Several major Japanese companies disclosed cyber incidents over the past two weeks that exposed customer data, disrupted internal systems and prompted investigations. 

The affected companies include a major insurer, a telecommunications provider, an electronic components maker, and a popular beverage producer. There is no evidence so far that the attacks are connected or were carried out by the same threat actor.

Aflac Japan

The largest disclosed breach involved Aflac Life Insurance Japan, the Japanese subsidiary of U.S.-based insurer, which said hackers compromised its customer portal and other systems, exposing the personal information of about 4.38 million policyholders.

According to the company, the stolen data includes customers' names, addresses and phone numbers. About 230,000 customers also had their premium payment account information compromised.

Aflac said it suspended parts of its systems after detecting the intrusion but continued handling insurance claims and customer inquiries through call centers and other channels. The company said the incident was limited to its Japanese operations and did not affect its U.S. business. Aflac has notified Japanese police and cybersecurity authorities but has not identified the attackers.

Sapporo subsidiaries

Last week, beverage giant Sapporo Holdings disclosed suspected unauthorized access affecting two overseas subsidiaries — Singapore-based food and beverage company Pokka and Canadian brewer Sleeman Breweries. The company said it detected suspicious network activity indicating a possible cyberattack and shut down affected systems while it investigates whether any data was stolen.

Sapporo has not released additional details since its initial disclosure and did not respond to a request for comment. The company said it has found no impact on its domestic operations.

The incident follows previous cyber disruptions in Japan's brewing industry. Last year, rival Asahi said a ransomware attack exposed the personal information of approximately 1.5 million customers and disrupted production, product launches, order processing and shipments across Japan.

Nidec subsidiary and KDDI

Industrial manufacturer Nidec also disclosed a breach by  ransomware actors of part of the network at its Taiwanese subsidiary, Nidec Chaun Choung Technology. The company acknowledged a possible information leak but said it has not confirmed that any personal or confidential data has been published online.

The BlackField ransomware group later claimed responsibility, demanding a $2 million ransom. The group said it stole more than two terabytes of corporate data, including employee, financial, procurement, manufacturing, legal and IT records.. Recorded Future News could not independently verify the group's claims, and Nidec has not indicated whether it is in contact with the attackers.

Nidec said the subsidiary operates on an independent network, limiting the incident's impact on the broader corporation.. The company was previously targeted by ransomware in 2024, when an attack on its Vietnam-based precision manufacturing division was claimed by the 8Base and Everest ransomware groups.

In a separate incident last week, telecommunications giant KDDI Corporation said attackers gained unauthorized access to an email system it operates for five Japanese internet service providers by exploiting a vulnerability in third-party software. The affected providers are STNet, JCOM, Chubu Telecommunications, NIFTY and BIGLOBE.

KDDI said it blocked the intrusion immediately after detecting it, identified the suspected point of entry and implemented additional security measures. The company warned that hackers may have obtained customers' email addresses and passwords.