In October 2026, unauthorized access occurred to a community site operated by Sansan on an external cloud service, resulting in a data leak affecting approximately 10,000 individuals. The background involves the increasing sophistication of cyberattacks targeting vulnerabilities in the peripheral systems and external integrations of SaaS providers, as well as challenges in authentication management within cloud operations.

Key Points of the Incident and the Information Leak Affecting Approximately 10,000 Individuals

In October 2026, it was revealed that unauthorized access and a data breach had occurred in a system on an external cloud at Sansan, Inc., a major business card management cloud provider. The affected target was a community site operated by the company using an external service, and it is suspected that user information and member data for approximately 10,000 registered individuals were unlawfully accessed by a third party. While detailed investigations into the cause and the identification of the scope of impact have been underway since immediately after the discovery, it has been confirmed that the core databases of its core business card management service and invoice management service “Bill One” were not directly breached. However, given that this is a security incident at a leading company driving Japan’s domestic SaaS market, it has caused a major ripple effect in the stock market and among user companies. In recent years, attack methods that use external clouds or third-party tools located on the periphery as stepping stones—rather than targeting the robust core systems of the companies themselves—have been surging globally. This incident can be said to be a textbook example of falling victim to such a security blind spot. Occurring amidst the ongoing digital transformation of enterprises, this incident serves as a critical catalyst for re-evaluating the safety of cloud utilization.

Structure of the external cloud community site that served as the breach path

In this unauthorized access incident, the target of the attack was a community site that Sansan had built and operated using an external SaaS vendor or cloud infrastructure rather than within its own internal infrastructure. Such third-party community platforms are widely adopted to promote user interaction and information exchange, but they tend to have relatively lax management of authentication settings and access permissions compared to main core systems. It is suspected that attackers targeted this administrative gap, illegally acquiring access privileges through methods such as misconfigurations, leaked credentials, or session hijacking. The following illustration shows the relationship between the core system and the external third-party environment.

In many companies, while robust multi-factor authentication (MFA) and monitoring systems are implemented for in-house developed core platforms, the reality is that equivalent security standards fail to be applied to externally procured cloud services used for operational support or community purposes. As a result, external clouds are targeted as the weakest link in the supply chain, leading to a succession of data breaches. This latest incident clearly illustrates just how crucial the integrated management of authentication infrastructure and integration settings truly is.

The affected data area and the scope of impact on the core SaaS infrastructure

Following the discovery of the unauthorized access, the primary concern was the potential impact on confidential data within Sansan’s core SaaS offerings—such as its corporate business card management cloud, which serves as its flagship business, as well as “Bill One” and “Contract One.” Because Sansan holds a market share of over 80% in Japan’s business card management sector and stores corporate data and business network information for more than 9,000 companies, the societal impact of a compromised core database would have been immeasurable. However, according to the investigation results, the breach was confined to a community site independently operated on an external cloud, and no unauthorized access to customer data or business card databases on the core services has been confirmed. Nevertheless, an impact on the stock price and a blow to the brand image are unavoidable, with voices in the stock market warning of adverse effects on future customer acquisition rates and churn rates. Although the scale of the leaked data itself was limited to approximately 10,000 individuals, as a SaaS provider whose core business involves handling customer data, the security incident inherently carries the risk of directly translating into a loss of customer trust. Rather than simply being relieved that the scope of damage was limited, the company is now expected to rebuild governance across its entire brand.

The “Shared Responsibility Model” Shaking the SaaS Industry and Security Blind Spots

The “Shared Responsibility Model” in Cloud Environments: Misconceptions and Reality

The most important principle when using cloud services is the “shared responsibility model,” in which safety management roles are divided between the provider and the user company. In many companies, a fundamental misunderstanding persists: the belief that “if we use a cloud service, the vendor will protect all security.” In reality, what cloud providers are responsible for is the protection of the infrastructure itself, such as physical data centers and virtualization platforms, whereas the management of data stored in the cloud, access permissions, and various settings falls under the user company’s scope of responsibility. Even in the case of SaaS, the user company must assume appropriate management responsibility for account administration, user privilege settings, and the configuration of data sharing scopes. When building community sites or similar platforms using external cloud services, information leaks caused by misconfigurations or lax access control are, in the vast majority of cases, legally judged to be the negligence and management responsibility of the user company. Responsibility cannot be shifted to the vendor, making a correct understanding of the shared responsibility model essential.

