# Data breaches and cybersecurity vulnerabilities in Japan > Live situation record from CLSTR: https://clstr.news/situations/data-breaches-and-cybersecurity-vulnerabilities-in-japan > Updated: 2026-10-01T23:05:21.000Z. Sources: 5. Developments: 2. Recent data breaches in Japan have brought attention to systemic vulnerabilities in corporate and institutional information security. A notable incident involving Times Car resulted in the leak of identification documents, highlighting the risks of retaining sensitive personal data long after service use has ended. Specific breaches have been reported by research institutions. The Japan Atomic Energy Agency (JAEA) confirmed that unauthorized access to a research support website led to the leak of personal information for 175 individuals, including identification card images, radiation-related health examination results, and My Number details. Additionally, the Institute of Energy Economics, Japan, suffered a breach via a phishing attack that compromised Microsoft 365 accounts, resulting in the suspected download of thousands of files. These incidents underscore a broader trend where Japanese companies may lack sufficient incentives to invest in robust security. Analysts note that unlike the European Union’s GDPR, the Japanese legal framework offers fewer financial deterrents for major leaks. Data indicates that 62.6% of small and medium-sized enterprises have not invested in security measures over the last three years, often viewing such expenditures as a cost center rather than a necessity. ## Timeline ### 2026-10-01: Japanese research agencies report data breaches Two Japanese research organizations, JAEA and the Institute of Energy Economics, Japan, reported data breaches involving personal information and file downloads due to unauthorized access and phishing. 3 sources. https://clstr.news/cluster/japanese-research-agencies-report-data-breaches ### 2026-10-01: Japan data breaches highlight lack of security investment Frequent data breaches in Japan underscore a lack of corporate security investment, driven by weak legal incentives compared to the EU's GDPR and a tendency to retain excessive personal data. 2 sources. https://clstr.news/cluster/japan-data-breaches-highlight-lack-of-security-investment --- Cite as: Data breaches and cybersecurity vulnerabilities in Japan. CLSTR, https://clstr.news/situations/data-breaches-and-cybersecurity-vulnerabilities-in-japan