Japanese parcel carrier Sagawa Express says up to about 53.23 million personal-data records may have leaked after a third party broke into its online parcel-tracking service. The company stresses that the figure includes duplicates and does not show how many people are affected. Credit-card details and passwords were not involved, it says.
The carrier gave the count in its fifth report on the incident, published on Friday 23 October, the same day it reopened the tracking service. It is the latest in a run of Japanese corporate disclosures that TSN has tracked in its round-up of Japan’s data-breach wave and follows on its ransomware and cyber-attack hub.
The count is records, not customers
Sagawa’s wording is careful. The number of records that may have leaked is “現時点で最大約5,323万件（重複を含む件数）”, meaning a maximum of about 53.23 million records at this stage, including duplicates.
In its updated questions and answers, the company says it has already merged some duplicate entries for the same customer, but only to a degree. Shipping-label data in particular contains a large number of duplicates, so the figure does not show the actual number of people affected, Sagawa says. Sagawa says it will keep cleaning the data to reach a more accurate count of people.
The Japan Times, carrying a Jiji report, described the figure as “53 million sets of personal info possibly compromised” and said it “does not necessarily reflect the number of affected customers”. INTERNET Watch gave the same count on Friday.
Names, addresses and phone numbers are in scope
The company lists three groups of data that may have been exposed. The first is shipping-label data for parcels it accepted between 21 June and 30 September 2026, a period of about 100 days: the names, addresses and phone numbers of senders and recipients. Parcels sent with handwritten labels are not included, it says.
The second is customers with freight contracts with Sagawa, again covering names, addresses and phone numbers. For business customers, that includes the name of the contact person. The third is members of Smart Club, Sagawa’s web service, whose records add an email address and a Smart Club member ID.
Sagawa has not published a breakdown of the 53.23 million records by group. It says it has found no secondary harm from the leak so far, and that “クレジットカード情報およびパスワードは含まれておりません”: credit-card information and passwords are not included.
Tracking is back, but other web services remain shut
Sagawa says it detected the unauthorised access at 7:30am Japan time on 30 September. It posted a first notice that day and, on 1 October, said in a second report that customers’ personal data may have leaked. According to its fourth report, it cut off outside access to its internet freight system at noon on 1 October. It says it found no impact on other systems or on group companies’ systems. The cause, and when the intrusion began, are still under investigation with an outside specialist firm.
The tracking service returned on Friday after security work and checks with that firm. Several other online services stay suspended, including the tracking API, online bookings for Hikyaku parcels and return-trip deliveries, changes of delivery destination and a product collection and refund service. Collection and delivery of parcels have carried on as normal throughout.
The company says this is not the same incident as a Smart Club data leak it disclosed in July. That earlier case was caused by a settings error during recovery from a system fault, not by an outside attack, according to its FAQ.
Customers will be told in turn
Sagawa says it will contact affected customers in turn. Where it cannot reach people individually, the published notice will stand in for individual notification. It warns customers to watch for emails, text messages and phone calls pretending to come from the company, and not to open links or hand over personal details. A dedicated call centre is open on 0120-28-3449 from 9am to 5pm Japan time, including weekends and public holidays.
The company made a preliminary report to Japan’s Personal Information Protection Commission on 1 October. It plans to file later reports jointly with the shipper customers whose parcels it carries.
Joint reporting spreads the paperwork to shippers
The reporting plan is the part business customers should read twice. Sagawa intends to file its later reports with the data-protection regulator together with the shippers that hand it parcels, because much of the data that may have leaked concerns their own customers. For a retailer that ships through Sagawa, the carrier’s breach becomes an item on its own compliance list: it has to decide whether to sign up to a joint report and check what its customer notices should say.
That is a pattern compliance teams across Japan are now meeting, as the disclosures from Treasure Factory and Capcom this month show. A logistics provider holds data on people who never chose it, so the senders’ own vendor contracts and incident-response plans matter as much as Sagawa’s.
A big number with a soft edge
The 53.23 million figure is a ceiling, not a body count. Sagawa has said plainly that it overstates the number of people, and it has not said how large the overlap is. Until it publishes a count of individuals, the scale of the breach for real people is unknown.
The practical risk is easier to pin down. Names, addresses and phone numbers tied to recent deliveries are exactly what makes a fake “missed parcel” text convincing, which is why Sagawa’s warning about impersonation matters more than the headline count.
Sources
- Sagawa Express, 「お荷物問い合わせサービス」の再開および個人情報の流出に関する調査状況について（第5報）, 23 October 2026
- Sagawa Express, FAQ on the possible personal-data leak, updated 23 October 2026
- Sagawa Express, fourth report, 9 October 2026
- Sagawa Express, second report, 1 October 2026
- Sagawa Express, first report, 30 September 2026
- INTERNET Watch, Sadayuki Yamada, 23 October 2026
- The Japan Times (Jiji), “Sagawa Express says 53 million sets of personal info possibly compromised”, 24 October 2026
Related stories
- Japan’s Data-Breach Wave: What Bookoff, Times Car, skyticket, Lawson, Resorttrust and Others Have Admitted
- Treasure Factory Says Hackers Took 746,277 Customer Email Addresses
- Capcom Says CAPCOM ID Breach Exposed 11.77 Million Email Records
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
