Shuichiro Ogawa
日本語

Notes · updated 2026-10-24 · Markdown

What Can Designers Do, and Where Can They Add Value, as Personal Data Breaches Continue? (Industry Sources)

This note examines, through industry sources, what designers can do about continuing personal data breaches and where they can add value.

Contents (8)
  1. The question and the scope of this note
  2. Which parts of the breach problem can design reach?
  3. Moving away from designs that ask users to be careful
  4. What did practitioners who deployed passkeys design?
  5. Consent and cancellation screens have become objects of regulation
  6. Who recognizes designers’ added value, and how?
  7. What designers can do
  8. Where this account does not apply

The question and the scope of this note

By October 5, 2026, ten breaches involving more than one million records each had been disclosed in Japan, compared with six in the whole of the previous year (Tokyo Shoko Research 2026b). The largest exposed about 12.23 million email addresses through unauthorized access to an email system. Few would dispute that information security matters more than before, but how this connects to designers’ work is not obvious. Many breaches appear to concern server vulnerabilities and ransomware, which seem far from interface design.

This note examines what designers (UX/UI, service, and product designers) can do about data breaches and privacy problems, and how they can add value there, within the range that industry sources support. The note asks two questions. The first is which parts of the breach problem design can reach. The second is who recognizes the value that designers provide in those parts, and how. An account based on academic research is in the academic counterpart, What Can Designers Do, and Where Can They Add Value, as Personal Data Breaches Continue? (Academic Research).

Three kinds of sources were used. These are primary documents from public bodies, regulators, and standards organizations; published figures from research firms and industry associations with stated methods; and statements by the people who built the products (designers, UX writers, engineers, and product managers). Figures from research firms and security companies are based on their own data or on members’ self-reports, and only the factual parts with stated methods were used.

Which parts of the breach problem can design reach?

The causes of breaches look different depending on the source. Tokyo Shoko Research collected 180 incidents disclosed in 2025 by listed companies and their subsidiaries; malware infection and unauthorized access accounted for 116 (64.4%), misdisplay and misdirected email for 37 (20.5%), and loss and mistaken disposal for 18 (10.0%) (Tokyo Shoko Research 2026a). Misdisplay and misdirected email include confusing CC and BCC in emails and misconfigured systems. The records exposed totaled 30,636,910, and six large incidents of over one million records each drove up the total.

Breach reports received by Japan’s Personal Information Protection Commission show a different picture. Of the 17,139 reports processed in fiscal 2025, 93.6% involved 1,000 people or fewer per incident, and 76.9% involved paper media only (Personal Information Protection Commission 2026a). Common causes were documents containing sensitive personal information handed to the wrong person at hospitals and pharmacies, misdirected credit cards and similar items, and unauthorized access. The report for the first quarter of fiscal 2026 (6,101 reports) also notes that documents handed to the wrong person by non-life insurers stood out (Personal Information Protection Commission 2026b). Incidents disclosed by listed companies lean toward large electronic breaches, whereas reports under the law capture small mix-ups involving paper. Both are aspects of the breach problem, and because their populations and definitions differ, their percentages cannot be compared side by side.

International breach data also show a large human role. In Verizon’s 2026 report, a human element (errors, being deceived, misuse of credentials, and so on) was present in 62% of confirmed breaches (Verizon 2026). However, the most common initial access vector was exploitation of vulnerabilities (31%), followed by phishing (16%) and credential abuse (13%). The Personal Information Protection Commission also lists, as causes of unauthorized access, unpatched published vulnerabilities, easily guessed IDs and passwords, and misconfiguration (Personal Information Protection Commission 2026a).

From these sources, the areas that design can reach narrow to three. The first is misdelivery, in which people hand documents to the wrong person or send items to the wrong address; this concerns service design, including counter and mailing procedures as well as screens. The second is authentication design, which bears on phishing and easily guessed passwords. The third is consent, cancellation, and notification screens, which bear on trust. Unpatched vulnerabilities and ransomware intrusions belong mainly to engineering and operations and cannot be prevented by interface design.

The sources also indicate the size of the losses when a breach occurs. In IBM’s 2025 study of 600 organizations, the global average cost of a breach was 4.44 million US dollars (IBM 2025). In a survey by Japan’s JNSA, organizations that leaked credit card information suspended card payments for an average of 131.8 days, and more than 60% suspended them for six months or longer (JNSA 2025). This answer came from 16 organizations, however, and cannot be treated as a representative value.

