660,000 Personal Records Stolen from Japanese Companies… Japanese Government: “Prepare for AI-Powered Saturation Attacks”

1. Overview

In early October 2026, a personal data leak incident came to light in Japan after reports said that Osaka Metropolitan University had leaked information on more than 130,000 people, including students’ ID-card photos.

The incident was reported alongside a wave of data leaks from companies and public institutions across Japan, rather than as an isolated case. The report below is nearly the only source cited in this article for information about Osaka Metropolitan University.

2. Report on the Osaka Metropolitan University Leak

According to a screenshot of a Japanese news site attached to a post on FM Korea, a social affairs article published at 11:11 a.m. on October 6, 2026, was titled, “Personal data leaks continue: Daiwa Securities has 220,000 records, including account numbers for 110,000 customers… Osaka Metropolitan University has photos from student IDs and other data on more than 130,000 people.” The headline grouped Osaka Metropolitan University together with Daiwa Securities. This suggests that the university leak was presented as one item in a list of ongoing incidents, rather than treated as a separate incident.

What stands out in the report is that the leaked information included face photos from student IDs. However, the only details confirmed are the headline’s mention of “photos from student IDs and other data” and the figure of “more than 130,000 people.” The report cited in this article does not establish when the leak occurred, how the breach took place, or whether those affected were current students alone or also included graduates and applicants.

3. A Series of Data Leaks

Around the same time, a series of major leaks was disclosed in Japan. Based on the FM Korea post and Financial News report, the known cases are as follows:

• Times Car: A car-sharing company; approximately 6.6 million records were leaked.
• Daiwa Securities: Announced that up to 220,000 records of customer information may have been leaked after a server at a contractor was hacked.
• Citizen: Said that approximately 100,000 people’s information may have been leaked after unauthorized access to a server at an external contractor.
• MrMax: Its online store server was accessed without authorization, resulting in the leak of information on up to 1.73 million people.
• Yakiniku King: Its app was hacked, and approximately 10.79 million records, including email addresses and phone numbers, were reportedly leaked. The FM Korea post described this as “10 million records.”
• GMO Research & AI: Approximately 950,000 records were leaked from its survey website. In addition, points worth 2.86 million yen were fraudulently exchanged, causing financial losses.
• Nihon Keizai Shimbun: On the 4th, an employee account was attacked, and approximately 9,000 emails impersonating the employee were sent to sources and others.

Later, on October 9, Adventure, which operates the airline ticket booking site Skyticket, announced that approximately 14.64 million records had been leaked through its website. According to the Shinano Mainichi Shimbun, the server was accessed without authorization between the 2nd and 4th, and the incident was discovered on the 5th. The leaked information included names, email addresses, and addresses. The company explained that it did not store credit card numbers or passport images, so those were not leaked.

Student ID images were also an issue in another incident. According to the Mainichi Shimbun, information leaked from Times Car included 1.6 million documents used for identity verification, such as driver’s licenses and student IDs. The FM Korea post said that Japan had been thrown into turmoil just three months earlier when 14.22 million records were stolen from KDDI, only for another incident like this to happen soon after.

4. Responses from the Japanese Government and Industry

As the series of leaks continued, the government took action. According to figures compiled by Trend Micro, the number of incidents involving unauthorized access disclosed by Japanese companies and local governments reached 600 from the start of the year through the end of September, already exceeding the 593 cases recorded for all of the previous year. On October 9, the Japanese government urgently called on companies to strengthen the security of their IT systems. The Mainichi Shimbun reported that the government warned that recurring unauthorized access could pose a management risk capable of disrupting business operations, not merely a security incident, and urged companies to promptly share information about incidents with the National Cybersecurity Office (NCO) and other relevant bodies.

In connection with the Times Car incident, the Ministry of Land, Infrastructure, Transport and Tourism asked the industry group National Rent-a-Car Association to urgently review how it handles personal information and report the results by the end of the month. According to TBS NEWS DIG, as of October 7, approximately 64,000 people had registered on a website set up by a lawyer to prepare a class action. A YouTube video put the number of registrants on the class-action preparation website at approximately 37,000. The reports cited in this article contain no information about an apology or subsequent measures by Osaka Metropolitan University itself.

5. Authenticity Debate

The central question is whether the leak of Osaka Metropolitan University’s face photos was part of a large-scale series of attacks exploiting AI, or whether it was a separate incident that happened to be reported during the same period. The reports confirmed here do not identify the cause of the university’s leak.

5.1. The Case That It Was Part of a Series of Attacks

Those who support this view point to the timing and scale. By the end of September, the number of incidents involving unauthorized access that year had already reached 600, exceeding the previous year’s full-year total of 593. In just a few days, a series of leaks involving millions or even tens of millions of records were disclosed. They argue that it is difficult to explain this frequency as mere coincidence. In addition, Masaaki Taira, head of the Liberal Democratic Party’s division responsible for AI policy, said that recent data leaks bore the hallmarks of “saturation attacks,” in which AI is used to launch large-scale attacks automatically. An official from Japan’s law enforcement authorities also told Kyodo News, “In the past, hacking required specialized knowledge, but with the advent of AI, it has become possible without such knowledge.”

5.2. The Case That These Were Separate Incidents

The opposing view argues that there is no direct evidence of a connection. The Mainichi Shimbun reported that Japan’s security authorities were still investigating who was behind the series of unauthorized accesses and how they were carried out. Without a confirmed perpetrator, grouping Osaka Metropolitan University into a single attack campaign is premature, they argue. The known cases involved different methods: hacking a contractor’s server, hacking an app, intruding into an online store server, and taking over an employee account. Reports of 1.6 million leaked student ID images concerned Times Car, not Osaka Metropolitan University. Unless the university’s breach method and timing are made public, there is no basis for concluding that the incidents were the work of the same attacker.

At present, there is insufficient evidence to determine which of these explanations applies to the university’s leak. The question remains open until the cause and method are officially disclosed.

6. Trivia

• Financial News also mentioned reports from the Asahi Shimbun and other outlets that a key member of the ransomware group Qilin had been arrested in Japan and handed over to Germany. A 28-year-old Russian man who was traveling in Osaka was arrested in May and extradited to German authorities on October 2. He was accused of breaking into the computer network of a German logistics company in 2024, and there is no evidence linking the case to the Osaka Metropolitan University leak.
• The FM Korea post included the phrase “not the usual FM Korea update” in its title.