For: people who have requested a quote or taken out car insurance with Mitsui Direct General Insurance. This article is an explanation based on the official notices from Mitsui Direct General Insurance Co., Ltd.; it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who have requested a quote or taken out car insurance with Mitsui Direct General Insurance.
- Confirmed so farSee the table ↓
- [Website] Detection
- [Website] Who is affected
- [Website] Count
10 more
- [Website] Policyholder and named-insured information
- [Website] Vehicle information
- [Website] Policy terms and coverage
- [Contractor] Detection and report
- [Contractor] Who is affected
- [Contractor] Count
- [Contractor] Name, address, phone number
- [Contractor] Vehicle information
- [Contractor] Bank account information
- [Contractor] Information on accident and breakdown reports
- Not yet confirmed
- Cause (how the access happened)
- When website and app procedures will resume
- When and how affected customers will be notified individually
2 more
- Any change in counts or items after the November 6 notice
- Cause of the roadside-assistance contractor incident
- What to do nowSee the steps ↓
- Do not open links in messages that use the Mitsui Direct name
- Be suspicious of anything that arrives while procedures are suspended
- Check whether you are affected through the individual notice and the contact line
2 more
- If you may be part of the incident with bank account details, check your account
- If you entered details or paid money, get help right away
- Where to verify (source)All sources ↓
- Mitsui Direct General Insurance Co., Ltd., "Customer information leak following unauthorized access to our systems" (November 6, 2026; Japanese)
- Last checked
- As of November 10, 2026
Follow-up plans and what we checked
The company says it will announce new facts or impacts confirmed by the forensic investigation on its official site. The restart date for website and app procedures will be announced separately on the site. When we checked the official site on November 10, 2026, we found no newer notice after those of November 6 and 9.
What people who got a quote or bought a policy should do today
Do not open links in messages that use the Mitsui Direct name
The company asks customers to watch for emails, texts and calls pretending to be the company. If you get a suspicious message, do not open the link, do not open attachments, and do not enter passwords, credit card details or similar.
Someone can now write a message that knows your name, address, phone number, date of birth, email address, even your registration number and policy terms. Being accurate proves nothing. For how to spot fakes, see What is phishing?.
Be suspicious of anything that arrives while procedures are suspended
The company has suspended all procedures on its website and app and says it will announce the restart date separately on its official site. If a message arrives in the meantime about "resuming procedures", "paying a premium" or "renewing your policy", do not open the link; check whether the same notice is on the official site (this site's view).
If you are unsure about a payment or renewal, call the contact line listed on the official website rather than responding to the message.
Check whether you are affected through the individual notice and the contact line
The company says it will notify affected customers individually. The affected group is people who got a quote or took out a policy, including people who never signed up.
The contact point is the inquiry line (toll-free 0120-312-770, weekdays 9:00 to 17:00 Japan time). The contact for the contractor incident is listed under "What happened" below.
If you may be part of the incident with bank account details, check your account
The roadside-assistance contractor incident includes bank account information. If you are a car insurance policyholder, check your premium-debit account statements for the next several weeks. If you see a withdrawal you do not recognize, contact your bank right away.
A call or message from a bank or the police asking for your PIN or password is fake. The Japanese Bankers Association (zenginkyo.or.jp) and the National Police Agency (npa.go.jp) have published warnings (Japanese). The company's notice says nothing about changing bank accounts.
If you entered details or paid money, get help right away
If you entered card details on a suspicious page, contact your card issuer immediately. If you entered a password, change it right away, and change it anywhere else you reused it (Choosing a password manager).
In Japan you can also consult the police advice line (#9110) or the Consumer Hotline (188).
What happened (from the Mitsui Direct notices)
On November 6, 2026 the company posted a notice on its official site about unauthorized access to its own website, and on November 9 a follow-up about unauthorized access at its roadside-assistance contractor. It explains the two as separate incidents. Everything below is from the company's notices.
Oct 29
The roadside-assistance contractor detected unauthorized access to its business system (per the company's November 9 notice).Nov 2
The company announced that it had been told by the contractor that its customer information might have leaked.Nov 4
Early in the morning, the company detected that a third party was accessing its website without authorization and suspended all procedures on the website and app. The same day, it was told by the contractor that its customer information had leaked.Nov 6
The company announced a leak of about 234,000 records from the website incident (as of 13:00). Website and app procedures remained suspended.Nov 9
Follow-up on the contractor incident: a leak of about 45,000 records (as of 09:00 on November 6).
- Detection
- Early on November 4, 2026. A third party was found accessing the company's website without authorization
- Who is affected
- Customers who got a quote or took out a policy with the company
- Count
- About 234,000 records (as of 13:00 on November 6)
- Leaked information
- Policyholder and named-insured information (name, address, phone number, date of birth, email address and so on), vehicle information (vehicle name, registration number, owner and so on), policy terms and coverage
- Not included
- Credit card information, bank account information, login passwords for the company's My Page
- Current status
- All procedures on the website and app suspended (as of 13:00 on November 6; the restart date will be announced separately). Forensic investigation with an outside expert organization under way. No secondary harm confirmed
- Contact
- Inquiry line, toll-free 0120-312-770 (9:00 to 17:00; weekdays from November 9, excluding year-end and New Year holidays)
- Detection
- October 29, 2026, when the contractor detected unauthorized access to its business system. The company was told on November 4 that a leak of its customer information had been confirmed
- Who is affected
- The company's car insurance customers
- Count
- About 45,000 records (as of 09:00 on November 6)
- Leaked information
- Name, address, phone number, vehicle information (registration number, chassis number and so on), bank account information, information on accident and breakdown reports, and so on
- Not included
- Credit card information
- Current status
- No misuse of the information has been confirmed. The company will notify affected customers individually, in turn, once it is ready
- Contact
- For the leak: the contractor's PR and IR department, 03-5213-0826 (weekdays 10:00 to 18:00). For policy details: the company's customer consultation desk, 0120-312-770 (weekdays 9:00 to 17:00)
The contractor incident has its own article
Unauthorized access to the roadside-assistance reception and dispatch system reaches customers of other client companies as well, not only this company (according to those companies' notices). For the contractor-side counts and items across all affected companies, see Unauthorized access to a roadside-assistance reception and dispatch system. This article does not add those counts to the figure for the company's website.
