Japan Data Breaches 2026: What Happened at Skyticket and Muji

October 2026 proved to be one of the most turbulent months for corporate cybersecurity in Japan. Within weeks of each other, online travel agency Skyticket and retail household name Muji disclosed major security incidents that collectively exposed more than 40 million user records. These disclosures arrived during the same wave of intrusions that impacted major logistics, food service, and entertainment providers across the country.

While database intrusions capture headlines with massive numbers, the initial theft is rarely where consumer damage stops. For millions of registered users, the greatest financial hazard arrives during the second wave of attacks: brand-impersonation phishing. When cybercriminals obtain authentic customer email lists, they gain the exact tool needed to launch convincing scams disguised as official corporate communications.

Japan’s 2026 Breach Wave in Context

The incidents at Skyticket and Muji were not isolated events. October 2026 saw an unprecedented wave of cybersecurity disclosures across Japanese retail, transportation, gaming, and software sectors. Many of these incidents originated through third-party software, administrative back ends, or exposed application interfaces rather than direct perimeter breaches.

As reported by Jiji Press via Nippon.com, Sagawa Express alone showed how widely personal contact details spread across public delivery networks. To understand broader systemic vulnerabilities across domestic enterprises, review our list of cybersecurity best practices for operational defense recommendations.

The Skyticket Data Breach: What Happened

Adventure, Inc., the Tokyo-listed operator behind Skyticket, revealed that attackers gained unauthorized access to internal systems across three distinct vectors.

Timeline and Scope

Adventure confirmed three separate operational security failures:

1. Server and Cloud Storage Intrusion: Attackers manipulated administrative functions on Skyticket between October 2 and October 4, 2026, gaining visibility into internal company servers and cloud databases. The intrusion was discovered on October 5.
2. Business Management System Compromise: An intrusion exploiting an unpatched software vulnerability took place on September 20 and was identified on September 28, targeting administrative accounting records.
3. Bus Booking Configuration Flaw: Between August 3 and October 1, booking-completion pages on the platform’s bus reservation portal were accessible without login authentication. Automated scripts viewed approximately 12,000 reservations before engineers corrected the permissions on October 1.

Adventure reported the incidents to Japan’s Personal Information Protection Commission (PPC) and began emailing affected users on October 8.

What Data Was Exposed

The main cloud intrusion affected roughly 14.64 million customer records. Compromised information included customer names (including passport-style romanized spellings), dates of birth, email addresses, phone numbers, postal addresses, and bank transfer remitter names. Roughly 4.13 million of these records contained member passwords stored in hashed form.

While Adventure stated that active credit card numbers and passport images were not stored in its primary flight databases, subsequent disclosures revealed additional risks. On October 28, Adventure confirmed that an unencrypted backup retained in the cloud was also accessed. This backup contained 32,341 bank account numbers registered for customer refunds between March 2022 and May 2024, along with 118,000 travel insurance application records.

Additionally, approximately 936,000 transaction logs with partially masked credit card numbers were involved. In 12 instances, card numbers entered incorrectly into the cardholder name field were saved in plain text. A separate review confirmed that older payment logs from 2018 exposed full credit card data belonging to roughly 6,140 skyticket Premium subscribers. In response, Adventure suspended saved-card transactions and recommended password resets across all member accounts.

The Muji App Data Breach: What Happened

On October 30, 2026, Ryohin Keikaku Co., Ltd., the parent company of lifestyle retailer Muji, disclosed unauthorized external access targeting its official mobile platform, the MUJI App.

The company determined that an unauthorized third party breached the application back end, potentially exposing up to 27.26 million customer records. This total included not only active shoppers but also former members who had previously closed their accounts.

Ryohin Keikaku confirmed that the exposed data was restricted to three specific data points:

• Registered email addresses
• Dates of birth
• Declared gender

Unlike the Skyticket incident, the Muji intrusion did not involve customer names, physical home addresses, telephone numbers, or financial card details. Ryohin Keikaku also clarified that customer accounts for Muji China are maintained on separate, localized server infrastructure and were unaffected.

