秘書官アイリスの都市伝説手帳～Urban Legend Notebook of Secretary Iris～

I am Iris.

Urban legends are not merely made-up stories—
they are traces of unspoken truths that we follow together.

Who Really Protects Your Personal Information?

Banking.

Online shopping.

Mobile phones.

Hospitals.

Government services.

Every day, we entrust our personal information to organizations we depend on.

Names.

Addresses.

Dates of birth.

Telephone numbers.

Payment details.

Identification documents.

Modern life is built around the exchange of information.

And the more connected our lives become, the more organizations are responsible for keeping that information secure.

But in 2026, Japan experienced a series of major cybersecurity incidents.

Millions of accounts were affected.

Sensitive identification documents were exposed.

Passwords were compromised.

And even a government IT platform was breached.

These incidents raise questions that go beyond individual companies.

Why did so many systems become vulnerable?

How much control does Japan have over the technology supporting its digital infrastructure?

And what happens when important public and private services depend on technology supplied by companies based overseas?

Tonight, we investigate Japan’s data breaches and the larger question of digital sovereignty.

---

Chapter One | A Wave of Data Breaches in Japan

On October 7, 2026, Japan’s Personal Information Protection Commission issued a warning in response to major personal-data leakage incidents.

On October 14, Japan’s National Cybersecurity Office also highlighted the growing number of unauthorized-access and data-leakage incidents affecting organizations across different sectors.

These were not merely rumors circulating on social media.

Japanese government authorities were publicly acknowledging the problem.

But to understand the scale of the issue, we need to examine specific incidents.

And the details are important.

A confirmed breach is not necessarily the same as a confirmed leak.

Potentially exposed records are not always confirmed stolen records.

And an account count is not automatically the same as the number of individual people affected.

Those distinctions matter.

---

Chapter Two | KDDI: Millions of Email Credentials Compromised

One of the most significant incidents involved an email platform developed by Japanese telecommunications company KDDI for multiple internet service providers.

On June 17, 2026, unauthorized access exploiting a software vulnerability resulted in the exposure of stored login credentials.

On August 19, Japan’s Personal Information Protection Commission published details of the incident.

According to the regulator, the confirmed breach involved credentials associated with:

12,231,954 individuals.

An even more troubling detail appeared in the findings.

Passwords belonging to approximately 7.62 million individuals had been stored in plaintext.

That meant the passwords were not protected by an appropriate one-way password-storage mechanism.

The regulator identified shortcomings in technical security measures and instructed KDDI to improve its safeguards.

The broader danger involved password reuse.

If a person used the same password for email, shopping, social media, or other accounts, compromised credentials could potentially be used to attempt unauthorized logins elsewhere.

The incident illustrated how the failure of one authentication platform can create risks across multiple services.

It also demonstrated an uncomfortable fact.

Cybersecurity failures do not always require sophisticated foreign espionage.

Basic weaknesses in password storage and access controls can create enormous problems.

---

Chapter Three | Times Car: Millions of Accounts and Identification Documents

On September 25, 2026, the car-sharing service Times Car detected unauthorized access to its web systems.

Three days later, its parent company, Park24, reported that information associated with approximately 6.6 million accounts had been acquired by an unauthorized third party.

The exposed information varied between accounts.

It included names, addresses, dates of birth, contact information, driving-license details, and other personal data.

A subsequent announcement clarified that identity-document information, including driver’s license images, had been leaked from approximately 1.6 million accounts.

That distinction is critical.

The company did not report that every one of the 6.6 million affected accounts had an identity-document image exposed.

Nevertheless, the incident highlighted the dangers of retaining sensitive information over long periods.

On October 16, Park24 announced a change in policy.

It explained that identity-document images had previously been retained throughout a customer’s membership and for seven years after withdrawal.

The company decided to stop retaining those images after membership registration was completed and announced plans to delete the images it still held by the end of October.

