For: people who took a Chamber of Commerce online exam (one of eight types, such as bookkeeping, Retail Marketing and Nissho PC) from April 1, 2022 to November 4, 2026. This article is an explanation based on the official notice of the Japan Chamber of Commerce and Industry; it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who took a Chamber of Commerce online exam (one of eight types, such as bookkeeping, Retail Marketing and Nissho PC) from April 1, 2022 to November 4, 2026.
- Confirmed so farSee the table ↓
- Unauthorized access and placement of a malicious file
- Deletion of the file and vulnerability fix
- Report to the Personal Information Protection Commission
Listed as possibly affected
- Number of people
- Name, name in kana, sex, date of birth
- Pass/fail result and exam score
1 more
- Email address, phone number, address
- Not yet confirmed
- How the access happened (cause)
- Whether a leak actually occurred (none confirmed so far)
- How affected people will be contacted
2 more
- Final number of people and records
- Whether the data has been misused
- What to do nowSee the steps ↓
- Do not respond to contact in the name of the Chamber of Commerce or related parties
- Check whether you are in scope
- Verify any contact about a certificate, exam fee or qualification registration through a channel you look up yourself
4 more
- If you registered an email, phone number or address, watch those channels
- Review password reuse
- If you entered information or responded to a suspicious contact, get help quickly
- Ask the official contact
- Where to verify (source)All sources ↓
- Japan Chamber of Commerce and Industry, "Possible leak of test-taker information (personal information) due to unauthorized access to the Chamber of Commerce online exam management system" (November 10, 2026, in Japanese)
- Last checked
- As of November 13, 2026
Follow-up plans and what we checked
JCCI says no leak or misuse of test-taker information has been confirmed so far. Because a leak cannot be ruled out, it reported the matter to the Personal Information Protection Commission on November 9, 2026. When we checked JCCI's news on November 13, 2026, we found no follow-up after the November 10 notice.
What test-takers should do today
Do not respond to contact in the name of the Chamber of Commerce or related parties
JCCI says suspicious emails (phishing), text messages, calls and mail pretending to be JCCI or related parties may arrive. Do not open links or attachments in emails or texts you do not recognize, and do not enter authentication information such as passwords, or credit card information, on suspicious websites. Do not respond to suspicious calls or mail either.
JCCI says it does not ask for passwords or credit card information by email, text, phone or similar means. Ways to tell the difference are in What is phishing?.
Check whether you are in scope
The scope is people who took any of these online exams from April 1, 2022 to November 4, 2026: bookkeeping, Retail Marketing (Hanbaishi), Nissho PC, electronic accounting practice, Key Touch 2000, Business Keyboard, Nissho Programming and Nissho Business English. If you remember taking one, act as if you may be affected.
The notice does not say how individuals will be contacted. To check, use the contacts listed in the notice (JCCI Business Division, inquiry form).
Verify any contact about a certificate, exam fee or qualification registration through a channel you look up yourself
Pass/fail results and scores may be included. In general, contact from someone who knows which exam you took and whether you passed looks genuine (our view). If a message gives a reason such as "reissuing a certificate", "refunding an exam fee" or "updating qualification information" to get you to open a link, do not use the link; open the Chamber of Commerce's official site yourself and check there.
If you registered an email, phone number or address, watch those channels
The email address, phone number and address are optional items, and some people did not enter them. If you did, fake emails, texts, calls or mail may arrive there. Because your name and date of birth may be known, also be careful with "identity verification" requests that try to get the rest of your information. Do not answer even if the caller correctly states your birth date.
Review password reuse
Passwords are not among the listed items (not stated), and the notice does not tell people to change passwords. Still, tricking people into entering a password on a fake site is a common method. If you use the same password as on other services, review it as a precaution. Steps are in How to check whether your password has leaked.
If you entered information or responded to a suspicious contact, get help quickly
If you entered card information or a password on a suspicious link, contact your card company and check your statement, and change the password on any service where you reused it. Also consult your local police or consumer hotline. For suspicious account activity, see How to check for unauthorized access.
Ask the official contact
The contacts in the notice are the Japan Chamber of Commerce and Industry Business Division (phone 03-6402-6154, weekdays 9:30 to 20:00 Japan time) and an inquiry form. Open the form from JCCI's notice page. Use the contacts on the official notice, not a number written in an email or text.
What happened (from JCCI's notice)
JCCI published a notice dated 17:00 on November 10, 2026 about unauthorized access to the online exam management system and the possible leak of test-taker information. Everything below is from that notice.
November 1
A malicious program (a malicious file) was placed on the exam management system.November 4
JCCI confirmed the unauthorized access through a report from the system management company. It deleted the malicious file immediately and applied a vulnerability fix (patch) late that night.November 9
The investigation found that information on up to about 980,000 test-takers may have leaked. JCCI reported the matter to the Personal Information Protection Commission the same day.November 10
The notice was posted on JCCI's site. It says no leak or misuse has been confirmed so far and that the online exams can be taken as usual.
