Sagawa Express Data Breach: What Was Exposed

In short: Sagawa Express, a major Japanese parcel delivery company, disclosed on October 23, 2026 that up to 53.23 million records of personal information may have leaked after unauthorized access to its parcel tracking system. The exposed data can include names, addresses and phone numbers tied to shipments, but not credit card numbers or passwords, and the company says the 53.23 million figure overstates how many individual people are affected because of duplicate records.

Sagawa Express is one of Japan's largest parcel delivery firms, handling shipments for both individual customers and corporate clients. On October 23, 2026, it announced that unauthorized access to its parcel tracking system may have exposed tens of millions of records. Here's what's confirmed, what isn't, and what an affected person should do right now.

What happened to Sagawa Express's parcel tracking system?

Sagawa Express confirmed on September 30, 2026 that its Parcel Inquiry Service "had been accessed without authorization by a third party," and it partially suspended online services as a precaution, Xinhua reported. The public disclosure of the scale came on October 23, 2026. Since then, the delivery tracking service has resumed, though "some other services will remain suspended for the time being," Nippon.com reported.

Which personal details were in the leaked shipping records?

The exposed information can include "names, addresses and telephone numbers of parcel senders and recipients, as well as email addresses registered with the company's membership service, Smart Club," and data tied to corporate freight customers, Xinhua reported based on the company's statement. Sagawa Express said "no credit card information or sign-in passwords for the tracking service were exposed." The affected shipment data covers labels from June 21 through September 30, 2026, along with Smart Club and corporate client records, according to the same report.

Why doesn't 53.23 million equal 53.23 million people?

Sagawa Express has said up to 53.23 million records may have leaked, but that number is not the number of people affected. The company "cautioned that the figure includes a considerable number of duplicate records and does not represent the number of individual people affected," and said it is still working to determine the precise figure, Xinhua reported. Jiji Press reported the same caveat, noting that "the number of potentially compromised personal information sets does not necessarily reflect the number of affected customers, as there are many overlaps among the senders and recipients listed on the shipping labels," since the same person can appear repeatedly as a sender or recipient across different shipments, according to Nippon.com.

What hasn't Sagawa Express said yet?

Sagawa Express has not named an attacker or hacking group, and the method of intrusion has not been disclosed. As of the latest update tracked by Westeria's incident page, the cause was still under investigation with a third-party specialist organization, and it was not yet public whether a software vulnerability was exploited. The exact number of people affected, as opposed to records leaked, also has not been finalized. As of the company's fourth status report, the same page notes, no confirmed misuse of the leaked information had turned up.

Checklist: what to do now if you shipped with Sagawa Express

Act now, even before the full scope is confirmed:

• Expect phishing emails, texts and phone calls impersonating Sagawa Express. The company itself has urged customers to be wary of suspicious messages claiming to come from it, and not to click included links or enter personal information, according to Westeria's tracking page.
• Do not click delivery-notification links from unexpected senders, even if they reference a real tracking number — verify shipments directly through Sagawa Express's own service instead.
• Change your password on any account where you reused your Smart Club password, even though Smart Club passwords themselves were not part of the exposed data, since reused passwords elsewhere could still be at risk.
• Watch your email, phone and mail for unexpected account activity, since names, addresses and phone numbers tied to shipments were exposed and can be used to impersonate you or target you more convincingly.
• Learn the common warning signs of breach-related phishing attempts, covered in this guide on how to spot phishing after a data breach.
• If you live in a country that offers one, consider a credit warning or freeze with the official registry — Denmark's CPR office, for example, lets residents register a credit warning that flags lenders before credit is granted in your name.
• Keep an eye on official Sagawa Express communications for updates, since the company says it is still finalizing the precise number of people affected.

Could this exposed data be used against me directly?

The exposed categories — names, addresses, phone numbers and, for some, email addresses — are enough to make phishing messages look convincing, even though no passwords or credit card numbers were part of this leak, per Xinhua's report, and bank account information was also excluded, according to Westeria's tracking page. That lowers the risk of someone draining a financial account directly from this data alone, but raises the risk of scam messages that reference real shipment or contact details to appear legitimate. No misuse of the data has been confirmed so far, according to Westeria's incident page, though that could change as the investigation continues.