Daiso's Paper "Password Management Notebook" Runs Short in Japan Amid Leak Surge; IPA Recommends MFA and Passkeys

Daiso, the Japanese 100-yen shop chain, is running short of its paper "Password Management Notebook," ITmedia NEWS reported on November 14, 2026 (JST). Daiso operator Daiso Industries told the outlet that sales have been climbing since around the end of October. The jump follows a sharp rise in data breach disclosures in Japan in October. Meanwhile, Japan's Information-technology Promotion Agency (IPA) warns that paper also carries risks and recommends using multi-factor authentication and passkeys.

Notebook Sales Have Surged Since Late October

According to the ITmedia NEWS article, Daiso began rolling out the notebook around fall 2020. It was originally aimed at people reluctant to manage passwords on digital devices, as well as older users who find such devices hard to operate. Sales have grown week after week since around late October, though the company has not disclosed specific sales figures.

Daiso Industries reportedly said the reassurance of keeping passwords on paper, which is not connected to any network, is drawing renewed attention. The company plans to restock the notebook in November and is working to increase production. Asked whether it plans to add more password-related products, it said there are no such plans "at this time," and that it will first focus on securing supply.

October Leak Incidents Hit 193, a Five-Year High

A survey released on November 4 by MM Research Institute found that data leak incidents caused by cyberattacks in Japan totaled 72 in August and 81 in September, then jumped to 193 in October. October's figure is the highest in the five years since the firm began tracking in 2022.

Leaks of credentials such as passwords and login IDs had already reached about 31 times the 2025 full-year total as of the end of October. The firm noted that leaked records grew about 7.6-fold while incidents grew only about 1.5-fold, indicating that individual breaches are getting larger.

Among the large cases, SourceNext announced on October 15 that unauthorized access to its member-management system may have exposed up to about 22.52 million member records, including passwords.

IPA Doesn't Reject Paper, but Users Can't Stop Leaks at Their End

On its website, IPA recommends using long passwords of around 15 characters that combine uppercase letters, lowercase letters, and numbers, with a different password for each service. Asked by ITmedia NEWS about paper-based management, IPA reportedly said its 2022 position, that it does not necessarily reject the practice, has not changed. It also said password managers are fine to use, as long as they come from trustworthy services with solid support.

At the same time, IPA pointed out that carrying a notebook around creates a risk of losing it or having it seen by others. Moreover, services also hold users' IDs and passwords, so if a service is breached, careful paper management on the user's side cannot prevent it. Avoiding "credential stuffing," in which attackers try leaked ID-password pairs on other services, starts with not reusing passwords.

Change Passwords Quickly After a Leak; Use MFA and Passkeys Day to Day

An advisory IPA published on October 26 says that if an ID and password are leaked, users should promptly change the password for that service, and also change it on any other service where the same password is reused. If an email address or phone number is leaked, IPA advises treating unexpected emails and text messages as scams by default, deleting them without opening any links.

For everyday protection, IPA recommends actively enabling multi-factor authentication, such as SMS codes, authenticator apps, or hardware tokens, as well as passkeys on services that support them. It also advises deleting accounts that are no longer used and registering only the minimum necessary information.

Our Take

A paper notebook can't be stolen over the internet, and it is easy to keep up even for people uncomfortable with digital devices. As a way to keep track of long, unique passwords for each service, it has some merit. However, as MM Research Institute's figures show, most leaks happen on the service side. Paper can't prevent that damage, and losing the notebook could put multiple accounts at risk at once.

Still, if a notebook helps people stop reusing passwords, it has value. A practical approach would likely be to prioritize passkeys and multi-factor authentication wherever they are available, and keep the notebook at home as a backup rather than carrying it around.

Summary

The surge in data leaks has drawn attention to paper-based password management, with Daiso's "Password Management Notebook" running short. IPA does not reject paper, but it carries a risk of loss and cannot prevent leaks on the service side. Anyone who uses online services should stop reusing passwords and set up multi-factor authentication or passkeys. Daiso reportedly plans to restock the notebook in November.