Japan's Sagawa Express says personal information linked to up to 53.23 million shipments may have been compromised after unauthorized access to its online parcel-tracking service, in what would be the largest breach count reported in the country this year.
The major parcel delivery company disclosed the possible scale of the leak on Friday, following a follow-up investigation into an intrusion it first confirmed on September 30. Sagawa said the figure includes a significant number of duplicate records, and that it is still working out the exact number of people affected.
What was exposed
According to the company, the records at risk include the names, addresses and phone numbers of people who sent or received parcels between June 21 and September 30, as listed on shipping labels. Email addresses registered with its Smart Club members-only service may also have been exposed, along with the names, addresses and phone numbers of corporate customers holding shipping rate agreements.
There is some reassurance in what was not taken. Sagawa said no credit card information was exposed, and sign-in passwords for the tracking service were not compromised. The company has apologized for the considerable inconvenience and concern caused to its customers.
A breach confirmed weeks ago
The timeline stretches back nearly a month. Sagawa confirmed the unauthorized access on September 30 and partially suspended its internet-based services to prevent further damage. The parcel-tracking service resumed on Friday, though some other services remain suspended for the time being.
The company has urged customers to stay alert, and the disclosure lands as Japan's government steps up its response to a wave of cyberattacks. Prime Minister Sanae Takaichi pledged on Friday to address the growing threat, with her ruling party submitting emergency proposals to accelerate cybersecurity measures across government agencies.
Japan's record breach year
The Sagawa figure tops a grim leaderboard. A weekly review of Japan's cybersecurity incidents put Sagawa's 53.23 million records at the top of the year's disclosures, ahead of breaches at game publisher Capcom, email delivery services and retailers. The same review counted 37 breaches of one million records or more in Japan so far in 2026, up from 29 just a week earlier.
The surge is not limited to parcel deliveries. In the same week, developers of PHP, the widely used programming language behind countless websites, released emergency patches for two critical vulnerabilities rated 9.2 out of 10 in severity, prompting companies and municipalities to take websites offline as a precaution.
For Sagawa, the work now is counting the real victims behind the headline number. Because the same names appear on many shipping labels, the 53.23 million figure counts records, not people, and the company says the true number of affected customers will be lower. Until that count is complete, millions of Japanese households are left wondering whether their address and phone number were swept up in the country's biggest data leak of the year.
By Hamza Faisal
