For: people who use, or have used, Sumitomo Life's "Vitality Trial / Corporate" or "Vitality Smart" (including the employee-benefit type). Not all policyholders. This article is an explanation based on the official notice from Sumitomo Life and the notice from the company that operates the system under contract; it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who use, or have used, Sumitomo Life's "Vitality Trial / Corporate" or "Vitality Smart" (including the employee-benefit type). Not all policyholders.
- Confirmed so farSee the table ↓
- Discovery
- Blocking of access
- People affected
2 more
- Name, address, phone number, date of birth, email address
- Credit card number
- Not yet confirmed
- Cause (how the access happened)
- What the company will do for affected customers, and when
- When new applications and procedures will resume
1 more
- Whether any misuse occurs (none confirmed so far, per the company)
- What to do nowSee the steps ↓
- If you registered a card, check your statement
- Do not open links in messages that claim to be from Sumitomo Life
- Hang up and call back
2 more
- If you are worried, use the official contact point
- If you entered details or paid money, get help right away
- Where to verify (source)All sources ↓
- Sumitomo Life Insurance Company, notice on customer information leaked through unauthorized access to a contractor's system (November 9, 2026; Japanese)
- Last checked
- As of November 11, 2026
Follow-up plans and what we checked
Sumitomo Life says it is identifying affected customers and will respond appropriately based on the results (the notice does not say how). The suspension lasts until the system is confirmed safe, and the company says it will announce resumption on its website. The company that operates the system under contract also says it will promptly announce new findings. When we checked both notice pages on November 11, 2026, we found no change since the November 9 notices.
What users of the affected services should do today
If you registered a card, check your statement
Card numbers leaked for about 1,000 people and are described as partly masked. If you registered a card with these services (or entered one when applying), check recent charges on your card issuer's member page or app for anything you do not recognize.
If you find a suspicious charge, contact the issuer right away, and ask whether a replacement card is needed. The notice says no misuse has been confirmed so far. For how card leaks usually unfold, see our card data leak article.
Do not open links in messages that claim to be from Sumitomo Life
With a name, email address and phone number together, it is easier to make a message look genuine. Sumitomo Life asks customers to be wary of emails, text messages and calls pretending to be from the company.
The company says it does not ask for passwords or PINs by email or phone. Do not open links in suspicious messages and do not call numbers written in them. For how to spot them, see What is phishing?.
Hang up and call back
A caller who knows your name or date of birth has not proved anything. Do not give out card numbers, PINs or verification codes by phone or text message; call back using a number listed on the official website.
If you are worried, use the official contact point
The contact point in the notice is 0120-550-997 (from November 9, weekdays 9:00 to 17:00 Japan time). The company is still checking who is affected and says it will respond appropriately based on the results (the notice does not say how). Use the number on the official website, not one written in an email or text message.
If you entered details or paid money, get help right away
If you entered card details on a page linked from a suspicious message, contact your card issuer immediately. If you entered a password, change it, and change it on any other service where you reused it (Choosing a password manager). In Japan you can also call the police consultation line (#9110) or the consumer hotline (188).
What happened (from the Sumitomo Life notice)
Sumitomo Life Insurance Company posted a notice on its website on November 9, 2026. The company that operates the system under contract announced the same day. Everything below comes from those two notices.
November 2
Unauthorized access by a third party to the system of the company that handles system-related work under contract was confirmed and reported to Sumitomo Life the same day (Sumitomo Life's notice).November 3
External access was blocked and the service was suspended temporarily (the contractor's notice). Sumitomo Life has suspended new applications and some procedures for the affected services since that day.November 9
Sumitomo Life made the incident public, and the contractor announced the same day. The contact line opened.
