Sagawa Express data breach
Was I affected?
Sagawa Express confirmed a breach involving up to 53.2 million records (duplicates possible), exposing names, addresses, phone numbers and email addresses. You may be affected if you sent or received a Sagawa parcel with a printed or online-created label between June 21 and September 30, 2026, have a freight contract with Sagawa, or have a Smart Club account.
| Announced | Sep 30, 2026 |
|---|---|
| When it happened | Detected September 30, 2026 |
| Country | Japan |
| Records exposed (may include duplicates) | 53.2 million |
| Data exposed | Names, Addresses, Phone numbers, Email addresses and Other details |
| Status | Confirmed by the company or a regulator filing |
What happened
Sagawa Express, one of Japan's largest parcel carriers, said on September 30, 2026 that an outside party had gained unauthorized access to the parcel tracking service on its website. On October 23 it said personal information in up to 53.23 million records (duplicates included) may have leaked, which Japan's Tokyo Shoko Research says is the largest count ever reported by a listed Japanese company or its subsidiary. The records cover senders' and recipients' names, addresses and phone numbers from shipping labels handled between June 21 and September 30, 2026, contract customers' details, and Smart Club members' names, addresses, phone numbers, email addresses and member IDs. The figure is not a count of people, and handwritten shipping labels, credit card data and passwords were not included. Sagawa said it had found no misuse of the data as of October 23.
What should I do?
- Expect fake 'missed delivery' texts and emails that use Sagawa's name; don't tap links in them, and check parcel status by typing Sagawa's address yourself or using the official app.
- Never enter passwords, card numbers or one-time codes on a page you reached from a delivery text or email.
- Be wary of calls that quote your name, address or phone number to sound official; hang up and call Sagawa's published number instead.
- If you have a Smart Club account, watch the email address you registered for phishing and change any password you reuse elsewhere.
Check the other services you use →
Sources
- 「お荷物問い合わせサービス」の再開および 個人情報の流出に関する調査状況について（第5報） (Tracking service restored and investigation update, 5th report) · Sagawa Express (in Japanese) · official
- 佐川急便の個人情報漏えい、過去最多の5,323万件 (Sagawa Express leak is the largest on record at 53.23 million) · Tokyo Shoko Research (in Japanese) · news
- 佐川急便「お荷物問い合わせサービス」に不正アクセス 第4報 (Unauthorized access to Sagawa tracking service, 4th report) · ScanNetSecurity (in Japanese) · news