October 26, 2026

A series of personal information leaks has plagued companies, hospitals, financial institutions, and government agencies. So far this year, approximately 330 million private data records have been leaked or are suspected to have been leaked.

A tally of this year’s data breach incidents that the Japanese Communist Party compiled shows that, as of October 23, confirmed leaks totaled 193 million records, while suspected compromises reached an additional 140 million records.

In fiscal 2025, the number of individuals affected by data breaches totaled 30.64 million, according to Tokyo Shoko Research. This means that about 11 times that amount has already been leaked this year, including potential leaks.

At a press conference on October 6, Minister for Digital Transformation Furukawa Toshiharu urged the general public to practice self-defense, stating that each citizen should protect their own online information.

In an Akahata interview on October 24, lawyer Muto Tadaaki, an expert in information management, stated, “The digital minister called for self-defense. However, shifting the responsibility to ordinary citizens who are likely to be harmed is unreasonable because only entities that are entrusted with handling personal information can implement preventive measures.”

Muto criticized the digital minister for failing to understand the revolutionary risks of AI where offensive capabilities have come to overwhelm defensive ones.

He added, “The Digital Agency itself has repeatedly suffered data leaks. It must urgently establish fundamental measures to prevent recurrence. If it cannot do so, it has no right to utilize the public’s valuable personal information.”

Muto noted that in the EU, an independent body with specialized expertise carries out supervision under the General Data Protection Regulation (GDPR) which is designed to protect privacy. He, however, pointed out that Japan’s Act on the Protection of Personal Information does not explicitly guarantee the right to privacy. The lawyer emphasized the need for legislative amendments to ensure that the Act protects this right.

Muto argued that to provide relief for victims of data breaches, a class-action lawsuit system should be established so that consumer groups or other organizations can file lawsuits on behalf of victims. He said, “It is difficult for individual victims to file lawsuits on their own. The introduction of a class-action lawsuit system will lead to preventive measures and is an effective means to provide compensation.”