Japan's MS&AD Insurance Group says the data leak across its non-life insurers has passed one million records, after Mitsui Sumitomo Insurance and Mitsui Direct General Insurance disclosed about 296,000 newly exposed records on 9 November 2026. Combined with about 715,000 records disclosed through 6 November, the total stands at about 1.011 million.

The new cases were disclosed by the two insurers on Monday. They said the records were exposed through unauthorised access, and that no misuse of the information, such as fraud, had been confirmed so far. The figures are approximate and come from the companies' own announcements.

How the new records leaked

The newly identified leaks break down into two parts. About 273,000 records of car insurance policyholder information were exposed after a contractor handling road service operations suffered unauthorised access. A further 23,000 records of corporate information leaked from Mitsui Sumitomo Insurance's website for small and midsize businesses.

The policyholder records include names, addresses, phone numbers and vehicle information. The corporate records include company names, sales figures, employee counts and job titles. At Mitsui Direct General Insurance, some account information was also affected. Across the group, the companies said credit card numbers and bank account information were not included in the newly disclosed records.

How the leak grew

The leak first came to light on 6 November, when Aioi Nissay Dowa Insurance, Mitsui Sumitomo Insurance and Mitsui Direct Insurance announced that about 715,000 pieces of personal information had leaked after suspicious access to their policyholder-only and quotation websites. The leaked information included policyholders' names, addresses and phone numbers.

At Aioi Nissay Dowa, the last four digits of credit card numbers were also included, although security codes were not leaked, according to TBS News. The three companies are all subsidiaries of MS&AD Holdings, Japan's largest non-life insurance group. With the latest additions, the series of leaks has now topped the one million mark.

A wider wave of Japanese breaches

The MS&AD leak is part of an unusually heavy run of cyberattacks on Japanese companies. SMBC Consumer Finance, part of Sumitomo Mitsui Financial Group, announced on 5 November that data on up to 320,118 people had leaked after unauthorised access to its loan guarantee system, which was detected on 2 November. The records included names, birth dates, addresses, driving licence numbers, annual incomes and loan guarantee amounts.

Nissan Financial Services, a subsidiary of Nissan Motor, also announced that up to about 236,000 pieces of policyholder information may have leaked after an outsourced service provider suffered unauthorised access. NTT Docomo separately announced that about 300,000 customer records had leaked through unauthorised access to its online shop and other services.

A common thread runs through several of the cases: attackers reaching customer data through contractors and outside service providers rather than the companies' own core systems. In the MS&AD case, the group confirmed leaks both through unauthorised access at an outside contractor and through suspicious access to its own websites, raising questions about access controls and auditing at suppliers.

What happens next

The insurers are expected to press ahead with notifying affected customers and bolstering call centres, but with the number of leaked records now above one million, the burden of handling inquiries and compensation measures could grow further. Regulators in Japan have tightened scrutiny of personal information protection, and market watchers have raised concerns about rising response costs and the time needed to restore trust.

Customers of the affected insurers should be wary of unsolicited calls, messages or emails that quote their policy or vehicle details, since the leaked information could be used in phishing attempts. The companies have said they will contact affected customers individually once the scope of the leak is fully established, and that no secondary harm from misuse of the data has been confirmed so far.