Personal data relating to around 100,000 people leaked from an external cloud service used by Suntory Holdings, which disclosed on 2 November 2026 that a third party had reached the service without authorisation and downloaded files, some of which held personal information. Suntory blocked the access, reported the leak to Japan's Personal Information Protection Commission, and started contacting affected people one by one. At the time of the notice, the company had not confirmed any misuse of the information. The disclosure comes from the company itself rather than from an attacker claim, and the figures below come from the company notice and established reporting of it.
The notice itself is the main source for the detail below. Suntory's own notice, published on 2 November 2026, sets out the affected groups, the dates and the data types. Kyodo News reported the disclosure the same day and gave the same rounded total of around 100,000 people affected.
The same day also brought a separate, much larger disclosure from Paycloud Holdings, covering about 77 million email addresses from its Arara Message email distribution service. That incident involves a different company, a different system and a different set of victims. Only the Suntory incident is covered here.
Affected groups and exposed data
Around 100,000 is the company's own rounded figure. The notice gives a figure for each group, confirmed as of 1 November 2026. It says nothing about whether one person might appear in two or more groups. The group figures below are therefore stated exactly as the company gave them, with no separate total calculated from them.
Employees are the largest group. About 90,000 employees of Suntory group companies and affiliated firms had names and email addresses included in the leak, according to the notice. Kyodo News reported the same employee figure. Nippon.com, carrying Jiji Press reporting, confirmed it as well as the exact figures for the two groups that follow. A work email address beside a real name lets a sender address a message to an identifiable person at an identifiable organisation.
Next are people registered for a corporate activity experience programme, put at 7,323 people registered as of the end of 2023. Email addresses are the only item listed for them. No names, phone numbers or other items appear for this group in the notice. Then come applicants for Suntory Holdings' 2026 new graduate recruitment process, in the business division open selection across the early and regular rounds, put at 7,173 applicants. Their leaked material is described as applicant portal registration information, including names, email addresses, phone numbers and other items. That broader company wording governs this group, because early wire reporting described the applicants by names alone while the notice itself lists email addresses and phone numbers among the items.
The notice closes with four smaller groups. Suntory Beverage Solution held names and phone numbers for 1,097 people on two company mobile phones, covering Suntory group and business partner employees. Monte Bussan and partner companies account for 324 employees, with names, email addresses and phone numbers. A delivery service of Izutsu Maisen accounts for 96 people, with names and delivery destination location information. Business partners of Suntory account for 25 employees, with names and job titles.
| Affected group | People | Data leaked |
|---|---|---|
| Suntory group and affiliated firm employees | About 90,000 | Names and email addresses |
| Corporate activity experience programme registrants, as of end 2023 | 7,323 | Email addresses |
| 2026 new graduate recruitment applicants, business division | 7,173 | Portal registration details including names, email addresses and phone numbers |
| People listed on two Suntory Beverage Solution company phones | 1,097 | Names and phone numbers |
| Monte Bussan and partner company employees | 324 | Names, email addresses and phone numbers |
| Izutsu Maisen delivery customers and delivery employees | 96 | Names and delivery destination location information |
| Suntory business partner employees | 25 | Names and job titles |
One exclusion in the notice is stated plainly. Credit card and other payment information is not part of the leaked personal information, according to Suntory. No card number or payment credential is reported in this leak. Names, email addresses and phone numbers are enough material for targeted messages, and the employee and recruitment details give those messages a plausible organisational context.
Dates of detection and disclosure
Suntory detected unusual activity in the external cloud service on Wednesday 28 October 2026. It blocked the unauthorised access that day. It also started an investigation and identified the names of the leaked files. The notice supplies this dating and the rest of the sequence below. On Thursday 29 October 2026, the company confirmed that part of the leaked files contained personal information. The figures are those confirmed as leaked by Sunday 1 November 2026. On Monday 2 November 2026, it filed an initial report with the Personal Information Protection Commission and began contacting affected people individually.
Three points about the sequence are left unstated in the notice. It does not say when the unauthorised access began. It does not say how long the access lasted before detection on 28 October. It does not say how the attacker gained access.
One detail in the reporting needs care. Kyodo News calls the affected system Microsoft's cloud service. Suntory's own notice calls it only an external cloud service used by the group. No source retrieved for this article names which Microsoft cloud service was involved. This article does not assume that detail. The system is therefore reported here as Kyodo's attribution, set beside Suntory's broader description.
Company response and regulatory report
The notice sets out four parts to the response. They are blocking the access, investigating the downloaded files, reporting to the regulator, and contacting affected people. Suntory said it has taken necessary measures to prevent further harm. It reported to the Personal Information Protection Commission on 2 November 2026. Individual contact with affected people began the same day. The notice also carries an apology for the concern and inconvenience caused. Suntory said its investigation is continuing and that it will disclose further facts promptly if any emerge.
The notice names no attacker. It attributes the incident to no particular group. It describes no vulnerability or misconfiguration. It says nothing about whether the downloaded files have been recovered or deleted. It says nothing about whether any affected person appears in more than one of the seven groups. The public account is incomplete for now on all of those points.
The regulatory step puts the incident on the formal record. An initial report to the Personal Information Protection Commission records that a leak occurred and that the regulator has the matter on file. Further reports may follow as the investigation establishes the access method and the full scope.
Guidance for affected people
The core exposure is the same across the groups, in different forms. It is a message that uses a real name, a real employer or a real application to gain trust. The measures in this section are general measures for people whose details appear in a breach, as described in the linked guides below, not instructions issued by Suntory in its notice. Unexpected messages that mention Suntory, a recruitment application or a business relationship are treated with caution under that general practice, and a request for credentials, payment or personal details is verified through a channel found independently, not through a link or number inside the message itself. A breach notice is itself usable as a phishing template, because an attacker who knows the breach happened can copy its wording and its subject matter.
How phishing uses a leaked email address describes the mechanism in detail. A leaked address lets an attacker target a known person with a plausible pretext. The pretext improves as more context about that person leaks alongside the address.
Checking whether an address appears in a known breach is a separate step. How to check if an email address was leaked explains the check and what a match does and does not prove. A match confirms the address appears in a breach corpus. No match does not prove the address is safe, because a breach may not yet have reached a public database. Have I Been Pwned is a widely used public check of this kind, and an address can be searched there directly.
Password practice matters where an address was reused across services. Where the same password protected another account, changing that password and enabling two-factor authentication reduces the value of any credential pairing an attacker might attempt. This applies even though Suntory has not reported passwords among the leaked items. Does changing your password stop hackers sets out what a password change does and does not achieve after a leak. Where a reused password has already let someone into an account, how to recover a hacked email account covers regaining control of it.
Using a different email address for every website limits the same problem at its source, because a leak from one service then exposes only the address used for that service. The measure does not undo the Suntory leak, and it does not protect a work address that an employer controls.
Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Open questions from the investigation
The investigation continues, and several questions stay open on the current public record. The access method is undisclosed. The specific Microsoft cloud service is unspecified beyond Kyodo's attribution. The duration of access before detection is unstated. The fate of the downloaded files is unreported. Suntory has said it will disclose further facts promptly if they emerge. The confirmed facts are the groups, the figures and the data types stated in the company's own notice, the exclusion of payment data, and the absence of confirmed misuse at the time of the notice. Those facts are the basis on which affected people can assess their own exposure while the investigation continues.
Top comments (0)