As of its initial notification, the retailer confirmed that it had not found evidence of the stolen data circulating on dark web marketplaces. However, company leadership issued a direct warning to users: attackers holding genuine customer email addresses often launch deceptive emails that mimic Muji branding.

Notably, Japanese restaurant group Matsuya Foods Holdings disclosed a separate application intrusion on the exact same day, affecting 2.38 million records. The incident also echoed supply chain challenges from October 2025, when a ransomware infection at logistics partner Askul Corporation temporarily paralyzed Muji’s online sales channels and fulfillment centers. 

For organizations reviewing defensive postures against these scenarios, read our guide on how to prevent a data breach to identify common security gaps.

Why Leaked Email Addresses Fuel Phishing

A corporate database breach frequently acts as recon for social engineering. Once a cybercriminal knows that a specific email address belongs to a Skyticket or Muji customer, their phishing campaigns become exponentially more effective.

Instead of sending generic spam to random recipients, attackers craft contextual lures:

• The Urgent Flight Cancellation: An attacker sends an email claiming that a recent Skyticket booking was canceled due to a system malfunction, prompting the recipient to click a link and re-enter payment details.
• The Refund Processing Alert: Exploiting Skyticket’s disclosure of bank refund issues, scammers send fake notifications instructing recipients to verify their bank routing numbers or account passwords on a replica website.
• The Loyalty Compensation Voucher: Posing as Muji, fraudsters send messages offering a complimentary gift card or app points as an apology for the October breach, directing users to credential-harvesting login pages.

Japan’s National Police Agency has repeatedly warned that recipient trust cannot be based on sender names alone. Attackers routinely disguise their identities to match legitimate corporate brands. Reviewing historical case studies of famous phishing attacks and data breaches shows that follow-on phishing frequently inflicts greater financial harm than the initial database theft.

If you suspect your information was included in a recent corporate leak, you can check if your email was exposed through dedicated exposure monitoring directories.

How Email Authentication Limits Brand Impersonation

When cybercriminals impersonate a breached company, they rely on two main tactics: direct domain spoofing and lookalike domain registration. Establishing email authentication standards prevents attackers from abusing brand reputation.

SPF, DKIM, and DMARC

• Sender Policy Framework (SPF): Publishes a list of authorized IP addresses permitted to send email on behalf of a company domain.
• DomainKeys Identified Mail (DKIM): Attaches a cryptographic signature to outbound messages, verifying that the body and attachments were not altered in transit.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): Unifies SPF and DKIM under a single domain policy. When an enterprise configures DMARC with an enforcement policy of p=reject, receiving mail servers automatically drop forged emails that attempt to use the brand’s exact domain in the visible “From” header.
• Brand Indicators for Message Identification (BIMI): Displays an authenticated company logo next to inbound messages in supported consumer inboxes, giving recipients immediate visual proof of sender legitimacy.

The Limits of Email Authentication

DMARC solves exact-domain spoofing, but attackers adapt. When scammers realize a company protects its exact domain with p=reject, they register typosquatted domains (such as skytlcket-support.jp or muji-rewards-app.com). Because the attacker owns the lookalike domain, their SPF and DKIM records will technically pass authentication checks.

Addressing this requires layered monitoring:

1. Exact-domain enforcement via DMARC to secure primary sending channels.
2. Domain threat intelligence to spot deceptive lookalike domains before they launch campaigns.

Understanding these gaps is critical for businesses in the region. According to insights on DMARC adoption in Japan, many leading organizations publish DMARC records but leave policies set to p=none. A p=none policy only monitors traffic without stopping forged emails from landing in users’ inboxes. For a deeper look at domestic deployment standards, see our analysis of DMARC in Japan.

PowerDMARC helps organizations automate SPF, DKIM, and DMARC deployment while moving safely to strict p=reject enforcement. Beyond protocol management, PowerDMARC provides automated alert routing and lookalike domain detection to stop spoofing across typosquatted variants.