Moving away from designs that ask users to be careful

In authentication and phishing, public bodies changed their thinking first. The UK’s NCSC wrote that, for users who need to open links from unfamiliar domains as part of their work, “being able to spot a phish is not their job”, and asked organizations to protect users with technical measures instead of relying on blame and fear (NCSC 2022). Japan’s Digital Agency states that real-time phishing, which relays a password and a one-time password entered on a fake site to the legitimate site on the spot, defeats even multi-factor authentication that combines the two, and that phishing-resistant methods such as passkeys are needed (Digital Agency 2026). The revision proposal enforces phishing-resistant methods for all users at the highest assurance level and provides them to users who wish to use them at the level below (Digital Agency 2025).

In the United States, NIST made the construction of the password field itself a requirement. SP 800-63B-4 states that, apart from rejecting known compromised values, no other composition rules (such as requiring symbols) shall be imposed on passwords; that verifiers shall allow password managers and autofill; and that they should permit pasting (NIST 2025). Password fields that force users to mix in symbols and that block pasting have been rejected by the standard.

These requirements hand designers a new question. The conclusion that services should move to passkeys has been reached on the technical side, but persuading users to choose passkeys and letting them recover when they lose one is work on screens and flows. The practitioner accounts in the next section show what that work involves.

What did practitioners who deployed passkeys design?

Practitioners who spread passkeys first treated where to prompt as a design issue. Product managers at Microsoft wrote that they actively prompted users at key moments (enrollment, sign-in, and password reset), and that enrollment through the settings page accounted for fewer than 1% of all enrollments (Microsoft 2024). In the Yahoo! JAPAN case, 97% of enrollments came from prompt pages (91% after sign-in and 6% after registration), and 3% came from the management page (Yahoo! JAPAN case 2023). An engineer at Nulab compared three options and chose to prompt users immediately after they completed a password reset; about 7% of users who completed a reset then created a passkey on the spot (Nulab 2025). Placing a feature on the settings page alone leads to very little use.

Practitioners also tested and chose the words and presentation. A UX writer, an interaction designer, and a UX researcher at Google presented passkeys as an alternative to passwords rather than a replacement, and wrote that “Create passkey” resonated with users better than “Add a passkey” (Google 2023). For the action of revoking a passkey, they chose a cross icon instead of a trash icon to signal that it is not deletion. Microsoft reported that messages about “better security” and “faster sign-in” led to more enrollments than “ease of use”, and labeled the decline button “Skip for now” to treat the user’s decision positively (Microsoft 2024).

There are also failures from prompting too much. GitHub prompted users to register a passkey on 100% of applicable sign-ins, but users who had already registered a passkey and were not yet using it regularly became confused and tried to register another one, which failed; GitHub then changed its approach (GitHub 2023).

Practitioners consistently named recovery from lost credentials as a hard problem. Mercari introduced passkeys to counter real-time phishing, but wrote that users who lose all their passkeys cannot recover by themselves and must ask customer support to reset their registration (Mercari 2023). GitHub showed a checkup screen 28 days after users set up 2FA, and reported that it helped 25% of users fix configuration mistakes or lost factors and avoid account lockout (GitHub 2024). The same article states that, because of investments in user experience and design before the rollout, 2FA-related support tickets fell by one-third.

Success rates have also been published, but comparing them requires care. Microsoft reported a sign-in success rate of 98% for passkeys and 32% for passwords (Microsoft 2024), and Mercari reported 82.5% for passkeys and 67.7% for SMS one-time passwords (Mercari 2023). According to self-reports from nine FIDO Alliance members, the rate is 93% for passkeys and 63% for other methods (FIDO Alliance 2025). The denominators and comparison methods differ, and there is no external verification, so it is not possible to state in a single number how much better passkeys are. What can be stated is that every practitioner counted success rates and completion times and used them in design decisions.

The same thinking appears in how warnings are shown. When the Chrome security team considered warning users by default before they open sites over insecure connections, it tested whether the warnings would be too frequent and reported that the median user would see fewer than one warning per week and the 95th-percentile user fewer than three (Chrome Security Team 2025). The design covers both whether to warn and how often to show the warning.

If authentication screens are designed to reduce breaches, consent and cancellation screens are designed not to lose trust. Regulators in many countries already inspect these screens. In a 2024 sweep by 27 consumer protection authorities, 75.70% of 642 traders handling subscriptions used at least one dark pattern (an interface element that steers users toward choices against their interest), and 81% of traders offering auto-renewing subscriptions did not let consumers turn off auto-renewal within the purchase flow (ICPEN 2024). In a sweep by 26 privacy enforcement authorities in the same period, 97% of the websites and apps examined showed at least one indicator of deceptive design, and in 48% of cases where privacy choices were presented up front, the least privacy-protective option was selected by default (GPEN 2024). Neither sweep is a finding of illegality; both are results of examining screens against set indicators.