That raises a question much bigger than the individual incident.

How long should a company keep personal information after it has served its original purpose?

A password can be changed.

A face cannot easily be changed.

A birth date cannot be replaced.

The longer sensitive information is stored, the more important its protection becomes.

And unnecessary retention can make the consequences of a breach worse.

---

Chapter Four | Seicomart: A Local Service, a Major Data Incident

Another incident affected Seicomart, a convenience-store chain particularly familiar to residents of Hokkaido.

On September 29, the company announced unauthorized access involving its mobile application.

In a September 30 update, Seicomart confirmed that information relating to 572,022 individuals who had registered for its app had been viewed through unauthorized access.

That represented approximately 49% of app members.

The company clarified that people who had never registered for the app were not part of the affected group.

It also stated that purchase-history information had not been leaked.

This incident illustrates a modern problem.

Convenience-store apps are not simply digital loyalty cards.

They often rely on customer databases, authentication systems, connected services, and network infrastructure.

What appears to be a small everyday application may depend on a much larger system behind the scenes.

And when that system is compromised, ordinary consumers can be affected.

---

Chapter Five | Japan’s Government IT Platform Was Also Breached

Perhaps the most symbolically important incident involved the Japanese government itself.

On September 11, Japan’s Digital Agency announced unauthorized access to Government Solution Services, commonly known as GSS.

GSS provides IT infrastructure used by multiple government organizations.

According to the agency, unusual access involving a maintenance account was detected on June 25.

On July 9, investigators established that a third party had exploited a vulnerability in a VPN network device.

The attack had allowed unauthorized access to the system.

The agency reported that approximately 246,000 records containing personal information relating to government employees and people involved in government work might have been leaked.

The potentially exposed data included names, email addresses, telephone numbers, and some addresses.

The agency also clarified that the affected information did not include personal data belonging to the general public.

Nor did it include Japan’s My Number identifiers or bank account information.

Here, the language is important.

The unauthorized access was confirmed.

The exposure of approximately 246,000 personal-information records was reported as a possibility.

Those are not identical findings.

The agency’s published announcement also did not establish that a foreign government was responsible.

Nor did it identify Chinese-made computers or equipment as the cause.

The reported entry point was a vulnerability in a VPN device.

This was a cybersecurity incident involving access management and system vulnerabilities.

Not proof of an international espionage operation.

---

Chapter Six | Why VPN Security Matters

A virtual private network, or VPN, is widely used to provide secure network connectivity.

Organizations may use VPN infrastructure to allow employees and administrators to connect to systems remotely.

Such connectivity is necessary for many modern workplaces.

But VPN devices are also part of an organization’s security boundary.

If a serious vulnerability remains unaddressed, attackers may be able to exploit it.

The GSS incident demonstrates why keeping network equipment secure is essential.

But patching the vulnerability is only one part of the problem.

Organizations also need to control what happens after a user enters the system.

What can a compromised account access?

Are privileges limited?

Can unusual behavior be detected?

Can an attacker reach sensitive files?

Can a breach be contained before it spreads?

These questions are central to modern cybersecurity.

A secure network should not depend entirely on the assumption that no attacker will ever get inside.

It also needs mechanisms to limit damage when that assumption fails.

---

Chapter Seven | The Chinese Robot Vacuum Controversy

Japan’s debate over supply-chain security has also reached an unexpected object.

Robot vacuum cleaners.

During a May 12, 2026 press conference, Minister Kimi Onoda was asked about Chinese-made cleaning robots reportedly used in a parliamentary building.

The question concerned whether connected cleaning devices should fall within government supply-chain security requirements.

The minister explained that equipment with network connectivity could fall within the scope of relevant risk-management measures, even if it served a specific purpose such as cleaning.

Why would a vacuum cleaner matter?

Some modern robot vacuums contain cameras, mapping systems, sensors, wireless connections, and cloud-based functions.

Those features can make cleaning more convenient.

