-3.png?w=1024)
A series of cyberattacks involving one of Japan's largest insurance groups has pushed its reported data exposure past 1 million records, with the latest incidents affecting both an outside service provider and a business information portal.
MS&AD Insurance Group subsidiaries Mitsui Sumitomo Insurance and Mitsui Direct General Insurance disclosed approximately 296,000 additional records on Nov. 9, bringing the group's combined total to about 1.01 million.
According to Kyodo News, the latest findings follow approximately 715,000 records reported by group companies through Nov. 6.
The incidents involve separate systems, and investigators have not established whether they are connected.
Third-party breach exposes 273,000 insurance records
Most of the newly disclosed information came from a cyberattack against Prestige Core Solution, a third-party provider handling roadside assistance services for insurers.
In a Nov. 9 disclosure, Mitsui Sumitomo said the provider detected unauthorized access on Oct. 29 and notified the insurer on Nov. 4.
The breach exposed approximately 228,000 Mitsui Sumitomo customer records. Including Mitsui Direct customers, the incident affected approximately 273,000 records.
According to Mitsui Sumitomo, the exposed information included:
- Customer names, addresses, and telephone numbers
- Vehicle registration and identification numbers
- Accident and vehicle breakdown assistance records
Mitsui Sumitomo said its affected records did not include credit card or bank account information. The insurers have not confirmed any misuse of the exposed data.
The incident highlights the risks of storing customer information with external providers, similar to the ManoMano third-party breach that reportedly affected nearly 38 million customers.
Separate MS Compass attack exposes 23,000 records
Mitsui Sumitomo also disclosed unauthorized access to MS Compass, its information portal for small and midsize businesses.
According to the insurer's official announcement, suspicious activity detected between Nov. 2 and 3 exposed approximately 23,000 records.
The affected information included company names, employee contact details, job titles, business addresses, annual sales, and employee counts.
Mitsui Sumitomo restricted access to affected systems on Nov. 3 and temporarily shut down the MS Compass website on Nov. 6.
The insurer is working with external security specialists to investigate the intrusion. No connection to the roadside assistance breach has been established.
How the reported exposure reached 1.01 million records
The Nov. 9 disclosures add to earlier incidents involving unauthorized access to policyholder-facing systems across MS&AD subsidiaries.
Those incidents exposed different types of customer information, including names, contact details, vehicle information, and insurance policy records.
Incident or disclosure | Reported records |
|---|---|
| Earlier MS&AD disclosures, through November 6 | 715,000 |
| Roadside assistance provider breach | 273,000 |
| MS Compass business portal breach | 23,000 |
| Combined total | 1,011,000 |
Source: Kyodo News and Mitsui Sumitomo Insurance disclosures, November 6–9, 2026.
The figures represent records reported across separate incidents, not necessarily 1.01 million unique individuals.
The disclosures also underscore the potential impact of third-party compromises. In another incident, a Frontline Education breach exposed information belonging to more than 1.3 million people through a vulnerability in external software.
What affected customers should do
Although the insurers have not confirmed misuse of the exposed information, customer and vehicle details could potentially be used for targeted phishing or impersonation scams.
Mitsui Sumitomo has warned customers to remain cautious of suspicious emails, text messages, and telephone calls claiming to represent the company.
Affected customers should:
- Verify unexpected messages by contacting their insurer through official channels.
- Avoid suspicious links requesting passwords, payment information, or other sensitive details.
- Watch for personalized scams referencing actual vehicles, policies, or roadside assistance requests.
- Check official notices for updates on affected services and customer notifications.
The insurer said it would contact affected customers individually as preparations are completed.
Multiple incidents highlight third-party security risks
The MS&AD disclosures show how customer information can be exposed through different systems serving unrelated business functions.
For security teams, the roadside assistance incident reinforces the importance of monitoring external providers, limiting the customer information they retain, and establishing clear breach notification procedures.
The MS Compass intrusion also highlights the need to protect business-facing portals that store employee contact details and corporate information.
These concerns extend beyond insurers. Organizations should regularly assess third-party security risks and supply chain vulnerabilities to identify weaknesses that could expose customer information.
Investigations into the MS&AD incidents remain ongoing, and the companies have not established a common cause linking the separate breaches.
In other cybersecurity news, mSecure has urged customers to change passwords, reset two-factor authentication, and review passkeys following a security incident in which an encrypted customer database was reportedly stolen.