SHINDO5

Tokio Marine Direct

Tokio Marine Direct Insurance Co., Ltd.

Special-care data~4,300peopleof ~16,000 people affected in total

LEAK UNCLEARHealth / medical / treatment / Call recordingsLoss · Closed (final report)

Open in the live monitor ▶
Disclosed
Dec 23, 2025
Detected
Sep 2025
Detection to disclosure
113 days
Leak
Unknown
Type
Loss
Status
Closed (final report)
Security spend
Not checked yet
Compensation
Not announced

What leaked

Communications & contentCall recordings
IdentityFull name, Date of birth
ContactAddress, Phone number
Transactions & activityVehicle information
Special-care dataInjury information

How many

  • Customers and accident parties whose personal data was recorded ~16,000 people
  • Including sensitive injury information ~4,300 people

Who is affected

  • Customers
  • Other parties to accidents

Cause

One optical disc holding call recordings between claims staff and customers or other parties to accidents went missing

Timeline

  1. Start of the recording period
  2. End of the recording period
  3. Found in late September 2025 when staff tried to check call recordings
  4. Date of the Security NEXT report

Response

  • Forensic investigation

What you should do

  1. Health data can't be taken back. Don't answer blackmail; call the police (#9110) or the consumer hotline (188)
  2. Call audio leaked. Watch for impersonation using your voice and agree a code word with family
  3. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  4. Watch for unexpected mail or invoices; your address is hard to change
  5. You can be affected without ever using this service (parcel recipients etc.). Check any notice you receive
  6. Check the company's notice to see if you're affected

Lessons for companies

  1. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  2. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources