statistics

Japan data breach statistics: 17,139 leak reports to the Personal Information Protection Commission in FY2025, and about 80% of those filed directly were human error

A statistics page on leak reports (rouei-tou houkoku) filed with Japan's Personal Information Protection Commission (PPC). Reports from businesses: 4,141 in FY2020, 5,846 in FY2021, 7,685 in FY2022, 12,120 in FY2023, 19,056 in FY2024 and 17,139 in FY2025. Reporting certain leaks became mandatory in April 2022, and leaks of sensitive data such as medical history must be reported even when only one person is affected, which pushed counts up. For reports filed directly with the commission in FY2025, the causes were handing documents to the wrong person (48.3%), sending to the wrong recipient (26.0%) and unauthorized access (9.4%). Our conclusion: the count is driven by documents handed or sent to the wrong person at hospitals, pharmacies and similar counters, so organizations should first add recipient checks. Large incidents affecting many people are mostly unauthorized access and call for patching internet-facing devices, multi-factor authentication and managing contractors. Updated each quarter when the PPC publishes.