jibun-de-mamoru 上線，按個人資料外洩類型列出限期行動

You get an email: "We are writing to inform you that your personal data may have been leaked." Do you know what to do next — and by when?

Earlier this year, Japan's government asked citizens to "protect your own information." The public reaction was blunt: companies leak — how is an individual supposed to protect anything? Fair. The leaking side is the companies.

But one thing IS in your hands: building, in advance, a state where a leak does not spread. So I built a small tool for exactly that, and put it online:

https://sunnydachs.github.io/jibun-de-mamoru/

It is a single HTML file. Everything runs on your device; nothing you enter is sent anywhere. The source code is public too:

https://github.com/sunnydachs/jibun-de-mamoru

What is happening

The numbers, from primary sources:

• In 2026 (as of Oct 5), listed companies in Japan have already announced ten breaches of more than 1 million records each — the worst pace on record, surpassing all of 2025 (Tokyo Shoko Research)
• Ransomware incidents hit 123 in the first half of 2026, the most for any half-year (National Police Agency, via Yomiuri)
• Over 90% of solved unauthorized-access cases abused IDs and passwords (National Police Agency)

In other words: most attackers don't break defenses. They steal a key and walk in through the front door.

The entry points collapse into four:

 1 known vulnerabilities, unpatched   ("medium" severity is enough, given time)
 2 stolen credentials used as a normal login  (wherever MFA is missing)
 3 a supplier or shared platform falling  (one incident, millions of people)
 4 human judgment  (a screenshot, a social post)

What happens to you depends on WHAT leaked

The scariest thing I learned: a leak starts a chain on day one.

• Password: the same password gets tried on other services within hours. One leak opens your mail, your shopping, everything.
• Credit card: compensation depends on how fast you report — watch the statements, mind the ~60-day window.
• Bank account & PIN: fraud-voice calls ("this is your bank") become personal: they know your name and your branch.
• License images: flagged for loan applications and account openings. Reissuing does NOT change the first 11 digits of the number.
• Name/address/phone only: "not a big deal" — except it sharpens the "someone who knows too much about you" scam. Stay extra alert for a month or two.
• What you pasted into an AI: in a survey of 300 workers and civil servants, about 1 in 5 people using generative AI at work used tools their employer never approved; 64% of those who said they were uneasy about uploading confidential data had uploaded it anyway (ELTES survey).

You know you shouldn't paste it. It's not a knowledge problem — it's a judgment-in-the-moment problem.

Turning notices into dated actions

Individuals can't prevent breaches. What we can do is make a leak spread less — which is exactly what the government's three measures are about.

But "stop reusing passwords" asks you to change everything today, and nobody does. Asked to do the impossible, we do nothing.

So the tool records each notice and turns it into actions:

 a leak notice arrives
    │ record: source, date, what leaked
    ▼
 one entry in the ledger
    │ actions generated per data type
    ▼
 today ─ this week ─ 30 days (color-coded)
    │
 check them off → the record stays

Free tools already list "what to do by leak type." What this page adds is the record and the deadlines: a second and third notice stack up, and the card's 60-day window or the credit-bureau alert stay on your list as YOUR state.

A five-item checklist is included for the before-any-notice case:

• cut down one service that shares the same password
• turn on multi-factor authentication for one email account
• decide one rule: don't tap links
• turn off AI training settings, and decide what you never paste
• when a notice arrives, act by data type

You don't have to do all five — you're allowed to decide which one you won't do. A checklist that pushes 0/5 toward 5/5 gets abandoned.

Design decisions

• Public authorities only as sources: the National Police Agency, the Personal Information Protection Commission, the National Consumer Affairs Center, and official service pages — cited on every item.
• Everything stays on the device. The input never leaves your browser.
• The limits are written on the page: this guarantees no protection, corporate breaches are out of an individual's hands, and procedures age.

Honesty about what a thing cannot do felt more trustworthy here than polish.

So — can individuals protect anything?

No, not the breach itself. That's the companies' job, and the institutions' (Japan's amended privacy law passed in July, with penalties starting January 2027; identity verification tightens in April 2027).

But notices keep arriving in the meantime. Holding what you CAN hold, in a form you can use — that's the position of this one page.

One checklist item, or one ledger entry. That cuts one chain.

The ledger lives at https://sunnydachs.github.io/jibun-de-mamoru/ — the code is on GitHub too.

This is a personal OSS project — no warranty, use at your own risk. Issues and improvement ideas are welcome.

Originally published in Japanese on note.