Our company's official social media account or business account has been hijacked. What should we do legally? The Unauthorized Access Act and data-breach reporting in Japan, for businesses

Question

阿部国際法律事務所 · Accepted Answer

Hijacking an account with someone else's ID and password is a crime under the Unauthorized Access Act (up to 3 years' imprisonment or a JPY 1 million fine). Recover the account, enable multi-factor authentication, preserve evidence and consult the police; if personal data may have leaked, consider reporting to the PPC and notifying individuals.

Logging in to an account with someone else's user ID and password without permission is "unauthorized access" prohibited by the Act on Prohibition of Unauthorized Computer Access, punishable by imprisonment of up to three years or a fine of up to JPY 1 million (Articles 3 and 11). If a company account is hijacked, the first priorities are to recover the account and stop the damage spreading, preserve evidence, and consult the police. If customers' personal data may have been viewed or sent through the hijacked account, the company may need to report to the Personal Information Protection Commission and notify the individuals (Act on the Protection of Personal Information, Article 26). Because the reports have deadlines, it is important to decide early who in the company is responsible.

Typical situations

- The company's official social media account has been hijacked and is posting investment solicitations or fake promotions.
- Someone logged in to an employee's email account and sent business partners emails giving false bank details.
- There are signs that someone logged in from abroad to the admin screen of the company's online shop or members' site and viewed customer data.
- A former employee who still knew the password kept logging in to a company account after leaving.

1. Crimes involved in account hijacking

Entering another person's user ID and password, without permission, to log in to a service protected by access controls is prohibited as unauthorized access (Unauthorized Access Act, Article 3). The penalty is imprisonment of up to three years or a fine of up to JPY 1 million (Article 11).

Acts leading up to the login are also punishable. Obtaining another person's ID and password for use in unauthorized access (Article 4), storing IDs and passwords that were obtained illicitly (Article 6), and posing as a service operator through a fake website or email to ask users to enter their ID and password (phishing, Article 7) are each punishable by imprisonment of up to one year or a fine of up to JPY 500,000 (Article 12). Giving another person's ID and password to a third party without a business or other legitimate reason is also prohibited (Articles 5, 12(ii) and 13).

If a former employee or former contractor logs in to a business account without the company's permission, this can also be unauthorized access. Knowing the password is not the same as having permission.

2. What the company should do immediately

The first few hours determine how far the damage spreads.

- Use the platform's account recovery procedure and change the password. Change it on every other service that uses the same password.
- Turn on multi-factor authentication (verifying identity with a second factor in addition to the password), and review linked apps and logged-in devices, removing any that are not needed.
- Save screenshots of posts, messages sent and settings changed after the hijacking, in a form that shows the date, time and URL. Also keep login notification emails and access history.
- Use the company website or another account to announce the hijacking and ask people not to open links in suspicious posts or messages.
- Consult the police (the cybercrime consultation desk of the prefectural police) and consider filing a damage report.

3. Reporting and notification where personal data may have leaked

If personal data, such as message histories with customers or member information, may have been viewed or sent through the hijacked account, the company should consider the data-breach reporting rules under the Act on the Protection of Personal Information.

A business handling personal information must report to the Personal Information Protection Commission, and notify the individuals, when a leak or similar incident occurs that is likely to seriously harm individuals' rights and interests (Article 26(1) and (2)). This includes leaks of personal data caused by acts that may have been carried out for a wrongful purpose, and in that case the number of people affected does not matter (Enforcement Rules, Article 7(iii)). Leaks of personal data that could cause financial harm if misused (such as credit card numbers) and leaks affecting more than 1,000 people are also covered (Article 7(ii) and (iv)).

Reporting has two stages. After becoming aware of the incident, the business must promptly report what it knows at that point (Enforcement Rules, Article 8(1)), and within 30 days of becoming aware of it, or 60 days where a wrongful purpose may be involved, it must report the full details (Article 8(2)). The individuals must also be notified promptly as the situation allows (Article 10). Note that the obligation applies once a leak "may have" occurred, even if it has not been confirmed.

4. The company's own account management

The Unauthorized Access Act asks access administrators, who manage IDs and passwords, to make efforts to manage them properly and to take protective measures (Article 8). Where a company runs its own members' site or internal systems, the company itself is the access administrator.

On 29 October 2026 the Personal Information Protection Commission opened public comment on draft revisions to the security-control measures in its APPI Guidelines (General Rules) and related guidelines (comments close on 27 November). The drafts would add a general prohibition on reusing the same ID and password, and multi-factor authentication, to the examples of security measures. Although they are still drafts, they are a useful reference when reviewing internal account management.

5. Holding the perpetrator liable

If the person who hijacked the account is identified, the company can claim damages (Civil Code, Article 709). Possible losses include harm to the company's reputation from fake posts and the cost of dealing with fake promotions.

If the perpetrator is unknown, there is a procedure for requesting disclosure of sender information from the social media operator or other provider (Act on Responding to Infringement of Rights Caused by the Distribution of Information through Specified Telecommunications, known as the Information Distribution Platform Act, Article 5). Disclosure requires, among other things, that the infringement of rights is evident, and providers keep logs only for a limited time, so it is important to act quickly.

What you can do now

- List all social media, email, cloud and admin accounts the company uses, and check who manages them and what permissions they have.
- Turn on multi-factor authentication for every business account and stop reusing passwords.
- Set a procedure to change passwords and remove permissions whenever someone is transferred or leaves.
- Put the contacts (PR, IT, legal, management) and the first steps for an account hijacking on a single page.
- Make sure the people responsible know how to decide whether a data leak must be reported, and the deadlines.

When to consult a lawyer

- Customers' or business partners' personal data may have been viewed or sent through the hijacked account.
- Business partners or customers have suffered, or may suffer, financial loss, for example from false bank details.
- You suspect a former employee or former contractor logged in without permission and are considering legal action.
- Fake posts have damaged the company's reputation and you are considering identifying the perpetrator or claiming damages.

Frequently asked questions

Q. Who files the damage report when a company account is hijacked?
The company, as the party entitled to use the account, can consult the police and consider filing a report. Having screenshots and login history showing when and how the account was taken over will make the consultation smoother.

Q. The hijacked account sent messages to customers. Do we need to report to the Personal Information Protection Commission?
If personal data such as message histories may have been viewed or obtained for a wrongful purpose, the incident can be reportable even if few people are affected (Enforcement Rules, Article 7(iii)). The initial report must be made promptly, and the full report in this case within 60 days.

Q. A former employee logged in to a business account after leaving. Is that a problem?
If they logged in without the company's permission, it can be unauthorized access (Unauthorized Access Act, Article 3). Having known the password while employed is not the same as permission. Review your procedure for removing access when people leave.

Q. If fake posts from the hijacked account harm third parties, is the company liable?
The posts were made by the perpetrator, so the company is not necessarily liable. However, failing to warn people after becoming aware of the hijacking, or clearly inadequate password management, could be raised against the company. Prompt warnings and good records are important.

Q.Our company's official social media account or business account has been hijacked. What should we do legally? The Unauthorized Access Act and data-breach reporting in Japan, for businesses

Related Questions

Q. What is the typical compensation for online defamation in Japan?

Q. How can I identify an anonymous online poster?

Q. A former employee left a 1-star Google Maps review calling our company a "black company" with a boss who habitually power-harasses. Can we request deletion and identify the poster?

Related Articles

Online Defamation: How to File a Sender Disclosure Request in Japan

Legal Remedies for Revenge Porn in Japan

Free Tools