Sakura Mobile, a Japanese telecommunications provider serving tourists and international residents, disclosed that an external party gained unauthorized access to its systems on 27 July 2026. The company closed the entry route, replaced credentials, notified Japanese authorities, and began implementing additional security measures. The incident may affect customers who placed certain Travel Plan orders between 4 November 2025 and 27 July 2026, including SIM, eSIM, and Pocket WiFi services. Potentially exposed information includes names, email addresses, order details, and payment methods, but credit card information, passwords, and location data were not compromised because payment data is stored by a separate provider. Sakura Mobile has not revealed how many customers were affected, and no threat actor has claimed responsibility.