News Data Breaches
JR East, Skyticket, Big Echo and Bookoff disclose breaches affecting millions in Japan
Four Japanese companies disclosed incidents between 8 and 9 October 2026 that together may have exposed data on more than 30 million customer records. Causes include a ransomware attack on SoftBank cloud subsidiary IDC Frontier and malware on a contractor's PC.
Key takeaways
- Skyticket, Big Echo operator Daiichikosho, Bookoff and JR East disclosed incidents on 8 and 9 October 2026.
- Skyticket's incident is the largest, at about 14.64 million records, including hashed passwords.
- JR East's exposure came through a ransomware attack on IDC Frontier, which serves 495 organisations.
- Daiichikosho's data was exposed through malware on a contractor's PC.
- The companies say card numbers were not exposed, but warn customers about phishing.
Four large Japanese consumer businesses disclosed data incidents on 8 and 9 October 2026. Each company gave its own estimate of how many records may have been exposed. Several said they had not yet confirmed that the data was misused.
Which companies were affected? #
| Company | Service | Records that may be affected | Cause the company gave |
|---|---|---|---|
| Adventure Inc. | Skyticket travel booking | About 14.64 million | Unauthorised access to its servers, 2 to 4 October |
| Daiichikosho | Big Echo and other karaoke chains | About 8.72 million | Malware on a contractor employee's PC |
| Bookoff Group Holdings | Member programme | Up to about 6.43 million | Unauthorised access to a subsidiary's member management system |
| JR East | Eki-net and Otona no Kyujitsu Club | Up to about 2.06 million | Unauthorised access at IDC Frontier, its email delivery provider |
Totals count records, not people. A person registered with more than one service may appear more than once.
What data was exposed at each company? #
Skyticket (Adventure Inc.). The company said parts of the site's administration functions were manipulated between 2 and 4 October, giving the attacker access to other servers and cloud-stored data. It found the intrusion on 5 October. The data includes names, dates of birth, email addresses, phone numbers, addresses and hashed login passwords, which about 4.13 million of the records include. The company says it does not store credit card numbers or passport images. It also disclosed two smaller, separate incidents: about 17,780 records from an internal business system on 20 September, including refund bank account details, and about 12,000 bus bookings whose confirmation pages could be viewed without logging in from 3 August to 1 October.
Daiichikosho (Big Echo). Malware infected a PC used by an employee of Nippon Columbia Group, a contractor that temporarily held the data for outsourced work. The infection was found on 1 to 2 October, and the PC was isolated on 2 October. The records cover about 8.63 million customers and about 93,000 employees: names, gender, dates of birth, email addresses and phone numbers. Passwords were not included. The company said no external leak or misuse had been confirmed when it announced the incident on 8 October.
Bookoff. The company detected the unauthorised access on 6 October and announced it on 9 October. The member records include names, dates of birth, gender, addresses, phone numbers, email addresses, point card and member numbers, and hashed passwords. Bookoff says the system holds no credit card or bank account details, and no misuse had been confirmed.
JR East. The rail operator said unauthorised access at IDC Frontier, the external provider of its email delivery service, may have exposed the email addresses of up to about 1.67 million Eki-net members. For up to about 390,000 Otona no Kyujitsu Club members, it may also have exposed member numbers, credit card expiry dates and dates of birth. JR East says names, addresses, phone numbers and card numbers could not have leaked.
What happened at IDC Frontier? #
IDC Frontier, a SoftBank subsidiary, said a ransomware attack by a third party caused an outage in its IDCF Cloud East Japan Region 1 starting at about 03:40 on 7 October. It said 495 companies and local governments contract the service. It cut the region off from the network, shut down its systems, and temporarily suspended customer management consoles in its other regions while it checks them. It is still investigating the cause and scope.
How has the Japanese government responded? #
Japan's National Cybersecurity Office told ministries, local authorities and companies to strengthen their defences, AP reported. Masaaki Taira, who heads the ruling Liberal Democratic Party's cybersecurity headquarters, said Japan was in "a state of emergency in cyber space", according to the Financial Times.
What should affected customers do? #
- Watch for phishing emails, text messages and calls that use your name or booking details. The companies say they will not ask for passwords or card numbers.
- Change your Skyticket and Bookoff passwords, and any other account where you reused them.
- Check booking history and card statements for activity you do not recognise.
Sources
- JR East notice on possible leak of Eki-net and Otona no Kyujitsu Club data (in Japanese), JR East
- Daiichikosho notice on data held by a contractor (in Japanese), Daiichikosho
- IDC Frontier report on the IDCF Cloud ransomware attack (in Japanese), IDC Frontier
- Details of the three Skyticket incidents (in Japanese), Impress Internet Watch
- Details of the Bookoff member data breach (in Japanese), Business+IT (SB Creative)
- Report on the IDCF Cloud ransomware outage, BleepingComputer
- Japan's government response to the breaches, The Next Web
Questions this raises
- Were credit card numbers leaked?
- All four companies say card numbers were not exposed. JR East says Otona no Kyujitsu Club card expiry dates may have been.
- Were passwords exposed?
- Skyticket and Bookoff say hashed passwords were in the affected data. Daiichikosho says passwords were not included. Change any reused passwords.
- Who is behind the attacks?
- None of the companies has named an attacker. IDC Frontier has confirmed ransomware but not the group responsible.