One in 6 Japanese companies has experienced a data leak or an incident that could lead to a leak, a survey showed. Some companies have not even determined whether an incident occurred, exposing gaps in security management systems.

On Oct. 19, Japanese media outlet ITmedia reported that credit research firm Teikoku Databank surveyed 1,328 Japanese companies and found 16.2 percent said they had experienced a data leak incident. The survey was conducted online from Oct. 9 to Oct. 14.

Among all respondent companies, 5.5 percent said they had experienced an incident within the past year, while 10.7 percent said they had experienced one more than a year ago. Companies saying they had never had an incident accounted for 69.1 percent, while 14.8 percent said they did not know whether one had occurred.

Major examples included human error by employees and external cyber attacks. Reported cases included misaddressing email recipients or being deceived by emails impersonating employees of business partners and sending sensitive information.

The gap by company size was also clear. Large companies reported an incident experience rate of 30.2 percent, 14 percentage points higher than the overall average. The rate of incidents within the past year was 8.8 percent for large companies, above 5.0 percent for small and medium-sized companies.

Teikoku Databank analysed that large companies manage relatively more information and systems, and also have better incident detection systems, making it easier for them to confirm that incidents occurred.

Among small and medium-sized companies, shortages of security personnel and budget were cited as problems. Some companies said that without specialised staff, it is difficult to verify even whether a data leak occurred.

Some also complained that while they are being asked by large business partners to strengthen security, it is difficult to secure the costs and personnel. One small and medium-sized company argued that it needs not only security guidelines but also financial and human support.

Teikoku Databank stressed that systems to detect signs of incidents early are as important as preventing data leaks. It said basic security measures such as employee training, access control and log management should be strengthened, and that response capabilities at small and medium-sized companies need to be improved.