2026 NYK Group — marine fuel procurement system intrusion (employee & partner PII; Mar–Apr)
Data compromised
Names, company names, phone numbers, emails (employees and partner employees per notice)
Technical writeup
On April 9, 2026, NYK Line (Nippon Yusen Kabushiki Kaisha) published an English notice stating that on the afternoon of March 24, 2026, it detected unauthorized access to a marine fuel procurement system used by the NYK Group, with certain data—including personal information—accessed and exfiltrated. The company isolated the system, suspended use, restored service on March 27, 2026, and reported to Japan’s Personal Information Protection Commission, other authorities as applicable, and police on March 31, 2026. NYK stated there was no evidence of encryption or financial demands. Potentially affected fields for NYK employees (including former) and business-partner employees included names, company names, telephone numbers, and email addresses. Victim counts were not enumerated in the initial public notice.
Root cause
Unauthorized access to operational procurement system (attribution not stated in official notice)