[ITmedia News] A return to analog due to a series of information leaks? Daiso's "Password Management Notebook" is in short supply, but there are also risks - asked IPA

Amid a series of information leaks due to unauthorized access, there is a movement to reconsider the analog method of managing passwords by writing them on paper. The 100 yen shop Daiso is running out of paper password management notebooks. Daiso Sangyo Co., Ltd. (Higashihiroshima City, Hiroshima Prefecture, hereinafter referred to as Daiso), which operates the system, told ITmedia NEWS that the security of managing it on paper, which is not connected to a network, is "gaining renewed attention."

A password management notebook is a paper notebook for writing and managing IDs and passwords for each service. According to Daiso, the product will be released in stages from around fall 2020, and was originally intended for use by people who are reluctant to manage passwords on digital devices or who are not good at operating them, mainly the elderly.

However, it is said that sales have been increasing week by week since around the end of October, and although specific sales numbers have not been disclosed, the recent growth has been ``surprising even to those in charge of development.''

The period when sales started to increase also coincided with the period when the number of publicized information leaks increased rapidly. According to a survey by MM Research Institute (Minato-ku, Tokyo), the number of incidents of information leaks due to cyber attacks increased from 72 in August and 81 in September to 193 in October. As of the end of October, there were a total of approximately 161 million leaks of authentication information such as passwords and login IDs, which is approximately 31 times the number for all of 2025 (5.14 million leaks). In a large-scale example, Sourcenext announced on October 15 that up to 22.52 million members' information, including passwords, may have been leaked due to unauthorized access to the system that manages member information.

As such unauthorized access continues to be publicized, password management notebooks are temporarily in short supply. Daiso plans to restock the product in November and is also making adjustments to increase production. When asked about plans to increase the number of products related to password management, the company replied that there are no plans at this time. The company's first priority is to improve its supply system so that it can deliver its current notebooks to as many customers as possible.

IPA: “We don’t necessarily deny paper.”

Is it safe to manage using analog paper notebooks? We spoke to the Information-technology Promotion Agency (IPA), which is responsible for promoting information security measures.

IPA recommends on its website that passwords be different for each service and be around 15 digits, including uppercase and lowercase letters and numbers. There is no change in the opinion that the paper held when interviewed in 2022, saying that it was not necessarily denying the method of managing passwords.

Regarding tools for managing passwords digitally, such as password management software, he answered, ``If you can use it, there is no problem in using it,'' and when choosing a reliable service with a solid support desk, etc. is preferable.

There are risks that cannot be prevented with paper.

However, paper management is not perfect, and IPA points out that if you carry around a notebook, there is a risk of it being lost or being seen. In addition, the service also has the ID and password information used to log in, so there is a risk separate from the notebook at hand.

If a service system leaks, users cannot prevent it even if they manage it with paper at hand. The attacker also attempts unauthorized logins to other services using the leaked ID and password. This type of ``list-based attack'' was confirmed on Muji's online store in November, and the possibility has also been raised on the official lottery website.

In response to these risks, IPA published a page on October 26th summarizing ``what to do'' and ``daily countermeasures'' in the event of a leak, and recommends that if the service supports multi-factor authentication or passkeys, proactively set them up as a countermeasure against unauthorized logins. Additionally, as a precaution against phishing, we generally treat emails and SMS that arrive out of the blue as fake, and ask users not to open links.