A cyberattack on Sony Life Insurance has exposed approximately 385,000 records containing personal information belonging to customers of another Japanese insurer.
The breach affected policyholders and insured individuals of Medicare Life Insurance, whose products Sony Life distributes as an insurance agent. The compromised information was held in Sony Life's systems, rather than those of the insurer underwriting the policies.
In its October 28 disclosure, Sony Life confirmed that unauthorized access to its policyholder website and related systems was discovered on October 27. The exposed information included names, dates of birth, gender, addresses, phone numbers, policy numbers, and insurance contract details.
The distribution relationship dates back to January 2023, when Sony Life began offering Medicare Life's medical insurance products through its Lifeplanner sales channel. Medicare Life confirmed that customer information relating to policies sold through other distribution channels was not affected.
Although the breach did not involve Japan's My Number identification numbers, credit card details, or bank account information used for premium payments, the exposure of policy and personal details has raised concerns about potential impersonation attempts.
Sony Life said it had found no evidence of customer information being misused as of October 28. Both insurers have warned customers to be cautious of suspicious communications seeking passwords or other authentication information.
The incident has also disrupted policy servicing. Sony Life suspended its policyholder website, mobile application, direct claims service, and several other online functions on October 28 to prevent further unauthorized access. Customers requiring urgent assistance have been directed to their representatives or customer service centers.
The disruption extended to Medicare Life, which temporarily suspended new registrations for its online customer portal. The insurer is targeting November 2 to restore registration services for policies sold through other channels, while access for Sony Life-distributed policies will resume once security measures are completed.
The breach comes amid growing attention to cybersecurity risks involving insurance intermediaries.
In an April 2026 study commissioned by Japan's Financial Services Agency (FSA), researchers examined how major overseas insurers assess third-party cybersecurity exposure, including risks involving agents and brokers with access to policyholder information.
The study found that some insurers had expanded their third-party risk management frameworks to include intermediaries, while suggesting that Japanese insurers consider similar risk-based approaches. The findings are particularly relevant to distribution arrangements in which customer information is accessed or retained outside the underwriting insurer's own systems.
The latest incident also follows a separate cyberattack affecting Aflac Japan, which disclosed in June that personal information belonging to approximately 4.38 million customers and agents had been compromised.
Sony Life has reported the breach to the FSA and said it would notify affected customers individually.
The company is still investigating how attackers gained access and the full extent of the incident, with no confirmed timeline for restoring its suspended services.
The Sony Life breach illustrates the specific risk gap Japan’s Financial Services Agency flagged in its April 2026 study: when customer information is accessed or retained in an intermediary’s systems rather than the underwriting insurer’s own infrastructure, the intermediary becomes an exposure point that standard insurer-level cyber controls do not reach.
For brokers and agents operating within Japanese distribution networks - particularly those holding policyholder records for products they sell on behalf of insurers - the practical question is whether their own cyber risk management framework has kept pace with the data they hold. An intermediary that retains policy numbers, personal details and contract information on behalf of multiple insurer partners carries a concentrated exposure across all of them simultaneously.
The FSA study found that some overseas insurers had already expanded their third-party risk management frameworks to include intermediaries, and suggested Japanese insurers consider similar risk-based approaches. The Sony Life incident, which originated in the intermediary’s systems rather than the product underwriter’s, gives that recommendation immediate force. Intermediaries whose cyber controls have not been reviewed recently against the volume and sensitivity of policyholder data they hold should treat this incident as the prompt to do so.
