SMBC Consumer Finance data leak affects up to 320,000 customers. November 6, 2026 (Mainichi Japan) TOKYO (Kyodo) - SMBC Consumer Finance Co. said Thursday that personal information of up to 320,000 customers had been leaked following unauthorized access to a system used for loan guarantees and other services, making it one of a growing number of Japanese companies to report major data breaches. The leaked information included driver's license numbers, names, addresses, phone numbers, email addresses, annual income and contract details, according to the company, a subsidiary of Sumitomo Mitsui Financial Group Inc. No images of identification documents, such as driver's licenses, were included. The company detected the unauthorized access on Monday following an investigation and confirmed that the data had been transmitted to external parties. The incident comes amid a series of data breaches at Japanese companies, including a number linked to unauthorized access to systems operated by email distribution service provider Arara Inc. Sumitomo Mitsui Banking Corp. said Thursday that around 227,000 customer email addresses had been leaked, while Mitsui Fudosan Co. and a subsidiary of NTT East Inc. also reported breaches. Sumitomo Mitsui Banking said the breach affected recipients of emails sent between July 1 and Oct. 31. The bank was notified by Arara on Monday. Mitsui Fudosan said 133,323 email addresses registered for &BIZ, a newsletter distributed to employees of office tenants, had been leaked. The company has suspended the newsletter until it can confirm its security. NTT TownPage Corp., an NTT East subsidiary providing online phone directory and other services, reported a leak of 142,126 email addresses belonging to customers who received its newsletter between Oct. 8 and 31. Monteroza Co., which operates the Shirokiya izakaya chain and other businesses, had also said that personal information of more than 620,000 newsletter subscribers, including email addresses and dates of birth, may have been leaked. Electronics retailer Bic Camera Inc. and major workwear retailer Workman Co. are among other companies that have confirmed data breaches linked to the unauthorized access to Arara's system. Other Japanese companies have also reported data breaches linked to unauthorized access to systems operated by a separate email distribution service provider, Ymirlink Inc. Among them, Central Japan Railway Co., West Japan Railway Co. and Kyushu Railway Co. said 172,735 personal information records, including email addresses and names written in katakana, had been leaked from the Shinkansen reservation services Smart EX and Express Reservation. The companies announced the breach on Oct. 26. Around 475 million instances of suspicious online activity were detected in October, mainly targeting websites of Japanese companies, according to a private-sector survey. The record figure was 2.5 times that of a year earlier and up about 21 million from September. Cyber Security Cloud Inc., which provides security services to around 20,000 websites, analyzed unauthorized communications detected through its services. It found that monthly detections, which had ranged from 100 million to 200 million from January 2025 through May 2026, jumped to around 400 million in June. Monthly detections have remained elevated since July, ranging from 200 million to 400 million. The company said the increase may be driven by the growing use of artificial intelligence to automate cyberattacks. Chief technology officer Yoji Watanabe said failing to fix software security flaws makes systems more susceptible to cyberattacks. He said the time between the discovery of a software vulnerability and a subsequent cyberattack is shrinking. "It is extremely important to clearly recognize the risks," Watanabe said.