But they also introduce questions about data collection, remote access, software updates, and network communication.

In sensitive environments, such as government offices, those questions deserve careful consideration.

However, one distinction must be made.

There is no verified evidence in the materials reviewed that the particular Chinese-made cleaning robot actually stole Japanese government information.

The issue raised during the press conference was a potential supply-chain security risk.

It was not a confirmed espionage incident.

The Japanese government also explained that the purpose of procurement controls was not simply to exclude products from one particular country.

The objective was to avoid purchasing systems and equipment that introduced unacceptable risks of information theft or destruction.

That is a much more specific standard.

---

Chapter Eight | What About Lenovo and Foreign-Made Computers?

The same questions apply to laptops and desktop computers.

Government agencies and private companies use equipment supplied by manufacturers around the world.

Lenovo.

Dell.

HP.

Japanese manufacturers.

And many others.

But a computer’s brand or country of origin does not, by itself, establish that information is being transmitted to a foreign intelligence service.

The relevant questions concern how the device operates.

Who designs the hardware?

Who maintains its firmware?

Who distributes security updates?

What management functions are enabled?

What network connections are permitted?

Who can remotely administer the device?

And can the organization verify that appropriate security controls are in place?

Modern computers depend on complex international supply chains.

Even a product sold under a Japanese brand may include components and software developed elsewhere.

Conversely, a product supplied by an overseas company may operate within carefully restricted and monitored environments.

Therefore, the security of government computers cannot be reduced to a simple question of nationality.

It requires assessment of the actual technology, configuration, and management practices.

---

Chapter Nine | Are Japan’s Government Servers Located in America?

Another common claim is that Japan’s government information is stored entirely on American servers.

That description is inaccurate.

Japanese government systems use different kinds of infrastructure.

Some employ cloud services.

Others use dedicated systems and data-center facilities.

There is no single physical location for all government information.

However, major American technology companies have played an important role in Japan’s Government Cloud program.

These include:

Amazon Web Services.

Microsoft Azure.

Google Cloud.

Oracle Cloud Infrastructure.

But the nationality of a cloud provider is not necessarily the same as the physical location where data is stored.

Cloud services may operate infrastructure in different geographical regions, including Japan.

In March 2026, Japan’s Digital Agency also confirmed that Sakura Cloud, a Japanese cloud service, had satisfied the Government Cloud program’s technical requirements and could provide a production environment.

That expanded the available domestic options.

But the larger question remains.

Is storing data inside Japan enough to guarantee that Japan controls the technology supporting it?

The answer is more complicated than the location of a server.

---

Chapter Ten | What Digital Sovereignty Actually Means

Digital sovereignty is the ability of a country or society to make meaningful decisions about its data, digital infrastructure, and technological dependencies.

It does not necessarily mean manufacturing every computer domestically.

Nor does it require rejecting all foreign technology.

Modern digital systems depend on international cooperation.

Cloud computing can improve reliability and security.

Overseas vendors can provide advanced tools that domestic organizations might struggle to build alone.

But dependence creates governance questions.

Can the customer control who accesses the data?

Who manages encryption keys?

What happens if the service becomes unavailable?

Can data be moved to another provider?

Can the system continue operating during an international disruption?

Can the organization investigate security incidents independently?

And who has the authority to make those decisions?

These questions concern resilience and control.

Not merely ownership.

A system can store information domestically while still depending on foreign software, components, or support.

At the same time, a foreign cloud service can employ strong technical and contractual safeguards.

The specific architecture matters.

---

Chapter Eleven | The Risks of Concentrated Data

There is another important issue.

Data concentration.

Businesses and governments often centralize information to improve efficiency.

A unified system may reduce duplicated work.

It may help detect fraud.

It may improve emergency response.

It may provide faster public services.

But concentration can also increase the impact of a successful intrusion.

Consider two databases.

One stores an email address.

