Sagawa Express (佐川急便), one of Japan's largest parcel carriers, says up to about 53.23 million records containing personal information may have leaked after a third party gained unauthorized access to its web-based Parcel Inquiry Service (お荷物問い合わせサービス). The figure comes from the company's fifth incident report, issued on October 23, 2026. Xinhua, IT Kisyakai and Japan Cyber Watch all report the same number. Sagawa stresses that the count still contains a "considerable number" of duplicate records and is not a count of affected people. It also says the figure is a maximum of potentially exposed records, not a count of records confirmed to have left its systems. Japan Cyber Watch describes it as the largest breach count disclosed in Japan this year. Sagawa has still not said how the attackers got in, and no threat actor has been named.
What Happened
- September 30, 2026: Sagawa confirmed that a third party had accessed its Parcel Inquiry Service without authorization. It cut off external access to its internet freight system and suspended part of its web services. Aikido Community counts nine suspended services in total, including the tracking API, online pickup requests and recipient-change functions. Pickup and delivery carried on as normal.
- October 1: A second notice said customer personal information may have leaked. According to SecOpsNomad, that notice gave no count and did not say data had actually been taken.
- October 5: Japan Cyber Watch reports that a Sagawa FAQ said the breach had been reported to Japan's Personal Information Protection Commission (PPC).
- October 9: Japan Cyber Watch reports that the fourth notice found no impact on other systems or group companies. In that notice Sagawa also said it would hold back a number until duplicate records had been sorted out.
- October 15: Unicharm's direct shop told its customers that delivery details for orders shipped through Sagawa since late June were "highly likely" to be in scope, and said it had filed its own preliminary report with the PPC. Japan Cyber Watch reports that other shippers, including the city of Yokosuka, have sent similar warnings.
- October 23: The fifth report gave the 53.23 million figure and announced that web-based parcel tracking had been restored after a security review with outside specialists. Eight services are still suspended: the tracking API, Hikyaku Takuhaibin booking, Hikyaku round-trip booking (standard and golf), the product-recovery refund service, both recipient-change functions, and "Kaishu-kun".
What Was Taken
Sagawa's fifth report, as reproduced by IT Kisyakai, lists three categories of data that may have been exposed:
- Waybill data for parcels handled from June 21 to September 30, 2026, about 100 days, which Sagawa says matches the system's retention period. This covers the names, addresses and phone numbers of senders and recipients. Unicharm adds that its affected customers' parcel tracking numbers were also included.
- Contract customer lists (customers with freight-rate contracts): name, address and phone number.
- Smart Club members: name, address, phone number, email address and Smart Club member ID.
All sources agree that credit card data and passwords were not involved. Parcels sent with handwritten waybills are excluded. Records about corporate customers are counted if they include an identifiable individual, such as a contact person's name; records holding only a company name are not counted.
On volume, the sources do not disagree. They all cite the same company figure of up to about 53.23 million records, duplicates included. The number of people affected is still unknown. Sagawa has not published a per-category breakdown, and it says the waybill data in particular contains many repeat entries and spelling variants of the same person. Work to merge duplicates (名寄せ) is continuing.
Why It Matters
- Phishing and smishing material on a national scale. Names, home addresses and phone numbers, matched to real recent shipments and in some cases tracking numbers, are exactly what attackers need for convincing "delivery failed" texts. Japan already sees heavy volumes of parcel-themed smishing. Unicharm says no secondary harm has been confirmed yet, but it is warning customers about fake emails, texts and calls claiming to be from Sagawa or Unicharm.
- Third-party exposure. Any retailer, municipality or business that shipped through Sagawa during the window has customer data in scope without having been breached itself. Unicharm's and Yokosuka's notices show the disclosure duty spreading down the supply chain.
- Part of a wider pattern. On October 8, JPCERT/CC warned of a wave of large breaches at Japanese organizations since around September, according to Japan Cyber Watch. Japan Cyber Watch has covered Sagawa alongside Times Car, Yakiniku King, Seicomart, infoQ and others. SecOpsNomad counts at least ten Japanese companies this autumn that said data left through apps, APIs or lookup pages, and lists a parcel lookup among them. A Macnica analysis cited by Japan Cyber Watch counts 119 similar web breaches disclosed in Japan this year.
The Attack Technique
Not disclosed. As of the fifth report, Sagawa has not said how the attackers got in, and no source attributes the incident to a named actor. Anything beyond that is analysis, not confirmed fact:
- Scope of the data does not match what the website shows. Aikido Community notes that the public tracking page shows about 60 days of data, while about 100 days are in scope. It argues the attacker reached a back-end data layer, limited by one application's permissions, rather than just scraping the visible lookup. The same permission limits would explain why passwords and card data were out of reach. It reads the nine-service shutdown as the area Sagawa could not rule out, not as proof that all nine were compromised. This is the outlet's inference.
- Patterns in the wider breach wave. JPCERT/CC's warning, as summarized by Japan Cyber Watch, describes four techniques across the wave: scanning for known vulnerabilities and exposed files, abuse of internal APIs often found by analyzing public smartphone apps, exploitation of a Metabase SQL injection flaw, and web shells hidden in WAR files on Java application servers. JPCERT/CC has not tied any of these to Sagawa specifically.
- SecOpsNomad maps Sagawa to its "parcel lookup" category of API leaks. It says plainly that these mappings are its own reading of company statements, not confirmed root causes.
What Organizations Should Do
- Check what your public lookup endpoints can reach. For every tracking, order-status or member lookup, confirm that its service account can read only the records and time range it actually shows. Remove database permissions that go beyond what the page displays.
- Test every API that returns personal data for broken object-level authorization. Sign in as customer A and request customer B's record, then repeat with no login at all. Include mobile-app back ends, old API versions and test hosts. Enforce rate limits and access control on every endpoint, and use short-lived tokens, in line with JPCERT/CC's guidance.
- Hunt using JPCERT/CC's indicators. Search web, WAF and API gateway logs for the attacker IP addresses and User-Agent strings JPCERT/CC published. Check Java application servers for unexpected WAR deployments or web shells, and patch Metabase and other BI tools that face the internet.
- Review carrier data retention as a third-party risk. Find out what customer data your logistics partners keep and for how long. Add breach-notification clauses and retention limits to your contracts.
- Prepare for smishing that follows the breach. If you shipped through Sagawa between June 21 and September 30, 2026, decide whether you have to notify the PPC and your customers. Warn customers about delivery-themed scams and tell them which official channels you actually use.
- Plan containment by shared infrastructure. Map which web services share authentication, API and database layers, so a confirmed compromise in one service can be contained quickly across all of them, as Sagawa had to do.
Sources: Japan's Sagawa Express says up to 53.23 mln personal data records m... | 「お荷物問い合わせサービス」の再開および 個人情報の流出に関する調査状況について（第5報）：佐川急便 - ＩＴ記者会Report | Sagawa Express Data Breach in Japan: 100 Days of Parcel Sender and... | Sagawa Express: when a parcel-tracking lookup puts 100 days of deli... | 9サービスを止めたのに、漏れたのは一部データ — 佐川急便の不正アクセスを権限の境界から読む Aikido Community | JPCERT/CC Warning on Japan's Breach Wave: API Abuse, Web Shells and... | Japan's autumn of API leaks: a go-to guide to finding and ... | 配送委託先（佐川急便）への不正アクセスに伴う、お客様の個人情報漏えいのおそれに関するお知らせとお詫び