“Unauthorized access to Rakuten Drive.”
This news came out today.
“Does it affect me?” Right. You wonder.
One thing up front: this site’s operator is an employee of Rakuten Group and also uses Rakuten Mobile referral links.
That is exactly why this article writes only the facts that could be confirmed in reports. Where something is speculation, I write it so you can tell it is speculation.
The 30-second summary
- Rakuten Drive announced the occurrence of unauthorized access on October 6, 2026
- Stored data was obtained or viewed for 15,382 accounts
- Information such as account names was involved for 687 accounts. Of those, encrypted passwords were also involved for 313 accounts
- The cause is said to be that the credentials of a management account for the system were obtained illegally
- Affected users are said to be notified individually
- It says that no secondary damage has been confirmed at this point
What is Rakuten Drive
Rakuten Drive is a cloud storage service provided by Rakuten Group. It lets you keep data such as photos and documents stored on the internet.
The ASCII.jp report does not describe its features or pricing.
What happened (what the reports say)
This is the content ASCII.jp reported as Rakuten Drive’s announcement.
What was affected
| Information | Count | Period / date |
|---|---|---|
| Stored data (photos, documents, etc.) | 15,382 accounts | Obtained or viewed from January 29 to September 17, 2026 |
| Account name, display name, profile image URL | 687 accounts | Obtained or viewed on August 27 |
| Encrypted password and the string added at the time of encryption | 313 of the 687 above | Same as above |
Regarding passwords, Rakuten Drive is reported to explain that processing has been applied to make them difficult to restore.
Cause
It is said that the credentials of a management account for the system were illegally obtained and the inside was accessed. How the credentials leaked and the method used are not written.
Rakuten’s response
The reported responses are as follows.
- The route of the unauthorized access was blocked, and monitoring was strengthened
- App downloads and the issuing of new accounts are restricted
- Affected users will be notified individually
- At this point, no secondary damage has been confirmed
Follow-up (added October 7, 2026)
A Keitai Watch report (published October 6, 2026, 17:42) revealed the following.
- The party making the announcement is Rakuten Symphony. It stated that there was unauthorized access by a third party to part of the “Rakuten Drive” system
- It is proceeding with notifying affected users by email and other means, and with reporting to the relevant authorities
- No secondary damage has been confirmed at this point
- In July as well, suspicious push notifications impersonating the service were confirmed, and it had warned people not to respond to things like payment demands
Guidance for users (as reported)
- Affected users will be contacted individually by email and other means
- If there are logins or account anomalies you don’t recognize, charges you don’t recognize, threatening contact, or contact that appears to be impersonation, it asks you to not open or respond to it, and to consult the Rakuten Drive contact point or the police
- The contact points are reported as a web inquiry form and a temporary telephone support desk (0800-600-6600, open every day of the year, 9:00 to 17:00)
The phone number is as stated in the report. Beware of fake contact information, and check that the number is the one posted on the official Rakuten Drive site before you call.
About how the counts are written
ASCII.jp reports “of the 687 accounts, password-related information was also involved for 313 accounts.” Keitai Watch writes the 313 accounts in a separate paragraph and does not state that they are included in the 687. The numbers themselves match in both reports.
What hasn’t been written yet
The body text of the reports does not say the following.
- When the unauthorized access was discovered (the period over which viewing or obtaining of data was confirmed is written as January 29 to September 17)
- How the credentials leaked, or details of the method
- Specific measures to prevent recurrence other than strengthened monitoring
- The name of the authorities reported to
- When the restrictions on app downloads and issuing new accounts will be lifted
- Any recommendation to change passwords, or the steps for doing so
For details, check “【重要】「楽天ドライブ」における不正アクセスの発生について” (Important: Regarding the Occurrence of Unauthorized Access to “Rakuten Drive”) on the Rakuten Drive support site (https://support.rakuten-drive.com/hc/ja).
I have not been able to check this official page itself (retrieval from outside was refused). The content of this article is based on the reports by ASCII.jp and Keitai Watch.
What users should check
From here on, this is not official guidance but my own general advice.
1. Check whether you used Rakuten Drive
Look through the app list on your phone, or try to recall the data you stored. If you don’t remember using it, you’re probably not affected, but please confirm with the official guidance to be sure.
2. Watch out for “impersonation” disguised as individual notices
Affected users are said to be notified individually. At times like this, emails and SMS impersonating the official source tend to increase.
- Don’t enter your ID or password through links in emails or SMS
- Check from the official app, or from an official site you opened yourself
3. Review password reuse
If you used the same password as Rakuten Drive on other services, it’s safer to change it. For services that support two-step verification, it’s a good idea to enable it.
4. Take stock of what you had stored
Try to recall whether you stored important documents or personal information. It will help you decide what to do when a notification arrives later.
About other information you see on social media
On the same day, a claim about a different data leak is also being discussed on social media.
However, as far as I could confirm, neither the truth of that claim nor the source of the leak is known. Please don’t confuse it with this Rakuten Drive incident. It is not covered in this article.
Summary
- On October 6, 2026, Rakuten Drive announced unauthorized access
- Stored data was obtained or viewed for 15,382 accounts. Account information was involved for 687 accounts (of which 313 also involved encrypted passwords)
- The cause is said to be illegal acquisition of a management account’s credentials. It says no secondary damage has been confirmed at this point
- The time of discovery, details of the method, and specific actions for users are not written in the body text of the reports
- Check the official notice for details. Be careful of impersonating emails and SMS
The information may be updated. Please be sure to check the official notice.
Sources: ASCII.jp, Keitai Watch
- Rakuten Drive: stored data of 15,000 accounts leaked in unauthorized access (October 6, 2026) (in Japanese)
- Unauthorized access to “Rakuten Drive”: 15,382 stored data items viewed and obtained (October 6, 2026) (in Japanese)
This article contains affiliate advertising. If you apply for a product or service through links on this site, we may receive compensation from partner companies. Additionally, the operator is an employee of Rakuten Group and may receive compensation through an employee referral program. Article content and evaluations are based on the operator's actual experience and research, regardless of advertising. For details, see the Disclaimer & Affiliate Disclosure. Disclaimer & Affiliate Disclosure
This article contains machine translation. For official terms, please refer to the multilingual pages on the official Rakuten Mobile website.
If you have concerns about Rakuten Mobile's coverage area or signal conditions, you can inquire through the official signal improvement survey request form .