- Affected services
- Sumitomo Life Vitality Trial / Corporate; Vitality Smart (including the employee-benefit type)
- People affected
- About 80,000 who use or have used the services above
- Leaked information
- Any of name, address, phone number, date of birth, email address and credit card number (partly masked); card numbers for about 1,000 people
- Not included
- Insurance contracts, and data such as step counts from use of Vitality or the Vitality health program that accompany insurance contracts
- Cause
- Unauthorized access by a third party to the system of the company the insurer outsources system work to (details under investigation)
- Suspended
- New applications for the affected services; Vitality Smart customers' own cancellation and card changes; use of the group portal for the employee-benefit type (until the system is confirmed safe)
- Not affected
- Use of the Vitality app; new applications and procedures for Vitality insurance
- Contact
- 0120-550-997 (weekdays 9:00 to 17:00 Japan time)
What is known and what is not
This table is based on the notices of November 9 from Sumitomo Life and the contractor, as of November 11, 2026. When follow-up notices appear, we will update the status column.
| Item | What the notice says | Status |
|---|---|---|
| Discovery | Confirmed November 2 and reported to Sumitomo Life the same day | Confirmed (company) |
| Blocking of access | External access blocked on November 3 (contractor's notice) | Confirmed (contractor) |
| People affected | About 80,000 (current or past users) | Confirmed (company) |
| Name, address, phone number, date of birth, email address | Any of these leaked (items differ by person) | Leak confirmed (company) |
| Credit card number | Partly masked; about 1,000 people | Leak confirmed (company) |
| Which digits are not masked | Not stated | Not stated |
| Insurance contract information | Did not leak | Not included (company) |
| Vitality step-count and similar data | Did not leak | Not included (company) |
| Password | Not in the list of leaked items | Not stated |
| Misuse or publication online | Not confirmed so far | Not confirmed (company) |
| Cause and how the access happened | Under investigation | Under investigation |
| Response to affected customers | Identifying them; says it will respond appropriately based on the results (method not stated) | Under investigation |
| Restart of applications and procedures | Suspended until the system is confirmed safe | Under investigation |
What names, contact details and card numbers can be used for
With a name, address, phone number and email address together, it becomes easier to make a message look genuine. The points below are what can happen in general; they do not mean it has happened in this incident.
Email address + name
↓→
Convincing apology or "please complete this procedure" emails addressed to you by name
→ Do not open links; check on the official site
Name + phone number
↓→
Calls or text messages using the company's name
→ Hang up and call the number on the official site
Card number (partly masked) + name
↓→
Messages that ask you to "confirm your card" by giving the remaining digits or a PIN
→ Never give card numbers or PINs to someone who contacts you
What the leaked data can be used for
- Emails and text messages addressed to you by name that look genuine
- Calls that use your name and the company's name
- Messages that lead to fake pages asking for card details or a password
Stated not to be included, within the notice's scope
- Insurance contract information (Sumitomo Life's notice)
- Data such as step counts from use of Vitality or the Vitality health program that accompany insurance contracts (same)
- Use of the Vitality app and new applications and procedures for Vitality insurance are stated to be unaffected
What operators should review: what an application system holds, and for how long
The cause has not been disclosed, so this section only covers what follows from the published facts.
- Past users were also included. The affected people include those who "have used" the services. Deciding how long an application system keeps contact details and card information of people who have left a service limits the damage when an incident happens.
- Whether the system needs card numbers at all. The card numbers were "partly masked". In general, leaving payment to a payment service provider so your own application system holds no card numbers limits the impact of a leak. If you must hold them, decide the masking range and the retention period.
- Dates between the contractor's incident and disclosure. The notices give the confirmation (November 2), the blocking of access (November 3) and the public notice (November 9). If a contractor runs your application system, deciding beforehand who suspends applications, what the notice to customers says and which contact point handles questions shortens the time to disclosure.
Sources (public record)
The facts in this article are based on the public information below. We have not speculated about details of the cause.
- Sumitomo Life Insurance Company, notice on customer information leaked through unauthorized access to a contractor's system (November 9, 2026; Japanese) — sumitomolife.co.jp
- Notice on the same incident from the company that operates the system under contract (November 9, 2026; Japanese) — Announcement by the contractor operating the system
Update history
2026-11-11: First version, based on the November 9 notices from Sumitomo Life and the company that operates the system under contract. We checked both notice pages on November 11 and found no follow-up.
Read next
- A separate incident at a life insurer: Unauthorized access to Sony Life and the leak of contract information
- Spotting fake messages: What is phishing? / Smartphone security basics
- Passwords: Choosing a password manager
- Other 2026 incidents: list of breaches and cyberattacks (Japan and worldwide)