Sakata Seed said on August 19, 2026 that outside forensic investigators have wrapped up their review of two unrelated unauthorized-access incidents, one at its own servers in Japan and one at its US subsidiary, Sakata America Holding Company, Inc. The company had first disclosed the Japan breach in November 2025 and the US breach in February 2026; this filing is the final word on both.
What may have leaked in Japan
Sakata Seed traced the Japan intrusion to a public-facing remote-access server, through which attackers may have gained administrator privileges. The company first found signs of unauthorized access on November 11, 2025. The final tally of potentially exposed personal data spans several distinct groups, from wholesale customers and suppliers to job applicants and staff.
| Group | Approx. records | Data types disclosed |
|---|---|---|
| Wholesale customers and business partners | ~44,000 | Names and addresses; phone numbers and email addresses for some individuals |
| Applicants for research and technical-role recruitment | ~5,000 | Personal information (type not further itemized in the disclosure) |
| Employees, including retirees, dispatched and group-company staff | ~5,000 | Personal information (type not further itemized in the disclosure) |
| Entrants in the company's calendar giveaway and a seed-themed promotional campaign | ~2,500 | Names, addresses, phone numbers |
| Other business partners (identified in follow-up review) | ~200 | Personal information (type not further itemized in the disclosure) |
The roughly 200 additional business partner records were only identified during follow-up investigation after the company's first two public updates. Sakata Seed says it has notified the relevant authorities and is contacting affected individuals directly by letter under Japan's personal information protection law; a dedicated inquiry line for this incident closed at the end of June 2026, with questions now directed to the company's general customer service desk.
A separate breach at the US subsidiary
The second incident hit Sakata America Holding Company's servers, detected January 21, 2026. Investigators found the entry point was remote-access login credentials, a different route from the Japan intrusion, and the company says the two cases have no direct connection. The damage was confined to the US subsidiary's own systems; Sakata Seed says there is no evidence the parent company or other group entities in Japan or overseas were affected, and the subsidiary's operations have continued as normal.
No misuse confirmed, for now
For both incidents, Sakata Seed says no secondary misuse of the exposed information has been identified to date. For the US subsidiary specifically, the company also says the breach caused no material disruption to business activities, which have continued as normal. The company has since tightened network management, restricted internal communications, moved to stricter administrator-privilege controls with round-the-clock monitoring, and rolled out additional staff security training. Those fixes close out the investigation file, but "no misuse confirmed to date" is a snapshot, not a guarantee, for the tens of thousands of people whose names and contact details were in the breached systems.