In enforcement, the wording and buttons on screens became direct targets. In 2025, the FTC settled with Amazon over the Prime enrollment and cancellation screens, and Amazon agreed to pay a 1 billion US dollar civil penalty and 1.5 billion US dollars in refunds (FTC 2025). The settlement requires a clear and conspicuous button for declining Prime and prohibits a decline button that reads “No, I don’t want Free Shipping.” The FTC’s 2022 report cites, as an example of design experimentation causing harm, Credit Karma’s A/B test comparing an allegedly false “pre-approved” message with a message saying the user had “Excellent” odds of approval; the company adopted the former, which produced a higher click rate (FTC 2022). A variant that wins on click rate can become the target of enforcement.

In Japan, too, the construction of screens is now written in the language of law. The Consumer Affairs Agency’s guideline on mail-order sales states that when the button on the final confirmation screen reads only “Send” or “Next” and nothing on the screen indicates that clicking it constitutes an order, consumers may be misled. The guideline adds that whether a display is misleading is judged by considering its position, format, size, color, and other features together (Consumer Affairs Agency 2024). The interim report draft of the agency’s study group states that, because problematic display and UI techniques are diverse and cannot all be listed in advance, “somewhat comprehensive rules” that can keep pace with changing dark patterns should be considered. The draft also states that illegal patterns and lawful patterns should be specified in subordinate regulations and guidelines (Consumer Affairs Agency 2026). The Personal Information Protection Commission’s policy for amending the law includes acquisition of personal information by deception or other improper means among the violations subject to administrative fines (Personal Information Protection Commission 2026c).

Figures from users point in the same direction. In a survey of 5,101 US adults, 56% said they frequently click “agree” without reading the content (Pew Research Center 2023). In JIPDEC’s Japanese survey, about 70% of respondents felt reluctant to give personal information to web services and apps, and 35% had stopped using a service (JIPDEC 2026). In the 2025 edition of the same survey, among respondents who had experienced each technique, 73.3% of those asked to register or enter unnecessary personal information just to make an inquiry, and 72.0% of those who found a subscription hard to recognize and faced fees added at the last step, stopped going further (JIPDEC 2025). Dark patterns are a regulatory problem and also a reason users leave.

Explanation after a breach is also part of designers’ work. In JIPDEC’s 2026 survey, the points respondents valued in restoring trust after a breach were careful follow-up for those affected (such as presenting measures to prevent recurrence) at 58.6% and speed of response at 51.2%, and 46.1% said companies’ information about security and personal data protection was hard to understand (JIPDEC 2026).

Who recognizes designers’ added value, and how?

Regulators have begun to ask for designers by name. The ICO’s code for designing services used by children states that it wants coders, UX designers, and system engineers to engage with its standards in their day-to-day work, and that settings must be “high privacy” by default unless there is a compelling reason not to (ICO). The EDPB recommends that controllers use interdisciplinary teams consisting of, among others, designers, data protection officers, and decision-makers to avoid deceptive design patterns (EDPB 2023). The EDPB also encourages industry to use data protection by design and by default as a means of achieving a competitive advantage when marketing products (EDPB 2020). When regulatory requirements are written in the language of screens and default settings, work for people who can translate those requirements into screens can be expected to grow.

Practitioner organizations have begun to build that work into their design processes. Microsoft Design published a UX toolkit whose best practices apply to security objectives and measures of success, threat modeling, usability testing, design sprints and reviews, and architecture reviews (Microsoft Design 2025). The UK government’s GOV.UK One Login team has carried out more than 150 rounds of research with more than 2,000 participants since April 2021, and found that users aged 13 to 17 are 20% to 33% less likely to prove their identity than the average potential user (UK Government Digital Service 2024). Stricter identity verification excludes people who lack identity documents or financial records. Finding and measuring that bias was the work of user research. The GOV.UK Design System explains that the cookie banner should not be fixed to the top of the page so that it does not cover content that has focus (GOV.UK Design System 2026). The construction of the consent screen is decided together with accessibility requirements.

For now, the value that can be shown in numbers appears in support requests and success rates. For GitHub’s mandatory 2FA, the one-third reduction in support tickets and the 25% of users who recovered by themselves through the checkup screen were described as results of investments in design (GitHub 2024). These are self-reports by the practitioners, however, and were not compared with a case in which design was not involved.

