Suntory Holdings has confirmed that an unauthorized third party downloaded files from an external cloud service used by the Japanese beverage group, exposing names and email addresses of about 90,000 Suntory group and partner company employees along with smaller sets of customer and job applicant data. Across all affected groups, the exposed records add up to more than 106,000 entries.
The company disclosed the breach on November 2 in a notice issued jointly by Suntory Holdings and Suntory Beverage & Food. Suntory says it has cut off the unauthorized access, reported the incident to Japan’s Personal Information Protection Commission, and started contacting affected people individually.
Six days from detection to disclosure
According to Suntory’s timeline, the company detected abnormal activity in the external cloud service on October 28, blocked the access the same day, and identified the names of the files that had been taken. On October 29, it confirmed that some of those files contained personal information. It filed a preliminary report with the regulator and began notifications on November 2.
Suntory has not named the cloud service, explained how the attacker gained access, or said whether the provider itself was compromised. No ransomware or extortion group has publicly claimed the incident.
Who is affected
The largest group by far is staff. Suntory lists the personal information it had confirmed leaked to a third party as of November 1:
- Employees: names and email addresses of about 90,000 employees of the Suntory group and of partner companies
- Program members: email addresses of 7,323 customers registered for the company’s corporate activity experience program as of the end of 2023
- Job applicants: applicant portal data, including names, email addresses and phone numbers, for 7,173 people who applied to Suntory Holdings’ 2026 new graduate business recruitment
- Business contacts: names and phone numbers of 1,097 group and business partner employees stored on 2 company mobile phones at Suntory Beverage Solution
- Subsidiary data: names, email addresses and phone numbers of 324 employees and partner staff at Monte Bussan, delivery location data for 96 customers and couriers of Izutsu Maisen, and names and job titles of 25 employees at Suntory business partners
Suntory says none of the exposed data includes credit card or other payment information, and that it has not confirmed any misuse of the information so far. Its online health product store, Suntory Wellness, separately said it had found no leak of its own customers’ personal data at this stage.
Why employee email lists matter
A list of 90,000 corporate names and work email addresses is not as sensitive as Social Security numbers or medical files, but it is valuable to attackers. It gives them a ready-made target list for spear phishing, business email compromise, and fake invoice scams aimed at Suntory and the many partner companies whose staff appear in the files. Matching names to addresses also makes impersonation of colleagues and suppliers far more convincing.
The applicant and contact data carries similar risks. Recruitment-themed phishing, where attackers pose as a hiring team and ask candidates for identity documents or bank details, is a common follow-up to leaks of applicant portal information.
Another week, another Japanese breach
Suntory’s disclosure landed on the same day that Paycloud Holdings said the breach of its Arara Message email delivery service may have exposed about 77 million email addresses. Japanese companies have been reporting incidents at a steady clip, including the Club Tourism member records breach and the GMO Internet cloud desktop breach.
Cloud services used by large enterprises for file sharing and collaboration have become a favored target because a single set of stolen credentials or a single misconfigured share can expose data from across an entire corporate group. Suntory’s notice does not say which of those scenarios applies here.
What affected people should do
Suntory says it is continuing its investigation and will publish any new facts that need to be disclosed. People who receive notification from the company should be cautious with unexpected emails or calls that mention Suntory, its subsidiaries, or recruitment, and should verify any request through official channels before responding. Our guide on how to respond when you receive a data breach notification walks through the next steps.
Suntory’s full notice is available on its official website (in Japanese).
