Breach · 3 min read
Sumitomo Life Vitality: about 80,000 standalone users’ details left NTT DATA systems
Sumitomo Life and NTT DATA say unauthorized access on November 2 reached about 80,000 Vitality standalone users. About 1,000 had partly masked card numbers.
Sumitomo Life Insurance and its systems contractor NTT DATA say unauthorized access on November 2, 2026, led to a leak of personal details for about 80,000 people who used Sumitomo Life’s standalone Vitality health-program products. Both firms published notices on November 9. Insurance-policy Vitality data and step-count health data were not in the set, they say. About 1,000 people had partly masked credit card numbers in the leak.
What happened
NTT DATA builds and runs the signup systems for Sumitomo Life’s standalone Vitality offerings: Vitality trial / corporate and Vitality Smart (including the employee-benefit type). On November 2, NTT DATA found unauthorized access to those systems and told Sumitomo Life the same day. Follow-up log work confirmed that some customer data had left. NTT DATA blocked outside access and, from November 3, paused new standalone applications, some self-serve card and cancellation steps, and the group portal for the benefit type. The Vitality app and insurance-linked Vitality signup were not stopped for this reason, Sumitomo Life says.
What may have been exposed
As of the November 9 notices:
- About 80,000 people who use or used the standalone Vitality products above.
- Fields that may have left, in combinations that vary: name, postal address, phone number, date of birth, email address, and for about 1,000 people, a partly masked credit card number.
- Not included: insurance contracts, Vitality tied to an insurance policy, or step and other health-program activity data.
Both companies say they have not confirmed misuse or public posting of the data so far. Sumitomo Life is identifying people to contact and opened a desk on November 9.
What this means for you
If you used a standalone Sumitomo Life Vitality product (not only a policy rider), your contact details may be in the set. Partly masked card numbers still help a scammer sound informed. Policy Vitality and the main app were described as outside this leak.
What you can do
- Watch for Sumitomo Life’s individual notice once the firm finishes identifying people.
- Call the desk at 0120-550-997 (weekdays, 9:00 a.m. to 5:00 p.m. local time, from November 9) if you have questions.
- Treat unexpected Sumitomo Life, NTT DATA or Vitality messages as suspect. Both firms say they will not ask for a password or PIN by email or phone.
- If you are among the roughly 1,000 with a masked card in the set, watch statements and consider asking your issuer about alerts; the companies have not said full PANs left.
- See how scammers use leaked data to make phishing personal.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.
Related coverage
- Mitsui Sumitomo Insurance: about 23,000 MS Compass records leaked after portal access: a separate Mitsui Sumitomo Insurance disclosure the same week (different company).
- How scammers use leaked data to make phishing personal.
Sources
- Sumitomo Life, Apology and notice: customer data leak after unauthorized access to a contractor’s systems (in Japanese), November 9, 2026
- NTT DATA, Personal data leak from a system we operate for a client (in Japanese), November 9, 2026
More stories
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.