[Data Leaks Keep Coming] A Mail With Your Name Isn't Proof It's Real | Nine Bodies Issued Alerts in October

Hello! I'm Shemhazai, the sentinel.
Today: with data-leak news arriving one after another, how do you decide whether an email you received can be trusted?

The short answer: a mail with your own name on it is not necessarily real. Do not click the link. Check through the official app, or a site you opened yourself.

Today's example. On 14 October 2026 the National Cybersecurity Office published a page collecting the alerts of nine bodies, opening with "leaks of personal information through unauthorised access are occurring one after another across a wide range of businesses and organisations" (the NPA, the Personal Information Protection Commission, the FSA, the Ministry of Internal Affairs and Communications, METI, IPA, NICT, JPCERT/CC and the Office itself). The individual alerts are dated 7 to 13 October.

In its report for September, published on 19 October, the Council of Anti-Phishing Japan wrote: "In September, announcements of information leaks from cyberattacks followed one after another. The link with each leak is unknown, but phishing mail with the recipient's name in the text has been confirmed."

First, what is known and what is not. Known: government bodies are warning in unison, and the Council has confirmed phishing mail that includes names. Not known: whether those named mails were built from information stolen in these leaks. The Council itself says the link is unknown. So "the name is right, so it's real" and "a leak means fake mail will arrive" are both claims no one can make for sure.

What the NPA asks of individuals

• ▸Do not casually click links in mail. The NPA's Cyber Police Agency Letter (October 2026, Vol.19) says: "it may be a fake mail posing as the company the information leaked from"
• ▸Set a strong password and do not reuse it. The same letter says multi-factor authentication such as one-time passwords is also effective
• ▸If anything seems off, report or consult the police. Your nearest police station, the cybercrime consultation desk, or the police advice line #9110 (Japan; NPA)
• ▸The letter also recommends the NPA-recommended app (a free anti-scam-call tool). For details, see the NPA page in "Pages we relied on" below

What can happen after a leak

• ▸1. A company announces that data may have leaked. IPA writes that financial institutions, telecom operators and a wide range of other businesses have been announcing leaks one after another (9 October)
• ▸2. Opportunistic mail arrives. The NPA writes "it may be fake mail posing as the company the data leaked from", and the Council has confirmed phishing mail with names in it
• ▸3. The link leads to a fake site. If you type what the mail asks, your ID, password or card details are stolen. The Council says that in September many mails posed as order or delivery notices, refunds, payment information, contract renewals, fraud-detection alerts, identity checks and point-expiry notices
• ▸4. A reused password opens other services. The NPA says "do not reuse" because once one is stolen, the same combination can be tried on other services (our note)

If ID document images have leaked

On 9 October the FSA wrote to financial institutions that "cyber incidents have occurred in which customer information, including images of identity documents such as driver's licences, has leaked." Because impersonation methods are getting more sophisticated, it asks them to check document images and face photos thoroughly for anything unnatural during non-face-to-face identity checks.

One more point concerns you. Under an amendment to the Act on Prevention of Transfer of Criminal Proceeds rules, from 1 April 2027 sending an image of an ID document is abolished as an identity-check method and unified, in principle, around reading the IC chip. The FSA calls this "extremely effective as a fraud countermeasure" and asks institutions to act as soon as possible rather than wait for that date. From the FSA's wording, when you can choose how to verify your identity for an account or card application, reading the IC chip resists impersonation better than sending an image of the document (our reading).

What you can do today

• ✓★Do not click the link in an email or text that says "your data leaked" or "please confirm". Check in the official app already on your phone, or on an official site you open from a bookmark or search (this is how to follow the NPA's "do not casually click links"; the exact steps are our note)
• ✓Do not trust a message just because your name is in it. The Council has confirmed phishing mail with names. A name is no proof
• ✓Stop reusing passwords. Start with your email account, bank, credit cards and shopping sites, where the damage would be largest (our ordering). Turn on multi-factor authentication where it is offered (NPA)
• ✓Check the official announcements of the companies you use. If one concerns you, read it on the company's official site or app. Even if the notice email is real, do not click; check that the same notice is on the official site (our note)
• ✓If you can choose how to verify your identity, choose reading the IC chip. The FSA calls it extremely effective against fraud
• ✓If you hear about an account, card or contract you do not recognise, do not leave it. See "Where to get help" below

If you already typed into a fake site

• ▸1. Change the password for that ID right away. Do it in the official app or on a site you opened yourself. Then change the same password on other services (our note)
• ▸2. If you typed a card number, contact the card company. Use the official number printed on the back of the card, not one in the email (our note)
• ▸3. Also consult the police. The NPA says to consult your nearest police station, the cybercrime consultation desk or the police advice line #9110 if anything seems off
• ▸The NPA letter does not give a specific order for changing passwords. Steps 1 and 2 are our notes

Spot-the-scam quiz

Picture this.

Three lines to send your family

• ▸Data-leak news keeps coming. Do not click links in emails or texts saying "your data leaked" or "please confirm". A name in the message does not make it real (NPA, Council of Anti-Phishing Japan)
• ▸★Check through the official app on your phone or a site you opened yourself. Do not reuse passwords. Turn on multi-factor authentication where you can
• ▸If you clicked, typed something, or feel unsure, call the police advice line #9110 (Japan). For contract or billing trouble, Consumer Hotline 188

Where to get help (Japan)

If you are not sure whether something is a scam, or you typed into a suspicious email or site, contact your nearest police station, the cybercrime consultation desk, or the police advice line #9110. If you are being harmed right now, call 110 (based on NPA guidance; our note). These are services within Japan.

For contract or billing trouble, call the Consumer Hotline 188. It connects you to your local consumer affairs centre.

What I could not confirm

• ▸Whether the named phishing mail was built from information stolen in these leaks. The Council says the link is unknown. I cannot confirm it
• ▸The overall picture of these leaks (how many companies, how many people, which data). The National Cybersecurity Office page collects each body's alert and does not give a total
• ▸The details of individual leaks. This article does not cover a specific company's leak. Check the official announcements of the companies you use to see whether one concerns you
• ▸The NPA letter gives no order for changing passwords and no concrete steps after typing into a fake site. Those parts of this article are marked as our notes
• ▸Which institutions let you choose IC chip reading, and for which procedures. The FSA document describes the planned unification but not each institution's status

Pages we relied on