Tokyo Shoko Research: Corporate Data Breaches in 2026 Set an All-Time High in October | Three Steps to Review Customer Data Management in Outsourced Web Systems

This article is an edited version of a column published by DnD Inc. (https://dnd-inc.jp).
Originally published: https://dnd-inc.jp/blog/web-system-data-security-review-2026.html

According to a preliminary report published by Tokyo Shoko Research (TSR) on November 9, 2026, disclosures of personal information leaks by listed companies and their subsidiaries totaled 215 cases from January through October 2026, setting a new annual record since data collection began in 2012. In October alone, the number surged to 109 cases, an order of magnitude apart from the monthly figures through September, which ranged from 8 to 17 cases. Earlier in November, the National Cyber Security Office of the Cabinet Secretariat also published its “Measures to Address Unauthorized Access Leading to Personal Information Leaks and Related Incidents,” identifying inadequate basic security measures for websites and mobile applications as a factor behind the leaks. This is not an issue confined to large companies. Small and medium-sized enterprises that handle customer, membership, and order data through outsourced web systems face the same structural risks.

Key Points of This Article

• According to Tokyo Shoko Research’s preliminary report of November 9, 2026, personal data breaches involving listed companies from January through October 2026 set an all-time high, with 215 cases and a cumulative total of more than 349.99 million records. The number surged to 109 cases in October alone.
• The National Cyber Security Office’s warning of November 5, 2026 identified deficiencies in basic security measures across three areas—“operations and management,” “design and development,” and “supply chain”—as a cause. These are problems that can readily arise even among small and medium-sized enterprises operating outsourced web systems without maintenance.
• In practice, the response should proceed in three steps: “assess the current state → take urgent action → decide whether to rebuild.” The system does not necessarily need to be rebuilt immediately; the first priority is to confirm the condition of your company’s own system.

What Happened in October 2026

Tokyo Shoko Research (TSR) has tallied personal information leak incidents disclosed by listed companies and their subsidiaries since 2012. According to its preliminary report published on November 9, 2026, the cumulative number from January through October 2026 reached 215 cases, surpassing the full-year total of 189 cases in 2024 and setting a new annual record.The cumulative number of personal information records leaked was 349,994,842, more than 10 times the year-earlier figure (both are preliminary figures).
The sharp increase in the number of cases was concentrated in October. Through September, the number had been increasing at a rate of 8–17 cases per month, but in October alone, it surged to 109 cases.
At the same time, the National Cybersecurity Office of the Cabinet Office announced on November 5, 2026, “Countermeasures Against Unauthorized Access Leading to Personal Information Leaks: Thorough Implementation of Basic Measures for Websites and Mobile Apps.” The measures cover three areas: “Operations and Management,” “Design and Development,” and “Supply Chain.” The background to the series of leak cases has been identified as the fact that basic measures have not been implemented.

What This Means for SMEs

TSR’s tabulation covers listed companies and their subsidiaries. It does not include cases involving SMEs. However, the structure of the risks highlighted by this alert can arise in SMEs in the same way.

① “Systems That Have Been Outsourced but Not Maintained” Pose the Greatest Danger

Many web systems used by SMEs—such as reservation sites, membership registration pages, and order forms—continue to operate after their development has been outsourced, with substantive maintenance having effectively stopped. Even if a design had no problems when it was developed, once support for the frameworks, programming languages, and libraries being used ends, new vulnerabilities accumulate without being fixed. Even basic safeguards have been found inadequate at large companies, and outsourced systems whose maintenance has stopped face even greater risks.

② Even Holding Only a Little Customer Data Carries the Same Risk

It is premature to think, “This is not a large-scale membership service, so it is irrelevant.” Even information such as names, email addresses, telephone numbers, and purchase histories, if leaked, gives rise to response obligations under the Act on the Protection of Personal Information. Any order form or reservation system used by an SME that handles customer information requires the same baseline safeguards.