Labor market data do not yet reflect this value. The US Bureau of Labor Statistics defines digital designers’ work as developing, creating, and testing website or interface layout, functions, and navigation for usability, and the occupational description does not mention privacy (BLS 2026). In IAPP’s survey, more than 80% of privacy professionals have responsibilities beyond privacy, and 55% work in functions with AI governance responsibilities (IAPP 2024). In ISACA’s survey, soft skills (59%) top the skills gaps seen in security professionals, and communication (56%) is among them (ISACA 2025). These offer indirect signs: the neighboring occupations are expanding, and the ability to communicate with people is reported as lacking. However, within the range searched, no data were found on the share of UX job postings that require privacy expertise, on trends in postings for designers specializing in security or privacy, or on salary differences between such designers and general UX designers.

What designers can do

From the sources above, six actions are open to designers. Each is supported by practitioner accounts or regulatory requirements, but no industry source was found that compared outcomes to confirm that designers’ involvement reduced the number of breaches. The strength of the evidence is noted for each.

First, designers can reduce mix-ups through procedures and screens. Many breach reports concern documents handed to the wrong person and misdirected cards, and among listed companies’ incidents, confusing CC and BCC and misconfiguration account for about 20% (Personal Information Protection Commission 2026a; Tokyo Shoko Research 2026a). Procedures for handing over documents at counters, screens for confirming recipients, and default settings for bulk sending are within the scope of service design and UI. However, this review found no source showing by how much a specific screen or procedure reduces misdelivery.

Second, designers can design the flow for moving users to phishing-resistant authentication. Where to prompt (at key moments such as enrollment, sign-in, and reset), what words to use (presenting passkeys as an alternative), how often to prompt (not too often), and how users recover lost credentials were the shared issues among practitioners (Microsoft 2024; Google 2023; GitHub 2023; Mercari 2023). In password fields, designers should not impose composition rules and should not block password managers or pasting (NIST 2025). The evidence consists of practitioner accounts and a standard, and the companies’ figures cannot be compared.

Third, designers can inspect consent, cancellation, and final confirmation screens against regulators’ criteria. The EDPB’s classification of deceptive design patterns, the indicators used in the international sweeps, and the Consumer Affairs Agency’s guideline can be used directly as design checklists (EDPB 2023; ICPEN 2024; GPEN 2024; Consumer Affairs Agency 2024). Because a variant that won an A/B test has become the target of enforcement, designers need to measure indicators other than click rate (such as whether important terms were understood) alongside it (FTC 2022).

Fourth, designers can design notifications and explanations for after a breach. Careful follow-up and speed are what people value in restoring trust, and companies’ explanations are seen as hard to understand (JIPDEC 2026). Preparing the wording of notifications and the presentation of the actions users should take before an incident occurs is worthwhile.

Fifth, designers can join security and privacy work from the design stage. Designers can take part in threat modeling and architecture reviews and include tasks such as changing passwords and managing permissions in usability testing (Microsoft Design 2025). Regulators also recommend interdisciplinary teams that include designers (EDPB 2023). However, the effect of the toolkit is not measured in the public article.

Sixth, designers can show the value they provide in numbers. The figures practitioners used were enrollment rates, sign-in success rates, completion times, numbers of support tickets, and rates of self-recovery (GitHub 2024; Microsoft 2024; Nulab 2025). Since the labor market does not yet treat designers in this area separately, their value has to be shown not through job titles but through such figures and a record of translating regulatory requirements into screens.

Where this account does not apply

The figures on breach causes come from legal reports, disclosures by listed companies, and international breach data, which differ in population and definition, so none of them can be called the overall picture of breaches. The areas that this note describes as reachable by design (misdelivery, authentication, and consent and notification) do not include the main intrusion vectors such as vulnerabilities and ransomware. Practitioner accounts are skewed toward large companies and public bodies, success rates and reductions in support requests are self-reported, and no source compared cases with and without designers’ involvement. Among Japanese sources, apart from articles on deploying passkeys, no practitioner account was found of designers taking part in security or privacy design. No data were found that show designers’ added value through salaries or job postings.

Unverified items

No unverified statements remain in the main claims. Several sources could not be reached: the OECD report on dark commercial patterns, the joint paper by the ICO and CMA, ISO 31700-1, the EUR-Lex text of Article 25 of the GDPR and of the DSA, the final version of the Consumer Affairs Agency study group’s interim report, and the main text of the Digital Agency’s DS-511. They are recorded in the ledger with the routes tried and are not used in this note. The researcher’s reports that Microsoft’s toolkit was “trialed by 20 internal teams” and that the GOV.UK cookie banner page states that “further research is needed” could not be confirmed in the full text and are not used.

References

Author: Shuichiro Ogawa (Design Researcher / Design Consultant) About me →