Suntory Holdings Reports Data Breach Affecting About 100,000 People After Unauthorized ...

Suntory Holdings said on November 2 that a third party had gained unauthorized access to an external cloud service used by the group, and that some of the downloaded files contained personal information. The confirmed leaked data covers 100,000 people, including group employees and employees of partner companies, as well as applicants for its 2026 new-graduate hiring and customers. No credit card or other payment information was included, and no fraudulent use of the personal information has been confirmed so far, the company said. It reported a preliminary notice to Japan's Personal Information Protection Commission the same day and began contacting affected individuals individually.

According to the company, it detected an anomaly on the external cloud service on October 28, blocked the unauthorized access and launched an investigation. The following day, October 29, it confirmed that some of the leaked files contained personal information. The unauthorized access has now been blocked, and measures are in place to prevent further damage, it said. No threats from the attacker have been confirmed.

The personal information confirmed leaked to third parties as of November 1 was disclosed in seven categories.

Note: Figures are based on Suntory Holdings' disclosure.

"We will work to prevent recurrence and strive to further strengthen our security measures," the company said in a statement. Inquiries are being accepted at a toll-free number (0120-050-310) from 9:30 a.m. to 5 p.m., excluding weekends, holidays and the year-end and New Year holiday period. The line will operate on November 3 even though it is a public holiday, the company said. The investigation is ongoing, and the company said it will promptly disclose any new facts that should be made public.

Data leaks via external cloud services and contractors have occurred one after another in recent years. Arara, an email distribution service provider, said the same day in a second update that the number of email addresses potentially leaked in an unauthorized access incident had grown to 77 million. iStyle, which operates the cosmetics review site @cosme, also said the same day that personal information on 3 million members had leaked. As attacks targeting files companies store in the cloud spread, the Suntory Holdings case shows how employee information, job-applicant data and customer information across an entire group can leak through a single entry point.

The case has also drawn attention to the scope and deadlines of reporting obligations under Japan's Act on the Protection of Personal Information. The law requires companies to promptly report preliminary notices to the Personal Information Protection Commission when a personal data leak occurs, and to submit a final report afterward. Suntory Holdings filed its preliminary report shortly after discovering the incident and is notifying affected individuals in parallel. The scale of the breach and the differences in the intrusion route compared with a ransomware incident at another contractor disclosed in January are points of interest.

In terms of the impact on markets and industry, the case will put the group-wide information management systems of a major food and beverage company under scrutiny. Suntory Holdings operates a wide range of businesses through group companies, including beverages, alcoholic drinks, restaurant operations and delivery, and information of differing natures — employee rosters, hiring-applicant data and customer location information — may have leaked from the same cloud environment. Because employee information of business partners is also included, the case is likely to prompt security reviews across the supply chain. The focus will be on the Personal Information Protection Commission's future investigation findings and the content of the recurrence-prevention measures the company discloses.