Biometric Update

Japan’s core My Number infrastructure has not been publicly identified as the source of a major data breach. The ecosystem around it is another matter. The Digital Agency that runs the program has disclosed two data leaks in recent months, a vendor serving a My Number card reservation system has exposed up to 2.2 million email addresses, and companies nationwide are reporting breaches at a sharply accelerating pace. The question is whether a decentralized design can protect a national ID when its weakest connected systems are the ones being hit.

The Personal Information Protection Commission , which requires companies to report breaches within three to five days, received 2,094 reports between April 1 and October 16, 2026, against 1,256 in all of fiscal 2025. Monthly reports stayed below 200 until July, then surged to 830 in the first 16 days of October. Reports covered personal information relating to a cumulative 260 million individuals, more than twice Japan’s population, although the total includes duplicate counts and incidents where exposure was suspected rather than confirmed. In the first 16 days of October alone, 18 reports involved between 1 million and 10 million people, and four involved more than 10 million. Many attacks are believed to use AI tools to find weaknesses, and shared cloud providers let one compromise ripple across dozens of firms.

An ID that keeps absorbing more of daily life

My Number assigns each resident a 12-digit identifier linking tax, pension, healthcare and family registry records. The card is now the default health insurance card, can carry driver’s license and residence card data, and is used for certificates and passport applications. More than 104 million cards had been issued by the end of October, covering 84.6 percent of the population.

The Digital Agency says the design protects it. Data is spread across ministries, local governments and authorized organizations rather than one central database, so no single breach exposes a full record, and the system meets an internationally recognized security standard. Tax amounts and medical diagnoses are not stored on the chip, access requires a PIN or facial recognition, and repeated incorrect PIN entries lock access to the chip, which also has protections against attempts to extract stored information.

The breaches that did happen

The incident most directly connected to My Number services involved an email vendor supporting municipal card-issuance appointments. Municipalities including Nagakute City use TKC Corporation’s My Number Card Issuance Reservation System, and TKC contracts Arara Co. to send confirmation emails. A breach at Arara exposed up to 2,230,812 email addresses. No My Number identifiers leaked, and the emails resumed on November 10.

The addresses were associated with a My Number card appointment service, creating a potential audience for phishing messages impersonating official notices. Attackers do not need to compromise the card itself if they can trick users into disclosing credentials.

The agency itself has been hit twice. On September 11 it disclosed that 246,000 sets of personal information, covering roughly 189,000 government employees and 57,000 private-sector workers, may have leaked from the Government Solution Service, a network shared across ministries. details were exposed, but not My Number identifiers or bank details. Attackers exploited a VPN vulnerability the agency knew but had not patched. They had been inside since around late May; suspicious activity was spotted on June 25, the intrusion confirmed on July 9, and the public told two months later. Chief Cabinet Secretary Minoru Kihara said the government took it seriously that the breach happened “despite our operations under multi-layered security measures.”

The second breach ran through Studio Co., a vendor managing parts of the agency’s website. Attackers accessed Studio’s cloud environment between September 30 and October 1, exposing more than 13,000 profiles collected between 2021 and 2023, mostly names and email addresses. Studio confirmed the breach on October 13 and reported it on October 16, within the regulator’s window. The agency acknowledged it only on October 22, citing its own investigation, and Digital Minister Toshiharu Furukawa confirmed the details the day. The agency has warned the public messages impersonating it. The Digital Agency took weeks to publicly disclose the Government Solution Service intrusion and several days to acknowledge the Studio breach after the vendor’s announcement.

Private companies that collect My Number data for their legal obligations have also had that data exposed, according to reporting on the incidents, though none of those cases involved government infrastructure.

A country under pressure

On October 27, attackers who breached GMO Internet Group began leaking client data following an intrusion that potentially affected 26,739 servers used by financial trading customers. The attackers reportedly demanded a ransom of approximately $50 million.

At a Keio University conference, Michael Rogers, former head of U.S. Cyber Command and the National Security Agency, said Japan is “failing in its most basic cyber intelligence mission” and suffers more major intrusions than almost any other country. He saw little sense of crisis, even after ruling-party cybersecurity chief Masaaki Taira declared a cyber emergency in October.

Is decentralization enough?

In interviews with The Japan Times , experts differed on whether the decentralized design provides sufficient protection as My Number takes on more functions.

Seiji Mizunaga, a lawyer at Makinouchi Comprehensive Law Office in Tokyo, said that many databases holding pieces of the system have weak security “because of their budget and limited staff numbers.” If the Digital Agency can be breached, he argued, so can local governments and companies.

His deeper objection is architectural. ID Austria derives separate identifiers for each administrative sector from a common base identity, limiting how records can be linked. Japan studied that model and still chose a single “common number,” Mizunaga said, urging a move toward Austria’s approach as more functions are added to the card.

Others are more confident. Masakatsu Nishigaki, a computer science professor at Shizuoka University, called the pace of AI development “very dangerous,” because attackers use it to find flaws faster, but did not believe confidential My Number information would be compromised in a leak. Hiroshi Miyashita, a law professor at Chuo University, said he knew of no case where data leaked “from the My Number system” or through a My Number card. He suggested moving older records, such as patient files that hospitals must keep for seven years, offline.

On November 6 , the government approved an emergency package with four pillars: AI-assisted vulnerability detection, better intelligence analysis, a more strategic response to attacks, and more support for victims. Specialist expert teams will follow, with the goal of “the world’s highest levels” of cybersecurity.

What other ID programs should take from Japan

A national ID is only as secure as its least-resourced participant. Decentralization limits what one breach exposes but multiplies the systems to defend, so a mailing vendor or an unpatched VPN becomes an attack surface, and every organization touching identity data, subcontractors included, needs enforceable security baselines.

Government disclosure deserves comparable scrutiny: companies face reporting deadlines measured in days, while the Digital Agency’s public announcements followed weeks or months after the underlying intrusions. And design matters. A single common number is efficient, but every service bolted onto it raises the stakes of a compromise. Japan looked at sector-specific identifiers and passed, and as My Number becomes an all-in-one card, that trade-off is coming back into view.

cybersecurity | digital government | digital ID infrastructure | identity infrastructure | Japan | My Number