SHINDO4

Ministry of Agriculture, Forestry and Fisheries

Staff and family members4,571people

LEAK CONFIRMEDMy Number / SalaryMisdelivery · Investigating

Open in the live monitor ▶
Disclosed
Jan 26, 2026
Detected
Jan 19, 2026
Detection to disclosure
7 days
Leak
Leak confirmed
Type
Misdelivery
Status
Investigating
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityName, Date of birth
ContactAddress
ID documentsMy Number
Employment & HRSalary paid and income tax withheld
Financial & paymentInsurance premium deduction information

How many

  • Staff and family members 4,571 people

Who is affected

  • Staff
  • Staff family members

Cause

Staff were given the wrong email address for submitting payroll documents, so the data went to an unintended third party

Timeline

  1. Detected
  2. First disclosure

Response

  • Staff training
  • Change process

Plans staff training on handling personal data and measures to prevent recurrence

What you should do

  1. ID numbers can never be changed. Request your credit file from CIC, JICC and others and look for contracts or loans you didn't make
  2. Register a self-declaration (honnin shinkoku) with the credit bureaus so lenders check applications in your name more carefully. The stronger loan self-restriction scheme also blocks your own borrowing and can't be withdrawn for 3 months. Neither stops bank accounts being opened
  3. Watch for unexpected mail or invoices; your address is hard to change
  4. Expect targeted phishing posing as HR or interview contacts
  5. Check the company's notice to see if you're affected

Lessons for companies

  1. Use DLP: recipient checks, send delay, automatic attachment protection
  2. Don't keep ID or bank data: delete after checks or use a KYC provider
  3. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  4. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources