Breach · 3 min read
Mitsui Sumitomo Insurance: about 23,000 MS Compass records leaked after portal access
The insurer says unauthorized access to its MS Compass site for small and midsize businesses between November 2 and 3 leaked company and contact details. Cards and bank accounts were not included.
Mitsui Sumitomo Insurance, part of MS&AD Insurance Group, said on November 9, 2026 that unauthorized access to MS Compass, its information site for small and midsize businesses, led to a leak of about 23,000 customer records. The company’s Japanese PDF notice is dated the same day.
What happened
The insurer says unauthorized access to MS Compass was detected between November 2 and 3. It restricted access to some systems on November 3 and temporarily closed the whole site on November 6. It says there has been no further external unauthorized access since November 3. The firm is investigating with outside specialists.
What was leaked
As of 9:00 a.m. on November 9, about 23,000 records were in scope. They cover people and companies that registered as MS Compass members, people who signed up for company seminars through the site between November 2023 and November 2026, and people who used the contact form.
Fields can include company name, corporate number, job title, personal name, email address, phone number, industry, head-office address, other addresses, annual sales and employee count. Credit card and bank account information were not included, the notice says. The insurer says it has not confirmed misuse of the leaked information so far.
What this means for you
Company names, job titles and direct emails are useful for spear-phishing that looks like a seminar follow-up or an insurer update. Mitsui Sumitomo warns people to be careful of emails, SMS and calls that claim to be from the company, and not to open links, attachments or enter passwords or card details.
This MS Compass incident is separate from the same day’s notice about customer data leaked through Prestige Core Solution, the roadside-assistance contractor. That larger vendor incident is covered in our Prestige International roadside-assistance post.
What you can do
- Watch for Mitsui Sumitomo’s individual notice if you used MS Compass. The company says it will contact affected customers when ready.
- Treat unexpected “MS Compass” or seminar messages as suspect, even if they know your company name or title.
- Call the dedicated line at 0120-769-542 (weekdays 9:00 a.m. to 5:00 p.m. local time, holidays excepted) with questions.
- See how leaked business contacts fuel phishing if a message already cites your firm.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.
Related coverage
- Roadside assistance records for up to 5.5 million cases leaked in Japan: the Prestige Core Solution vendor breach, including Mitsui Sumitomo’s separate customer notice.
- How scammers use leaked data to make phishing personal.
Sources
- Mitsui Sumitomo Insurance, Information leak following unauthorized access to MS Compass (in Japanese, PDF), November 9, 2026
More stories
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.