What Affected Customers Should Do

If you hold an active or historical account with Skyticket, the MUJI App, or other services caught in the October wave, take these precautions:

• Avoid Embedded Links: Do not click URLs inside emails regarding account alerts, refunds, or system updates. Open a browser and navigate to the official site directly, or use the official mobile application.
• Familiarize Yourself with Red Flags: Review common phishing message red flags such as artificial urgency, mismatched sender addresses, and unexpected attachments.
• Inspect Suspicious Messages: If an email seems questionable, analyze the headers using a phishing email checker before interacting with its contents.
• Change Shared Passwords: Skyticket confirmed that 4.13 million member records contained hashed passwords. If you used your Skyticket password on any other platform, update those accounts immediately with unique passwords and enable multi-factor authentication (MFA).
• Verify Lookalike Addresses: Before submitting credentials on any page, verify that the domain matches the true corporate web address. Use a lookalike domain checker to confirm whether an unfamiliar URL is an authentic enterprise property.
• Monitor Financial Accounts: Review bank and credit card statements closely for unauthorized micro-charges or suspicious refund activities.

Lessons for Businesses

The October disclosures offer critical takeaways for security leaders managing customer-facing applications and digital communications:

• Enforce Aggressive Data Purging: Retaining legacy data creates unnecessary liability. Skyticket’s exposure of payment cards stemmed from records archived in 2018, while Muji’s record count swelled to 27.26 million because former member records were kept long after account cancellation. Regularly prune retired accounts and purge obsolete database backups.
• Audit Administrative Endpoints: Both incidents involved compromises in administrative tools or application back ends rather than sophisticated perimeter attacks. Restrict admin dashboards behind zero-trust network access and mandatory hardware-backed MFA.
• Close Public Application Gaps: Skyticket’s bus booking platform exposed 12,000 itineraries because order-completion pages failed to enforce user session checks. Integrate continuous API testing and access-control reviews into CI/CD deployment pipelines.
• Enforce DMARC Before Experiencing an Incident: Establishing a p=reject policy prior to a breach ensures that attackers cannot hijack your exact domain to deceive customers during crisis communications.
• Establish Transparent Notification Channels: Publish verified sending addresses and clear policies outlining what your support teams will never ask for (such as credit card numbers or banking PINs via email).

Frequently Asked Questions

What data was leaked in the Skyticket breach?

The primary incident affected roughly 14.64 million records, containing names, dates of birth, emails, phone numbers, addresses, and 4.13 million hashed passwords. An unencrypted cloud backup also exposed 32,341 bank refund details, 118,000 travel insurance records, and older payment logs containing credit card details for 6,140 Premium users.

Was credit card information exposed in the Muji breach?

No. Ryohin Keikaku confirmed that credit card numbers, customer names, street addresses, and phone numbers were not involved. The MUJI App exposure was strictly limited to email addresses, birth dates, and gender data across up to 27.26 million active and closed accounts.

How can I tell if an email from Skyticket or Muji is real?

Check the sender domain carefully and inspect inbound messages for official digital signatures. Legitimate company notices will not request your banking PIN, password, or credit card details over email. When in doubt, navigate to the brand’s official website directly rather than clicking links inside messages.

Why do data breaches lead to more phishing?

Exposed email databases give scammers targeted recipient lists of confirmed brand customers. Attackers exploit this context by creating convincing fake messages about account verifications, breach compensations, or booking cancellations, significantly increasing the probability that recipients fall for the scam.

Can DMARC stop breach-related phishing?

DMARC set to p=reject completely stops attackers from sending emails using the company’s exact domain in the visible “From” header. However, DMARC cannot block emails sent from lookalike or typosquatted domains, which requires domain monitoring and brand threat intelligence.

Final Thoughts

The October 2026 security disclosures at Skyticket and Muji highlight how digital breaches create an immediate, two-stage crisis. While securing servers, purging deprecated backups, and closing application back-end vulnerabilities resolve the first stage, protecting customer communication channels handles the second.

When cybercriminals weaponize stolen email lists, organizations must ensure their domains cannot be used against their own customers. Implementing DMARC at full enforcement shuts down direct domain impersonation and restores trust in corporate communications.

Evaluate your domain security posture today: use our free Domain Analyzer to inspect your SPF, DKIM, and DMARC records and ensure your brand remains protected.