The MS&AD data breach has exposed customer and corporate information across several insurance services and a third party contractor. Japanese press reports on 9 November 2026 placed the combined exposure at about 1.01 million records, although the figures confirmed by individual subsidiaries total approximately 971,300.
The incidents affect policyholder portals, a direct insurance website, a roadside assistance platform and an information service for small and medium-sized enterprises. Investigations remain active, and no threat actor has been publicly identified.
What happened in the MS&AD data breach
Multiple companies within MS&AD Insurance Group detected unauthorised access between 2 and 3 November 2026. The affected businesses isolated systems, suspended customer-facing services and began investigating whether information had been taken.
On 6 November, four subsidiaries confirmed leaks from their own systems. Further disclosures on 9 November added an incident involving contractor Prestige Core Solutions, known as PCS, and a separate compromise of Mitsui Sumitomo Insurance’s MS Compass website.
The MS&AD data breach is therefore not one intrusion into a single central database. It covers several incidents involving different services and data sets, including a distinct compromise within a third party contractor’s environment.
Aioi Nissay Dowa Insurance portal
Aioi Nissay Dowa Insurance confirmed that about 444,000 records were exposed through its policyholder-only page. The information included policy numbers, names, addresses, contact details and portal IDs.
For a small number of people, the leaked information also included the last four digits of payment card numbers or masked bank account numbers. The available notices do not indicate that complete card or bank details were exposed through this portal.
Mitsui Sumitomo Insurance portal
Mitsui Sumitomo Insurance, or MSI, reported that about 37,000 policyholder portal records were affected. These contained policy numbers and customer contact information, but MSI said the affected data did not include card or bank account details.
Another 5,300 records related to Mitsui Sumitomo Aioi Life Insurance customers who had configured life insurance contracts to appear within the non-life insurance portal. This data included policy numbers, names, dates of birth and email addresses.
Mitsui Direct website and app services
Mitsui Direct General Insurance confirmed that approximately 234,000 records were taken from its website. Affected information included insurance contract details, insured person information, contact data and vehicle details.
The company said card details, bank account information and customer portal passwords were not included in this data set. Mitsui Direct has also acknowledged a possible impact from the separate PCS contractor incident, but it had not confirmed a record count for that exposure as of 9 November.
MS&AD data breach timeline and contractor exposure
The earliest event in the wider timeline occurred at PCS, which provides roadside assistance operations for insurers and other clients. PCS detected unauthorised access to its operations system on 29 October 2026 and disabled credentials believed to have been misused.
The contractor halted the affected system on 30 October. Its parent company, Prestige International, issued an incident notice on 2 November and subsequently said that up to approximately 5.5 million records across multiple clients and sectors may have been exfiltrated.
- 29 October 2026: PCS detected unauthorised access and disabled compromised credentials.
- 30 October 2026: PCS halted the affected operations system.
- 2 to 3 November 2026: MSI and Aioi Nissay Dowa Insurance detected suspicious portal access and suspended services.
- 4 November 2026: The life insurance subsidiary posted a service notice, while MSI received information about its PCS exposure.
- 6 November 2026: Four subsidiaries confirmed leaks and published initial record counts.
- 9 November 2026: MSI disclosed the PCS customer impact and the separate MS Compass incident.
MSI said the PCS breach affected about 228,000 of its motor insurance customers. The records contained names, addresses, telephone numbers, vehicle identifiers and information collected during roadside assistance calls. MSI said its affected subset did not contain card or bank account information.
PCS has described a wider multi-client compromise, so its potential total should not be treated as an MS&AD-only figure. The contractor incident nevertheless forms a significant part of the MS&AD data breach because of the volume and detail of the MSI customer records involved.
MS Compass corporate records
A separate attack affected MSI’s MS Compass information site for small and medium-sized businesses. Unauthorised access between 2 and 3 November led to the exposure of about 23,000 corporate entries.
The records included company names, corporate numbers, contact details, staff roles and business attributes such as turnover and employee numbers. MSI restricted access on 3 November and temporarily closed the site on 6 November.
Why the reported totals differ
Japanese media reported on 9 November that the MS&AD data breach had reached approximately 1.01 million records. However, adding the figures publicly confirmed by subsidiaries produces a lower total of about 971,300.
That calculation consists of 444,000 Aioi Nissay Dowa records, 37,000 MSI portal records, 5,300 life insurance records, 234,000 Mitsui Direct records, 228,000 MSI records from PCS and 23,000 MS Compass entries.
The difference appears to arise because press calculations included an assumed figure for Mitsui Direct’s possible PCS exposure. As that part remained under investigation, 1.01 million should be understood as a press composite rather than a confirmed company-wide total.
Current exploitation status
The MS&AD data breach involved confirmed unauthorised access and data exfiltration, meaning exploitation occurred in the wild. It is not associated with one publicly disclosed software vulnerability, and no proof-of-concept exploit or affected software version has been published.
The affected products are online services rather than identified software releases. They include subsidiary policyholder portals, Mitsui Direct website and app workflows, MS Compass and the PCS roadside assistance platform.
No threat actor attribution has been announced. MS&AD companies and PCS had also published no technical indicators of compromise, such as malicious IP addresses, file hashes or domains, as of 9 November.
Why the MS&AD data breach matters
Policy numbers, vehicle identifiers and roadside incident details can give phishing messages credibility even without passwords or complete payment details. Corporate information from MS Compass could similarly support targeted impersonation of named businesses or employees.
Direct UK impact remains unconfirmed. However, organisations connected to MS&AD companies, insurance partners or assistance providers should establish whether their own customer or employee information was processed through the affected services.
What organisations should do now
- Ask relevant insurers and service providers whether organisational, employee or customer records are included in the affected data sets.
- Review access to MS&AD and supplier portals, and suspend integrations or single sign-on connections that are not currently required.
- Warn staff handling insurance or vehicle matters to verify messages quoting policy numbers, vehicle details or roadside incidents.
- Monitor for impersonation, account recovery attempts and unusual enquiries involving the exposed corporate or policyholder information.
Because no technical indicators have been released, organisations should base their response on confirmed business relationships and the specific services used rather than relying only on conventional indicator scanning.
Originally reported by eSecurity Planet.