③ A State in Which No One “Knows” Is the Most Dangerous

In reality, a state in which “the contractor is surely handling it” is the least visible risk. It is not uncommon for a contractor to go out of business, for the person responsible to leave, or for a maintenance contract to expire automatically. Allowing a situation to persist in which no one at the company can check things and problems go unnoticed even when they occur is a primary factor delaying the discovery of damage.

Eight Items You Can Check Yourself

Based on the three areas presented by the National Cybersecurity Office, we have organized items that SMEs can check by asking their contractors and personnel in charge.
**If you cannot answer items 1–3, we recommend beginning by understanding the current situation.** The remaining items can also be addressed by checking them one by one after the current situation has been understood.

Three Steps for Reviewing an Outsourced Web System

The answer to the question, “Do we need to rebuild the entire system?” cannot be known without examining the current situation. In many cases, it is more realistic to inspect the system first, fix only what is urgent, and then decide whether to modernize it.

Step 1: Understand the Current Situation

Begin by checking the following three points.

• What systems are running: Create a list of the websites, apps, forms, and administration screens managed in-house. Even if the outsourcing provider has changed, you can identify them from information about domains and server contracts.
• What data you have: Identify where customer, member, order, and application data are stored, including data stored through cloud services.
• Who maintains the system: Confirm which company or individual is currently responsible for maintenance and whether they can be contacted. If they cannot be reached, locating the source code should be the first priority.

Step 2: Handle urgent matters first

Once the current situation has been assessed, begin with high-risk issues that can be addressed immediately. Common urgent examples include the following.

• The administration screen password is still at its default setting or is a simple string → Change it immediately
• The administration screen is exposed to the internet without IP address restrictions → Add access restrictions
• Outdated versions of plugins and libraries remain → Check whether they can be updated
• Backups have not been taken or verified → Configure backups and conduct a restoration test
  These measures can be handled by contracting the company responsible for development. Rather than trying to do everything at once, it is easier to sustain progress by starting with the one or two highest-risk items and working down from there.

Step 3: Determine whether the system needs to be refreshed

If the inspection shows that the framework or operating system in use is already unsupported and that partial fixes can no longer keep up, refreshing the system may be an option. When deciding whether to rebuild, it is important tonarrow the system down to the data and functions that are truly necessary rather than adding more features. Minimizing the amount of data being managed is itself a way to reduce risk.
There is no need to refresh everything at once. You can begin with a limited scope, such as “first migrate only customer information management” or “replace the old order form with a new one.”
If you are considering what to do for your own company, why not consult with us?
Consultations and estimates are free. We accept requests even if you are at the stage of not knowing where to begin.

Frequently asked questions

Can you conduct an inspection even if the outsourcing company has gone bankrupt or become unreachable?

Yes. If we receive a request from the owner of the system’s rights, we can inspect the source code and configuration directly. Even if the outsourcing provider has changed, an inspection is possible if you have the source code. If you do not have it, we can first help you locate it.

Do small and medium-sized businesses also have a reporting obligation when personal information is leaked?

Due to the amendment to the Act on the Protection of Personal Information (effective April 2022), if a certain amount of personal information is leaked, reporting to the Personal Information Protection Commission and notifying the individuals concerned are mandatory. The size requirements for covered businesses have been abolished, meaning small and medium-sized businesses are also covered. For details, please check the Personal Information Protection Commission’s official website.

After an inspection, will the system always need to be rebuilt?

No. Depending on the inspection results, “partial repairs” addressing issues that can be fixed immediately may be sufficient. Only when the underlying framework or OS is out of support and partial repairs cannot keep up do we consider a refresh. First, it is essential to understand the current situation.

Is it irrelevant if our company does not develop its own web systems?

Even outsourced web systems face similar risks if they handle customer, member, or order data. Even when people assume that “the vendor should be handling it,” it is quite common for no one to be maintaining the system in practice. We recommend checking whether you can contact the person responsible for maintenance and when security was last reviewed.

This article is a reprint of a column operated by DnD Inc. (a partner for business efficiency and DX).
▶ Original publication and full text: https://dnd-inc.jp/blog/web-system-data-security-review-2026.html
▶ Contact: https://dnd-inc.jp/contact.html