Where Do Misdirected Emails Show Up in the Statistics?

I build small tools that add a check before you send something. Before writing any more about why, I wanted to test the premise against public numbers: how common are misdirected emails, actually? In August 2026 I read three Japanese sources.

I went looking for one number

My assumption was that somewhere there would be a figure like "misdirected email causes X% of data leaks," and that I could simply cite it.

That number turned out not to exist. What I found instead were three documents showing three quite different pictures of the same country, over roughly the same period.

The mandatory-report window: mistakes, not attacks

In Japan, organizations are required to report certain personal-data leaks to the Personal Information Protection Commission (PPC), the national regulator. Its annual report for fiscal 2025, published on July 7, 2026, counts 17,139 processed reports from private-sector organizations. For the 13,345 reports the Commission received directly, it publishes a breakdown of causes.

The table separates incidents by where the leak happened. Leaks at the reporting organization itself account for 82.7%, and within those, the largest cause is misdelivery — documents or cards handed or mailed to the wrong person — at 45.5%, followed by missending at 21.6%. Those two alone are roughly two thirds of the whole. Unauthorized access stays under ten percent even after adding incidents at contractors and cases of unknown origin. In 76.9% of cases, what leaked was paper only. The report's own examples are documents handed over at hospitals and pharmacies, and credit cards mailed to the wrong address.

Seen through this window, personal-data leaks in Japan are mostly not a cybersecurity story. They are a story about paper and small mistakes.

What the report does not say is how many of the "missending" cases were email. Postal mail and email share a single category.

The listed-company window: unauthorized access takes over

Tokyo Shoko Research, a corporate research firm, counts the incidents that listed companies and their subsidiaries disclose themselves. Its survey published on January 30, 2026 (Tokyo Shoko Research, TSR Data Insight, "Personal information leak and loss incidents at listed companies, 2025") counts 180 incidents in 2025. The largest cause there is virus infection and unauthorized access, at 64.4%. Misdisplay and missending — the category that includes mixing up CC and BCC — comes second at 20.5%.

Nearly the opposite picture.

The expert window: carelessness drops off the list

The IPA, Japan's information-technology agency, publishes an annual "10 Major Security Threats" list, decided by discussion and votes among security practitioners and researchers. In the 2025 edition, "damage from information leaks caused by carelessness" ranked 10th for organizations. In the 2026 edition it is no longer in the top 10. The top of the list belongs to ransomware, supply-chain attacks, and risks around AI use.

Which number to quote

For someone who builds pre-send checking tools, the temptation is obvious: quote the biggest number. "Two thirds of reported leaks are simple mistakes." That is true. But if you only look at what listed companies disclose, the main story is unauthorized access — and that is also true. Quoting one half of this felt like a waste of having looked.

The difference comes from how each source counts. Mandatory reporting covers even a single person's sensitive data handed to the wrong patient, so the paper mistakes of hospitals and pharmacies fill the statistics. Voluntary disclosure by listed companies skews toward incidents large enough to disclose, so ransomware dominates. Expert votes go to threats that are new and growing. None of the three windows is wrong. They are just different windows.

So this note keeps all three.

What I learned

Misdirected email has no line of its own in any of these statistics. In the mandatory reports it shares a category with postal mail. In the listed-company survey it shares one with website misdisplays. In the expert ranking it has slipped out of view. Each individual case is small and rarely makes the news.

Still, through the mandatory-report window, the most common form of leak in Japan is not an attack but a mistake. And as I wrote in an earlier note, I think mistakes are less about how careful people are and more about whether there is a place to check at the moment of sending.

What I came away with was not an exact count of misdirected emails. It was the fact that, inside such a large category, nobody counts them on their own.