Got a "data leak" notice? What to watch for when your information was exposed

Short answer

If a service you use sends you a "notice of personal information leak" or an apology email, the first rule is not to log in through a link in that email. Leaked information can be used to send fake emails that pose as the same company. Next, change the password everywhere you reused it, and turn on multi-factor authentication. If you submitted images of ID documents to that service, keep an eye out for contracts or charges you do not recognise for a while.

The alerts issued in October 2026

In October 2026, after a series of data leaks caused by unauthorised access, several Japanese government bodies issued alerts one after another. Japan's National Police Agency (NPA) lists on its website the alerts from itself, the Personal Information Protection Commission, the National Cybersecurity Office, the Ministry of Internal Affairs and Communications, the Ministry of Economy, Trade and Industry and the Financial Services Agency.

On 7 October, the Personal Information Protection Commission (PPC) issued an alert asking businesses that hold large amounts of personal information to tighten their security measures. On 9 October, the Financial Services Agency (FSA) said there had been incidents in which customer information, including images of ID documents such as driving licences, had leaked. It asked financial institutions to check thoroughly whether ID document images and customers' face images look unnatural.

Most of these alerts are aimed at businesses. The NPA's "Cyber Police Agency Letter" for October 2026 (Vol.19), however, also includes advice for individuals.

What tends to happen after a leak

The NPA letter gives individuals three points:

• Do not click links in emails without thinking (they may be fake emails posing as the company the data leaked from)
• Set strong passwords and do not reuse them (multi-factor authentication, such as one-time passwords, also helps)
• Install an app recommended by the NPA as a countermeasure against scam phone calls on smartphones (check the list on the NPA website)

A leaked name, email address or phone number cannot take your money on its own. It can, however, be used to make a message look genuine. For example, suppose you receive an "apology and request to reset your password" that shows the name of a company you really use and your own full name. That is much harder to recognise as fake. A phone call offering to "process compensation for the leak" is another possible approach.

What you can do yourself

The PPC's material lists, as an example countermeasure, that when IDs and passwords may have leaked, the business should reset them or guide users to change them. A genuine notice may therefore also ask you to change your password, so always make the change on an official site you opened yourself.

According to the FSA, under the amended Enforcement Regulation of Japan's Act on Prevention of Transfer of Criminal Proceeds, for identity verification under that Act (such as opening a bank account online), the method of sending images of ID documents will be abolished from 1 April 2027, and verification will in principle be unified around reading the IC chip. Until then, it is worth keeping an eye out yourself for any misuse of images you have submitted.

If the problem is not solved

If you think you may have been harmed through a suspicious email or call, you can consult your nearest police station or a cybercrime consultation desk. The NPA also notes that you can call the police consultation line #9110 (within Japan). If you notice unfamiliar activity on a card or bank account, contact the card company or bank straight away using the number on the back of the card or on its official site. For questions about the service that leaked your data, use the contact desk on that company's official site.