More Japanese companies across various sectors are reporting data breaches due to cyberattacks that put millions at risk of identity theft, with authorities trying to get to the bottom of the situation.

This week alone, reports of unauthorized access and potential user-data leaks were reported by Daiwa Securities, GMO Research, Rakuten Drive, Nikkei media group and Yakiniku King — potentially affecting millions of customers. These reports follow the disclosure of a data breach by Park24, which operates Times rental car and car-sharing services, that affected 6.6 million accounts in late September.

On Tuesday, Scala Communications announced that its FAQ system had been subjected to unauthorized access — exposing up to five of its client companies, including Daiwa Securities and Citizen Watch.

Rakuten Drive, Rakuten Group’s cloud storage service, acknowledged three unauthorized access incidents between January and September, possibly affecting over 16,000 users.

On Monday, GMO Research reported that its survey site, infoQ, experienced unauthorized access impacting up to 948,498 users. The company said that, in 611 cases, customer points were exchanged for Amazon gift codes worth a total of nearly ?2.9 million ($18,310). Its parent company, GMO Internet Group, also operates a cybersecurity service, GMO Cybersecurity.

Yakiniku King’s parent company, Monogatari, revealed on Monday that unauthorized third-party access on Saturday exposed data for about 10 million user accounts.

At a news conference on Tuesday, Chief Cabinet Secretary Minoru Kihara acknowledged the government’s concern over the attacks against the wide range of businesses, noting that hackers employed various methods to gain access to information.

“At this point, it is not clear whether these incidents are related, but we are working to grasp the overall picture of the damage by gathering information from those involved and analyzing the methods and trends of the attacks,” Kihara said.

The National Police Agency is currently conducting a survey in partnership with an external company, ResearchWorks, to study the occurrence of unauthorized access and methodology of the cyberattacks. Results are expected to be released next March.

Kihara reiterated the measures announced by the Digital Agency on Tuesday for people to take to protect themselves from cyberattacks: avoiding password reuse, enabling multifactor authentication and exercising caution when opening links.

“We are also conducting information-gathering through collaboration with overseas cybersecurity organizations and investigative authorities, and issuing advisories,” Kihara said.

Reports emerged on Tuesday that Japanese police have captured a suspected member of the international hacker group “Qilin” and extradited him to Germany.