfamiliar online contact? What should an older family member do when a caller appears to know personal details? How should an employee respond when an apparently legitimate request combines accurate information with pressure to act?

These are not obscure cybersecurity concepts. They are increasingly part of ordinary digital life. And they can be taught.

The SAYA perspective

SAYA was built around a simple idea: security education works better when people recognize the situation.

Our learning is developed around Japanese language, institutions, behaviors and everyday digital experiences rather than treating Japan as a translated version of another market.

For an employee, the relevant moment may happen inside a workplace application. For a parent, it may happen while looking at a child’s phone. For an older adult, it may begin with a call or message that sounds surprisingly credible. And for any of us, it may begin with a delivery notification that appears to know just enough about us to make us click.

The Sagawa investigation is still developing. We do not yet know the final number of affected individuals, and Sagawa says it has not confirmed secondary misuse associated with the incident. Those facts should not be overstated.

But the broader lesson is already clear. A breach is not always the end of the security event. Once information about people is exposed, protecting those people requires more than securing the system that was attacked. It also requires giving them the knowledge to recognize what may come next.

That is the security-literacy challenge Japan now needs to address at scale.

Sources

Sagawa Express — October 1, 2026: Second Report. Official company disclosure confirming the possibility of personal-information exposure and identifying the potentially affected data categories.

Sagawa Express — October 9, 2026: Fourth Report. Official update confirming the investigation remained in progress and that no misuse of potentially exposed information had been confirmed at that point.

Sagawa Express — October 23, 2026: Fifth Report. Official update disclosing the current maximum of approximately 53.23 million records and announcing service resumption.

ITmedia NEWS — October 1, 2026. Japanese reporting on Sagawa’s early disclosure, the affected data categories and the fact that the record count was still under investigation.

ITmedia NEWS — October 23, 2026. Japanese follow-up identifying the 53.23 million-record figure as the new development in Sagawa’s fifth report.

Tokyo Shoko Research — October 23, 2026. Independent context placing the 53.23 million-record disclosure within its historical survey of personal-information incidents in Japan.