Another stores an email address alongside a name, date of birth, identity-document image, contact information, and service history.

Compromising the second database may expose a much richer collection of personal information.

Furthermore, information obtained from different sources can sometimes be correlated.

This process is often called data linkage or record matching.

With AI-assisted analysis, large datasets can be processed and compared more efficiently.

That creates legitimate opportunities for research and operations.

But it can also make stolen information more useful to criminals.

This does not prove that a single secret database containing every Japanese citizen’s information exists.

It illustrates why data minimization and access control are important.

---

Chapter Twelve | Is Japan’s Information Flowing Freely to Foreign Governments?

The most dramatic version of the digital-sovereignty debate suggests that all Japanese personal information is already available to foreign governments.

The evidence examined for this investigation does not support that sweeping claim.

Using a Chinese-made device does not automatically prove that information is sent to China.

Using an American cloud provider does not automatically prove that the United States government can freely read every stored file.

Using foreign software does not automatically mean that the customer has surrendered all control.

Actual access depends on the system architecture, encryption arrangements, legal obligations, contractual conditions, and security configuration.

Nevertheless, international cyber espionage is a genuine security concern.

Japan’s Information-technology Promotion Agency includes geopolitically motivated cyberattacks among its major organizational cybersecurity threats for 2026.

That means supply-chain security and foreign influence are legitimate areas for investigation.

But general geopolitical risks cannot be used as proof that a specific company or product caused one of the breaches discussed here.

Evidence must connect the claim to the incident.

Without that connection, suspicion remains suspicion.

---

Chapter Thirteen | Japan’s Problems Are Not Only Foreign Dependencies

There is another lesson from the events of 2026.

Some of the most serious weaknesses were domestic management failures.

The KDDI-related incident exposed major deficiencies in password storage and access controls.

The Times Car incident raised questions about how long sensitive identity-document images should be retained.

The GSS breach demonstrated the importance of vulnerability management and access restrictions.

These are not problems that can be solved simply by replacing foreign computers with Japanese computers.

Nor can they be solved by moving every server into a domestic facility.

Good cybersecurity requires continuous operational discipline.

Strong authentication.

Appropriate password storage.

Timely security updates.

Restricted privileges.

Monitoring and incident response.

Data minimization.

Vendor oversight.

And transparent communication with affected users.

Digital sovereignty is important.

But it cannot replace basic cybersecurity management.

---

Final Chapter | Can Japan Protect Its Own Digital Future?

Japan is becoming more digital.

Government services are moving online.

Businesses increasingly depend on cloud platforms.

Connected devices are spreading.

AI is becoming part of everyday operations.

These developments can improve people’s lives.

But they also make the protection of information more important.

The incidents of 2026 show why.

Millions of credentials were compromised in the KDDI-related case.

Millions of Times Car accounts were affected.

Hundreds of thousands of Seicomart app users had information accessed.

And even a government IT service experienced unauthorized access involving potentially exposed records.

None of these events, on its own, proves that Japan has lost control over its digital infrastructure.

Nor do they establish that a foreign government was responsible for every breach.

But they reveal the importance of asking difficult questions.

Who controls the technology?

Who can access the information?

Who updates the systems?

How long is personal data retained?

Can services continue if a foreign supplier becomes unavailable?

And can citizens understand what happens to the information they provide?

Perhaps digital sovereignty is not about refusing to use technology developed overseas.

Perhaps it is about ensuring that international technological cooperation does not eliminate a country’s ability to make independent choices.

Japan does not need to build every component itself.

But it does need to understand its dependencies.

It needs to manage risks.

It needs alternatives where they matter.

And it needs to protect the people whose information makes the digital economy possible.

The most important question is not simply where Japan’s data is stored.

It is who controls the systems that make that data useful—and what happens when those systems fail.

That is the real challenge of digital sovereignty.

And it concerns every country, not only Japan.

Let us keep looking for the fragments of truth.

I will return to continue the telling.