Identity (ID) and Access Management (IAM) misconfiguration risks

In recent years, the mainstream of cyberattacks in the SaaS industry has shifted from traditional malware infections to attacks that steal credentials such as IDs, API keys, and OAuth tokens to impersonate legitimate users. In particular, public misconfigurations in cloud storage, unmanaged administrator accounts without multi-factor authentication, and leaked unnecessary API keys have become serious security holes. According to research by specialized organizations, the majority of cloud-related security incidents are caused by “misconfigurations” or “inadequate credential management.” Attackers search for privileged service accounts or vulnerable authentication points, then move laterally within the network to extract large amounts of data. The following diagram illustrates a typical process in which damage expands from misconfigurations and credential theft in a cloud environment.

No matter how robust the encryption technology may be, if IDs and tokens—which serve as the keys to access—are not properly managed, attackers can easily breach the defenses. There is a strong demand for thorough access management based on the “principle of least privilege,” which restricts access rights to the absolute minimum, and the “zero trust” philosophy of continuous authentication.

Increasing Legal Risks and Future Corporate Defense Strategies

The Surcharge System and Mandatory Vendor Oversight under the Amended Act on the Protection of Personal Information

The number of personal data breach reports in Japan is surging, with the number of processed reports reaching a record high of 19,056 in fiscal 2024. In response to this situation, the government decided on an amendment bill to the Act on the Protection of Personal Information at a Cabinet meeting in April 2026, setting forth the establishment of a “surcharge system” for inappropriate data utilization and illegal provision. This is establishing an environment where strict administrative penalties will be imposed for intentional illegal acts and unjust enrichment. Furthermore, under this legal revision, legal obligations such as the “implementation of security control measures” and “immediate reporting in the event of a leak” will be directly imposed on subcontracted business operators as well. Among the 2,248 leak incidents caused by subcontractors, approximately 62.8% are due to unauthorized access, making the management of external subcontractors—such as payment, logistics, and marketing tools—a top priority for corporate management. When companies use external services or subcontractors, they are strongly obligated to conduct regular security audits and conclude appropriate data processing contracts. Companies that neglect the proper handling of personal information will face not only risks of damage compensation and site suspension, but also massive economic and social penalties that threaten business continuity.

Future Developments and Next-Generation Defense Measures SaaS Providers Should Implement

Sansan’s unauthorized access incident involving an external cloud goes beyond being a mere single-company incident, forcing all SaaS providers and cloud-utilizing enterprises to fundamentally review their security postures. Moving forward, SaaS providers will be strictly required not only to defend their own core systems, but also to improve visibility across the entire ecosystem they provide and eliminate supply chain risks. Specifically, this makes it essential to automatically detect misconfigurations in real time using cloud security posture management tools and to strictly restrict access privileges in external service integrations. Furthermore, operating on the premise that it is impossible to completely prevent intrusions, the implementation of MDR and EDR to detect abnormal behavior early and limit damage, as well as the establishment of a 24/7 monitoring system, is indispensable. In the event of an incident, avoiding concealment or delays in public disclosure and providing prompt and highly transparent information disclosure will ultimately serve as the watershed moment for maintaining a company’s brand value and user trust. In the cloud-native era, the establishment of security governance that combines robustness with flexible resilience holds the key to sustainable business growth.

Reference Page

• [2025 White Paper on Information and Communications | Ministry of Internal Affairs and Communications] https://www.soumu.go.jp/johotsusintokei/whitepaper/ja/r07/html/nd218200.html
• [Regarding the Bill to Amend Part of the Act on the Protection of Personal Information, etc. | Personal Information Protection Commission] https://www.ppc.go.jp/news/press/2026/260407/
• [10 Major Information Security Threats 2026 | IPA (Information-technology Promotion Agency, Japan)] https://www.ipa.go.jp/security/10threats/10threats2026.html

【#Sansan #DataBreach #UnauthorizedAccess #CloudSecurity #SharedResponsibilityModel #PersonalInformationProtectionAct #SaaSSecurity #Cybersecurity】