From our other sites
The story
Since late September 2026, a string of corporate data breaches has come to light one after another: Times Car (about 6.6 million records, roughly 1.6 million of which included images of ID documents such as driver’s licenses), the yakiniku chain Yakiniku Kingu (about 10.79 million records), and Lawson (about 2.15 million records). In the past, the standard response to this kind of incident — a practice kicked off by the 2004 Yahoo! BB leak — was to hand victims a 500 yen gift voucher as an apology, but that kind of cash gesture has become much less common in recent years. On 5ch, opinions varied: some suspected companies now prioritize lobbying the media and politicians over compensating victims, while others argued that leak volumes have grown by orders of magnitude, making cash compensation no longer realistic.
October 12, 2026, 11:03 PM
Naigai Times
Since late September 2026, companies have been disclosing one unauthorized-access incident and personal-data leak after another. Times Car had about 6.6 million accounts’ worth of data exposed, roughly 1.6 million of which included images of ID documents such as driver’s licenses. Yakiniku Kingu saw about 10.79 million customer records leaked, and Lawson about 2.15 million.
Source: news.livedoor.com / Original article here
What people said
The reality of the "electronics superpower"
Cyberattack hits refrigeration systems at hundreds of French supermarkets — temperature spikes to 50°C, forcing mass disposal of food [Shōkō-san★]
https://asahi.5ch.io/test/read.cgi/newsplus/1791854997/
There are countries where the My Number itself got leaked, and people are still this lax about it.
Well, it's clearly not getting buried lol
Management's already preparing their exit. Because the LDP and big companies have spent years pushing the idea that "people who sue are scum" in Japan, everyone's staying weirdly quiet even over something this massive, lol. In the US or Europe this would be a multi-trillion-yen lawsuit.
My personal info is worth so little, 500 yen would practically be too much change back.
“As a token of our humblest apology…”
“Please note that winners will only be notified by receiving the prize in the mail.”
It starts with the politicians. And politicians are backed by companies with deep pockets. Rather than handing small one-time payments to a huge number of people, if you're going to spend money anyway, it's much safer for the company to funnel a large sum to a handful of politicians instead. This only works because the LDP has stayed in power so long — if the ruling party kept changing, problems would surface later and the company would be finished. The LDP's long reign is exactly why this scheme holds up.
The email I got from Skyticket was exactly like that 💧 Basically “we'll be more careful going forward,” plus a smug “your credit card info wasn't leaked though” (said with a real punchable smirk).
Wait, so does that mean everyone actually gets one if you push it?
Mailing out a postcard was about the extent of what the company was willing to spend.
Does it never occur to you that you could just… not use it?
Apparently though, even after a reissue, all that changes is a “1” gets tacked onto the end of your license number — reissue again and it becomes 2, 3, 4… and after 9 it just loops back to 1. Just by looking at the card, you can't tell the old one's been invalidated. For something only used as basic ID, that's no obstacle at all for someone trying to impersonate you, since nobody actually cross-checks it the way police would.
I don't use it myself — I don't really care about points or anything like that.
Your personal situation is beside the point here — this is about the premise of the discussion.
Leaving driver's license images just sitting on a server is basically begging to be robbed.
Well, this is the same Ministry of Health, Labour and Welfare that thought building the COVID contact-tracing app once meant the job was done forever — truly an “IT kingdom.”
“Personal information protection”? What's that? Does that even exist in developed countries?
But doesn't that just mean going on the offensive to steal data in return?
Well, officially it's only under the premise that the other side attacked first.
And on top of that, attackers hijack innocent third parties' systems to launch their attacks, so you can't actually tell who's really behind it.
So honestly, the real mentality is just: if you suspect someone might be an enemy, hack them first.
Background and key points of this debate
These “apology vouchers” are not a legal obligation — they’re simply a goodwill practice companies use to settle things informally. The classic example is the 500 yen voucher handed out after the 2004 Yahoo! BB leak, back when breach sizes were still small enough for that kind of response to be workable. In recent years, though, leak sizes have grown by an order of magnitude — from the hundreds of thousands into the millions or even tens of millions — and now sometimes include sensitive data like driver’s license images, making equivalent cash compensation unrealistic for companies to offer. On the thread, opinions split between those who wanted companies to invest in preventing harm and future breaches rather than handing out token vouchers, and those who felt even a symbolic gesture of compensation was better than nothing. Commenters also pointed out that Japan still lacks clear laws spelling out penalties or compensation for data leaks, which they saw as part of why these incidents keep repeating.
※This article is compiled and summarized from the 5ch (Breaking News+) thread “It used to be a “500 yen voucher”… So why have corporate data-breach apology gifts disappeared?”
Leave a Reply