Japan's Sagawa Express says up to 53.23 million parcel records may have leaked

Sagawa Express Co., one of Japan's largest parcel delivery companies, has told customers that up to about 53.23 million sets of personal information linked to its online parcel tracking service may have been compromised, a figure that ranks among the biggest exposure counts ever announced by a Japanese logistics firm. The company, part of SG Holdings, published the number in a notice issued on October 23, 2026, roughly three weeks after it first confirmed that an outside party had reached into the system.

The service at the center of the case is the Parcel Inquiry Service, the web tool that shoppers, senders and recipients use to check where a package is and when it will arrive. Sagawa said it detected unauthorized access to that service on September 30, 2026 and moved to cut off parts of its internet based operations. Online tracking, which had been halted since the detection, was restored on the same day the record count was published.

The exposed material is the ordinary paperwork of daily commerce: names, addresses and telephone numbers of people who sent or received parcels, plus email addresses registered with the company's Smart Club membership program and details tied to corporate customers holding freight service contracts. Sagawa has stressed that credit card information and sign-in passwords for the tracking service were not part of the exposure, a detail that limits, but does not remove, the risk to the people named on those waybills.

Key Facts

The company's October 23 notice puts the ceiling at about 53.23 million sets of personal information. Kyodo News reported on October 23, 2026 that the figure covers names and addresses associated with up to 53.23 million shipments handled through Sagawa's tracking service. The company said the count includes a considerable number of duplicate records, because the same sender or recipient can appear on many waybills across a three month window, and that it is still organizing the data to determine how many individuals are actually involved.

The window is narrow and specific. The Japan Times reported on October 24, 2026, citing Jiji, that the affected waybill details cover parcels handled from June 21 to September 30, 2026, a span of about 100 days that matches the period the tracking system retains waybill data. Xinhua reported on October 23, 2026 that the potentially compromised information includes names, addresses and telephone numbers of parcel senders and recipients, email addresses registered with Smart Club, and information related to corporate customers with freight service contracts.

Sagawa confirmed the unauthorized access on September 30, 2026 and partially suspended its internet based services to prevent further damage. Japan Cyber Watch reported on October 23, 2026 that the company restricted access the same day, said on October 1 that personal data may have leaked and suspended nine web services, and on October 5 published an FAQ stating that it had reported the breach to the Personal Information Protection Commission and consulted police, with a third party organization conducting the investigation. On October 9 the company said it had found no impact on other systems or on group companies.

Eight services remain suspended as of the October 23 disclosure, including the tracking API that businesses rely on, online requests for package pickup, and the function that lets recipients change a delivery location or time. Tracking itself is back. Sagawa has said it still does not know how the attackers got in, that it will notify affected people in turn, and that where individual contact is difficult the public notice will serve as notification. The final report to the regulator will be filed jointly with the shippers that use Sagawa.

The disclosure also sets a boundary around what was not taken: no credit card data, no login passwords for the tracking service. Records containing only a company name, and parcels sent with handwritten waybills, are excluded from the count. Sagawa has removed some duplicates from the total but says many remain, so 53.23 million is not a count of people and not a count of records confirmed to have left the company. Japan Cyber Watch described the count as the largest of any breach disclosed in Japan this year.

Analysis

The most striking number here is not the 53.23 million, it is the 100 days. Sagawa's exposure is bounded by how long its tracking system keeps waybill data, which means the blast radius of a single intrusion into a customer facing lookup tool was determined months earlier by a routine retention setting. A shorter retention window, or one that strips personal fields from records once a parcel is delivered, would have shrunk this incident before it happened.

The second notable feature is the shape of the data rather than its volume. Names, addresses and phone numbers are not credentials, and the absence of card numbers and passwords keeps this out of the most damaging category of breach. What it does hand an attacker is a verified, recent mapping of people to physical addresses and phone numbers, tied to a delivery relationship that makes follow up contact plausible. That is the raw material for convincing phishing calls and for parcels sent to real addresses under false pretexts.

What this really means is that the risk has migrated from the account to the doorstep. Consumers are trained to watch for password reuse and card fraud, and Sagawa has correctly said neither is at stake. The exposure instead supports impersonation that plays out over the phone and at the front door, where no two factor prompt intervenes and where the recipient has every reason to believe the caller already knows their address. Publishing a figure before publishing a cause is understandable under disclosure pressure, but it leaves customers unable to judge whether the hole is closed or merely unwatched.

Why It Matters

Scale matters because of where it sits in the national ledger. The Personal Information Protection Commission now holds a case that will test how much detail it demands when a company reports a number it cannot yet defend as a count of people. Sagawa went from detection on September 30 to a number on October 23, and in between it gave the regulator and the police what amounts to a placeholder: a breach confirmed, a scope unknown, a cause unidentified.

The eight suspended services matter separately from the leak. Small businesses that built order status pages and customer notifications on top of Sagawa's tracking API have now been without it for more than three weeks, and the company has not said when it will return. A breach in a lookup tool has become an availability problem for the merchants who depend on it, which is the part of the incident that spreads outward through the supply chain.

The duplicates question matters too, because it will shape how the public reads the final figure. If 53.23 million sets resolve into far fewer individuals, the headline will look inflated in hindsight; if they do not, the same number will look understated as a measure of harm. Either way, the company has already told customers that the published count is provisional, which is honest but also an admission that the first number the public heard was not a measurement of anything in particular.

Next Up

Sagawa is expected to keep working through the record set to strip out duplicate entries, file its final report to the Personal Information Protection Commission jointly with the shippers that use its network, and notify affected individuals in turn. Watch for the identification of the entry point, which the company has said it still does not know, and for the return of the tracking API and the other seven suspended services.

The wider question is whether the case shifts behavior at other Japanese logistics and retail firms running similar lookup tools on similar retention schedules. With prefectural police forces and private companies already reporting intrusions this year, and with a security firm pointing to a China linked AI agent behind Japanese cyberattacks, the industry's next move will be judged less on whether another breach is disclosed than on how quickly the companies holding waybill data decide they no longer need to keep it.