- Occurrence
- A malicious file was placed on November 1, 2026. Confirmed on November 4
- Scope
- People who took the online exams from April 1, 2022 to November 4, 2026. Up to about 980,000 people (about 1.97 million records)
- Exams in scope
- Bookkeeping, Retail Marketing (Hanbaishi), Nissho PC, electronic accounting practice, Key Touch 2000, Business Keyboard, Nissho Programming, Nissho Business English
- Information that may have leaked
- Name, name in kana, sex, date of birth, pass/fail result, exam score, optional items (email address, phone number, address)
- Not included
- Information used for payment, such as credit card information
- Cause
- Unauthorized access to the exam management system on an external server. A malicious file was placed. The route and method have not been disclosed
- Contact
- Japan Chamber of Commerce and Industry Business Division (phone 03-6402-6154, weekdays 9:30 to 20:00 Japan time); inquiry form
What is known and what is not
This table is based on JCCI's notice (November 10) as of November 13, 2026. JCCI lists these items as test-taker information that may possibly have leaked as of now. We will rewrite the status column when there is a follow-up.
| Item | What the notice says | Status |
|---|---|---|
| Unauthorized access and placement of a malicious file | Placed on November 1; confirmed on November 4 | Confirmed (JCCI) |
| Deletion of the file and vulnerability fix | Deleted on November 4; patch applied late that night. The fix is complete | Confirmed (JCCI) |
| Number of people | Up to about 980,000 (about 1.97 million records) | Possible (JCCI; an upper limit) |
| Name, name in kana, sex, date of birth | Among the items that may have leaked | Possible (JCCI) |
| Pass/fail result and exam score | Among the items that may have leaked | Possible (JCCI) |
| Email address, phone number, address | Optional items. The information of people who entered them may be included | Possible (JCCI) |
| Information used for payment, such as credit card information | Not included | Not included (JCCI) |
| Passwords | Not listed as an item | Not stated |
| Leak or misuse of test-taker information | Not confirmed so far (JCCI says a leak cannot be ruled out) | Not confirmed (JCCI) |
| Route and method of access | Not stated | Not stated |
| Report to the Personal Information Protection Commission | Reported on November 9 | Confirmed (JCCI) |
| Individual notification to affected people | Not stated | Not stated |
What names, birth dates, results and scores can be used for
The table below describes what can generally happen with combinations of these items. It does not mean this has happened in this incident.
| Items that may have leaked | What can generally happen | What test-takers should do |
|---|---|---|
| Name + email address / phone number (optional) | Genuine-looking emails, texts and calls in the Chamber of Commerce's name | Do not open links; open the official site yourself |
| Pass/fail result + score + exam name | Contact about "reissuing a certificate" or "qualification registration", or contact that gains trust by knowing you took the exam | Do not trust it even if they know you took the exam |
| Name + date of birth | "Identity verification" used to get the rest of your information | Do not answer even if they state your birth date |
| Name + address (optional) | Fake mail, or calls that gain trust by knowing your address | Do not call the number on the mail; check with the official contact |
What can happen with the information that may have leaked
- Genuine-looking emails, texts, calls and mail in the name of the Chamber of Commerce or related parties
- Contact that gains trust by knowing your result or score
- "Identity verification" used to extract personal information
Reported as outside the scope in the notice
- Information used for payment, such as credit card information
What operators should review: how much exam data to keep in an externally managed system
The cause has not been disclosed, so this section only covers what can be said from the published facts.
- Watch externally managed systems from the ordering side too: here, three days passed between the malicious file being placed (November 1) and confirmation through the system management company's report (November 4). Rather than leaving it all to the contractor, agree on a way for the ordering side to be told about newly placed files and unusual changes, and on a deadline for that notice. This can shorten the time to notice (our view).
- Review how long and which items you keep: the scope covers about four years and seven months, from April 2022 to November 2026. Information that cannot be changed later, such as pass/fail results and scores, has a longer-lasting impact the longer it is kept. Deciding to archive separately or delete data beyond the period needed to run the exams can reduce what leaks.
Sources (public record)
The facts in this article are based on the official notice below. We do not speculate about cause details that have not been disclosed.
- Japan Chamber of Commerce and Industry, "Possible leak of test-taker information (personal information) due to unauthorized access to the Chamber of Commerce online exam management system" (November 10, 2026, in Japanese) — jcci.or.jp
Update history
2026-11-13: First version. Based on JCCI's notice of November 10. We checked JCCI's news the same day and found no follow-up.
Read next
- How to spot fake contact: What is phishing? / Smartphone security basics
- Checking your password: How to check whether your password has leaked
- Suspicious activity on an account: How to check for unauthorized access
- Other incidents in 2026: Data breaches and cyberattacks (Japan and overseas)