What is known and what is not
Based on the company's notices of November 6 and 9, as of November 10, 2026. When there is news, we will rewrite the Status column.
| Item | What the notices say | Status |
|---|---|---|
| [Website] Detection | A third party's unauthorized access detected early on November 4 | Confirmed (company) |
| [Website] Who is affected | Customers who got a quote or took out a policy | Confirmed (company) |
| [Website] Count | About 234,000 records (as of 13:00 on November 6) | Confirmed (company; a figure as of a given time) |
| [Website] Policyholder and named-insured information | Name, address, phone number, date of birth, email address and so on | Leak confirmed (company) |
| [Website] Vehicle information | Vehicle name, registration number, owner and so on | Leak confirmed (company) |
| [Website] Policy terms and coverage | Listed with "and so on"; no detailed items given | Leak confirmed (company) |
| [Website] Credit card information, bank account information, My Page password | Not included | Not included (company) |
| [Website] Other items | "And so on" is used; whether other items are included is not stated | Not stated |
| [Website] Cause and route | Forensic investigation under way; no cause given | Under investigation |
| [Website] Suspension of procedures | All website and app procedures suspended; restart date to be announced | Under investigation |
| [Contractor] Detection and report | Contractor detected on October 29; reported to the company on November 4 | Confirmed (company) |
| [Contractor] Who is affected | The company's car insurance customers | Confirmed (company) |
| [Contractor] Count | About 45,000 records (as of 09:00 on November 6) | Confirmed (company; a figure as of a given time) |
| [Contractor] Name, address, phone number | Included in the leaked information | Leak confirmed (company) |
| [Contractor] Vehicle information | Registration number, chassis number and so on | Leak confirmed (company) |
| [Contractor] Bank account information | Included in the leaked information | Leak confirmed (company) |
| [Contractor] Information on accident and breakdown reports | Included in the leaked information | Leak confirmed (company) |
| [Contractor] Credit card information | Not included | Not included (company) |
| [Contractor] Cause and route | Not stated in the notice | Not stated |
| Secondary harm (both incidents) | No misuse confirmed | Not confirmed (company) |
| Individual notice to affected customers | Customers will be notified individually. No timing for the website incident; "once ready" for the contractor incident | Under investigation |
What an address, vehicle details, policy terms and bank account details can be used for
These are things that can generally happen from the combination of items; they do not mean they happened in this incident.
| Combination | What can generally happen | What to do today |
|---|---|---|
| Name + address + phone number + email address | A genuine-looking email, text or call using an insurer's name and addressing you by name | Do not open links; check the official site or contact line |
| Vehicle name and registration number + policy terms and coverage | A fake notice about "confirming your policy" or "renewing coverage" whose details match | Handle policy procedures through the official contact line |
| Name + date of birth | A contact that uses "identity verification" to get the remaining details | Do not answer, even if they state your birth date correctly |
| Name + bank account information (contractor incident) | A contact about debits or refunds that asks for account PINs | Hang up on callers claiming to be a bank or the police; check statements |
What the leaked information can enable
- Genuine-looking emails and texts that state your policy details
- Fake sites reached through the excuse of suspended procedures
- Calls that use your name and ask you to verify your identity
What this notice's scope does not allow
- Card fraud from the website incident (card information is not included)
- Login to My Page (the website incident does not include login passwords)
- Account operations from website-incident data (bank account information is not included)
What operators should review: how much to keep about people who only got a quote
The cause has not been disclosed, so this covers only what the disclosed facts support.
- People who never signed up were affected too: the affected group is people who got a quote and people who took out a policy. How long to keep the name, address, date of birth and vehicle details of quote-only users, and which items, is generally up to the operator. Decide which items and what period you need to show a quote again later, and delete anything beyond that, so less leaks when something goes wrong.
- Report a contractor incident separately from your own: the company used separate notices for its own systems and for the contractor, and did not add the counts. Customers need to know which incident applies to them, because it changes whether bank account checks are needed. When an event involves both, separate notices, with items and contacts per incident, keep inquiries from getting mixed up.
Sources (public record)
The facts in this article come from the public information below. We have not speculated about causes that have not been disclosed. The company's notice names the contractor; this article refers to it by role.
- Mitsui Direct General Insurance Co., Ltd., "Customer information leak following unauthorized access to our systems" (November 6, 2026; Japanese) — mitsui-direct.co.jp
- Mitsui Direct General Insurance Co., Ltd., "Information leak following unauthorized access to a business contractor (follow-up)" (November 9, 2026; Japanese) — mitsui-direct.co.jp
Update history
2026-11-10: First version, based on the company's notices of November 6 and 9. We checked the company's official site the same day and found no notice newer than November 9.
Read next
- Roadside-assistance reception and dispatch system incident (the contractor side): Unauthorized access to a roadside-assistance reception and dispatch system
- Similar incidents: Unauthorized access at Times Car / Unauthorized access to Carsensor net
- An example that included bank account details: Unauthorized access at Lashinbang
- Spotting fake emails: What is phishing? / Smartphone security basics
- Other 2026 incidents: list of breaches and cyberattacks (Japan and worldwide)