Criminals Are Watching Japanese Breach Announcements
One of the study’s clearest findings was a direct correlation between when Japanese companies disclosed security incidents and when posts appeared on dark web forums naming those same companies.
The researchers found at least seven posts on a single English-language forum advertising customer data from Japanese IT and transportation companies, companies that had announced data breaches between mid-September and late October 2026. Some posts named specific organizations and expressed explicit interest in buying their data.
“It appears that criminals monitor announcements from Japanese companies,” said an engineer at Mitsui Bussan Secure Directions. “There seems to be a new demand for leaked information.”
This timing isn’t accidental. When a company announces a breach, it’s essentially advertising that sensitive data exists, is probably already in circulation, and may not yet be fully secured. For dark web buyers and sellers, that announcement is a signal to look for the data — and for anyone who already has it, a cue to price it and post it.
The same pattern has been documented in how supply chain attacks and early dark web signals precede public disclosure. The timeline from breach to dark web listing is often shorter than the timeline from breach to company disclosure.
What Was Being Sold and What It Cost
The price points recorded in the study show how dark web data markets work in practice.
A specialized marketplace traded credit card information for $24 per record. On a Chinese-language site, 28 sets of Japanese driver’s license images, including supporting documents like auto insurance papers, were listed at $84 each.
One English-language post claimed to be selling data on 11 million customers: email addresses, names, and phone numbers. Sellers were directing buyers to Telegram for negotiations, the standard channel for data deals that need more anonymity than forum posts alone provide.
The driver’s license figure is particularly significant. As we’ve covered in the 153 million driver’s license breach through IDScan.net, identity documents are worth more than financial credentials on their own because they can’t be canceled like a credit card or reset like a password. A Japanese driver’s license with supporting documents provides a complete identity verification package that can be used for account opening, loan applications, and other high-value fraud.
Sellers take time to analyze and price data before listing, the engineer noted. “As sellers take time to analyze and price leaked data, the trade of leaked data is likely to become more active in the future.” The more supplementary data attached, the fuller the profile, the higher the sale price.
Passwords Are Losing Their Value. This Is Actually a Problem.
One of the more counterintuitive findings from the study is that usernames and passwords are becoming worth very little on these markets. Some sellers were offering them for free as promotional material.
The reason is multi-factor authentication. As more organizations and consumer services have adopted MFA, a username-and-password combination alone is no longer enough to access most accounts. Criminals are recognizing this.
The same post that noted declining credential values pointed to the logical response: a shift in demand toward more durable data, full identity documents, biometric information, session tokens, and account-level access rather than raw credentials.
This connects directly to what we’ve been tracking in the synthetic identity fraud market: the demand has shifted from stolen passwords toward richer identity packages that can bypass MFA entirely. Japanese driver’s licenses at $84 per set show what that demand looks like in practice.
Japan Has Had a Series of High-Profile Breaches
The study’s findings land in the context of a documented wave of Japanese corporate security incidents in 2026.
Earlier this year, Keio Corporation, one of Tokyo’s major private railway operators, was hit by ransomware that disrupted its hotel and payment systems, as we reported in our Keio Corporation breach coverage. Tokyo Metro separately disclosed that 59,000 member email addresses were accessed the same weekend. Both are exactly the kind of IT and transportation sector companies the dark web posts were targeting, according to the Mitsui Bussan study.
Japan has also been building its defenses. The Active Cyber Defense Law, passed in 2026, gave Japanese organizations and government entities new authority to proactively monitor for cyberattack indicators. Fujitsu launched a dark web monitoring service in partnership with KELA specifically to help Japanese enterprises detect credential exposure before attackers can use it.
But the Mitsui Bussan study suggests the threat environment is moving faster than many organizations’ defenses. When criminals monitor breach announcements and list stolen data within the same news cycle, the gap between incident and exploitation is measured in days.
The Cat-and-Mouse Problem
Law enforcement agencies worldwide continue to fight dark web markets, seizing servers, taking down domains, and disrupting infrastructure. The problem is what the Mitsui Bussan study described as a cat-and-mouse pattern: for every marketplace taken down, similar platforms emerge to replace it.
We’ve seen this directly in Operation Alice’s takedown of 373,000 dark web sites, a record-breaking operation that shut down platforms used for illegal data trading. Despite that scale, researchers immediately noted that new infrastructure would emerge. The economics are too favorable, and the barrier to launching a new dark web marketplace is too low.
The dark web intelligence market has grown to over $920 million in 2026 precisely because organizations are recognizing that waiting for law enforcement to take down markets isn’t a security strategy. Monitoring your own data in those markets, finding out when your credentials appear, is the only approach that creates an actionable response window.
What the Study Recommends
The engineer from Mitsui Bussan Secure Directions was direct about what Japanese companies need to do. “A series of cyberattacks have exposed the security vulnerabilities of Japanese companies, making them more vulnerable to further attacks.”
Their recommendations:
Gather the latest threat intelligence through cybersecurity firms and monitoring services rather than relying on inbound incident reports. By the time an alert reaches you through traditional channels, the data is already circulating.
Thoroughly inspect your own systems for vulnerabilities, especially after any public breach announcement from companies in your sector. The study shows criminals specifically target similar organizations after a disclosure.
Raise awareness among employees and business partners. The human element- phishing, credential theft, social engineering- remains a primary initial access vector for the breaches that end up on dark web markets. If your personal data is already in Japanese dark web listings, the practical steps match broader exposure response: monitor for unexpected account activity, enable MFA everywhere it’s available, and treat your identity documents as particularly high-value. Our guide on what to do when your data is on the dark web covers the full response checklist.
Frequently Asked Questions
What did the Mitsui Bussan study find?
Criminals actively monitor Japanese company breach announcements and post stolen data for sale on dark web forums within days of a disclosure. At least seven posts named specific Japanese IT and transportation companies that had disclosed breaches.
How much does Japanese data cost on the dark web?
Credit card information: $24 per record. Japanese driver’s licenses with supporting documents: $84 per set. Full customer datasets (names, emails, phone numbers) are negotiated privately via Telegram.
Are passwords still valuable on the dark web?
Less so. Sellers noted that as multi-factor authentication becomes more common, usernames and passwords alone are losing value; some were offered for free. Demand has shifted toward more complete identity documents and account access.
Why is Japan specifically being targeted?
A series of high-profile breaches in Japan’s IT and transportation sectors has created a known supply of stolen data and signaled to criminals that Japanese organizations have exploitable vulnerabilities. Each breach announcement creates demand for similar data.
What should Japanese companies do?
Proactively gather threat intelligence, audit systems for vulnerabilities (especially after sector peer announcements), and train employees and partners on cybersecurity risks.
