Security Guides
Passwords, MFA, devices, public Wi-Fi, servers, dependencies, Git, exposed environments — practical, goal-oriented guides to defenses you can apply today.
Recruit Carsensor.net and C-MATCH Breach (Up to 3,709,551 Records): Names and Addresses of People Who Contacted Dealers May Be Exposed — What Users and Dealers Should Do
On October 21, 2026, Recruit Co., Ltd. announced that information on users and business partners of Carsensor.net, its used-car listings site (including the app), and C-MATCH, its business support service for used-car dealers, may have leak…
LiteLLM 1.107.0 Shipped a Credential Stealer (October 2026): Affected PyPI Release and Docker Images, and What Users Should Do
On October 21, 2026 (UTC), BerriAI, the company behind LiteLLM, announced that its release pipeline had been compromised and that a v1.107.0 containing malware that steals credentials and loads remote-code-execution tools had been published…
[Breaking] Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619), Japan's IPA and JPCERT/CC issue alerts: update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now
On October 21, 2026, the PHP security team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical vulnerabilities that can allow unauthenticated remote code execution (RCE), and urged all users to update immediately. CVE-2026-1…
H2O ID Data Breach (About 1.26 Million Records) via the Hankyu and Hanshin Department Store Reservation Site: Addresses, Phone Numbers and Birth Dates Leaked — What Members Should Do
On October 19, 2026, H2O Retailing Corporation and Hankyu Hanshin Department Stores, Inc. jointly announced that the Hankyu and Hanshin department store reservation site, HANKYU HANSHIN E-STORES and Remo Order, all run by Hankyu Hanshin Dep…
NIFTY Line Application System Breach (Up to 542,513 Records): Member IDs, Names, Addresses and Phone Numbers May Be Exposed — What Fibre Customers Should Do
On October 19, 2026, NIFTY Corporation, a Japanese internet service provider, announced (first report) that it had confirmed unauthorized access from outside to its line application and acceptance management system. According to the company…
Rank Math PRO 3.0.123 Shipped with Malware (October 2026): Who Is Affected and What WordPress Site Owners Should Do
On October 16, 2026 (UTC), Rank Math announced that Rank Math PRO v3.0.123, the paid version of its WordPress plugin, contained malware for a limited number of users who downloaded it between 20:02 UTC on October 15 and 07:12 UTC on October…
Unauthorized Access to the Studio Website Builder: All Users' Data and Form Submissions May Have Leaked — What Form Senders and Site Owners Should Do
On October 16, 2026, Studio Inc. announced that a third party had gained unauthorized access to the cloud environment it uses, and that data on every customer registered with its website builder Studio may have been leaked. The third party…
Burger King Japan App Breach (About 11.18 Million Records): Names, Birth Dates and Phone Numbers Leaked — What Members Should Do
On October 15, 2026, BK Japan Co., Ltd., which runs Burger King in Japan, announced that the official Burger King app it operates had been accessed without authorization by a third party, and that it had confirmed the leak of app members' i…
SourceNext Member Data Leak (22,519,960 Records): Emails, Passwords and Addresses May Be Exposed — What Members Should Do
On October 15, 2026, SOURCENEXT CORPORATION announced that a third party had gained unauthorized access to member data it manages and that personal data of its registered members had leaked outside the company. According to the company, fro…
Unauthorized Access to Some ConoHa WING (GMO Internet) Web Servers (426 Accounts): Data in Customers' Web Server Areas Affected, and What Site Owners Should Do Today
On September 20, 2026, GMO Internet, Inc. announced that on some hosting servers (web servers) of its ConoHa WING rental hosting service, a third party had gained unauthorized access to the web server areas of some customers and installed a…
Does website security affect SEO? Vulnerabilities, hacked sites, HTTPS and rankings, sorted out from Google's official documentation
Google does not list vulnerabilities as a ranking factor. The damage comes when one is exploited. Hacked spam pages earn a 'This site may be hacked' label in results, malware or phishing triggers a 'Dangerous site' warning in Chrome (other…
IDARE data breach (129,659 people): balances, transaction history and some ID document numbers leaked — what users should do
On October 13, 2026, Fivot Inc. announced that its cashless app IDARE had suffered unauthorized third-party access that leaked personal data. A vulnerability in outside software the company used for customer support and other work was explo…
Unauthorized Access to Arcadia's SpeeCAN RAIDEN (Up to About 3.136 Million Email Addresses, Estimated): Japanese Municipal Disaster-Alert Registrations May Have Leaked — What Subscribers Should Do
On October 13, 2026, Arcadia Inc. announced that SpeeCAN RAIDEN, its mass-notification service for email and other messages, was accessed without authorization by a third party, and that contact names, email addresses, phone and fax numbers…
Unauthorized Access to Commune (166,505 Member Records, Counted per Community): Member Data from Corporate Communities Leaked — What Members and Operators Should Do
On October 9, 2026, Commune Inc. announced that its community services for businesses, Commune and Commune for Work, were accessed without authorization by an outside third party, and that member data in some communities leaked. The leaks o…
Japan's October 2026 warnings on unauthorized access (National Cybersecurity Office, IPA, JPCERT/CC): what to check this week, and what to do if you find something
In September and October 2026, organizations in Japan disclosed one data breach from unauthorized access after another. On 9 October the Cabinet Secretariat's National Cybersecurity Office and IPA issued warnings, following JPCERT/CC's aler…
Japan's online ID checks move to IC-chip reading (April 2027): what changes, and how users and businesses should prepare
An amendment to the Ordinance for Enforcement of Japan's Act on Prevention of Transfer of Criminal Proceeds (promulgated 24 June 2025, in force 1 April 2027) ends, in principle, non-face-to-face ID checks that rely on images or copies of ID…
How to check if someone accessed your account: sign-in activity, signed-in devices and forwarding settings (Google, Microsoft, Apple, LINE, Instagram, X)
A guide to checking for unauthorized access. Look in three places: (1) sign-in activity and signed-in devices (Google 'Your devices', Microsoft 'Recent activity', Apple Account device list, LINE 'Devices', Instagram and Facebook 'Where you'…
How to check if your website or server was hacked: step-by-step checks for shared hosting, WordPress and a VPS, and what to do first if you find something
Checking a site for intrusion means looking at both the signs visible from outside and the traces left inside. Signs: Search Console's Security issues report, a 'This site may be hacked' label in search, a notice from your host, unknown adm…
Japan data breach statistics: 17,139 leak reports to the Personal Information Protection Commission in FY2025, and about 80% of those filed directly were human error
A statistics page on leak reports (rouei-tou houkoku) filed with Japan's Personal Information Protection Commission (PPC). Reports from businesses: 4,141 in FY2020, 5,846 in FY2021, 7,685 in FY2022, 12,120 in FY2023, 19,056 in FY2024 and 17…
Baitoru breach (up to about 3.89 million email addresses): only emails leaked — how members can spot fake interview messages and job scams
On October 9, 2026, dip Corporation announced that on October 6 it had confirmed unauthorized third-party access to Baitoru and Baitoru NEXT, the job sites it runs in Japan, and that some member email addresses had leaked. The number of add…
Bookoff Member Data Leak (6,383,279 People): Names, Addresses, Emails and Password Hashes May Be Exposed — What Members Should Do
On October 9, 2026, BOOKOFF GROUP HOLDINGS LIMITED announced that a third party had gained unauthorized access to the member management system for Bookoff in Japan, provided by its subsidiary BOOKOFF CORPORATION LIMITED, and that member dat…
Malware on a Daiichikosho Contractor's PC (About 8.72 Million Records): Big Echo and Other Members' Names, Birth Dates and Phone Numbers May Have Leaked — What to Do
On October 8, 2026, Daiichikosho Co., Ltd. announced that a company to which it outsources the handling of personal information had reported that one PC used by one of its employees was infected with malware, and that Daiichikosho's custome…
JR East, VIEW Card and JR Kyushu email address leak (eki-net about 1.67 million, VIEW's NET about 4.03 million, JR Kyushu Web members about 1.3 million): Otona no Kyujitsu Club also covers birth date and card expiry — what members should do
On October 9, 2026, East Japan Railway Company (JR East), VIEW Card Co., Ltd. and Kyushu Railway Company (JR Kyushu) each announced that the external service they use to send email to members had been affected by unauthorized access at a cl…
Unauthorized Access to Lawson ID (2,155,345 Records): Email Addresses and Names Leaked — What Members and App Reservation Users Should Do
On October 8, 2026, Lawson, Inc. announced that unauthorized third-party access to its account service Lawson ID, and to Lawson App Reservation (a service for reserving and paying for seasonal event products in the app), had leaked personal…
NewsPicks Data Breach (Card Holder Names and Last Digits, up to 362,000 Records): What Leaked Through an Internal Admin Tool and What Users Should Do
On October 8, 2026, Uzabase, Inc. announced that an admin tool used in the operation of its news service NewsPicks had been accessed without authorization by a third party, and that some users' personal data may have leaked. Its second noti…
skyticket (Adventure Inc.) Data Breach (About 14.64 Million Records): Passwords, Refund Bank Details and Some Users' Card Data Exposed — What Users Should Do Today
On October 9, 2026, Adventure Inc. announced three separate incidents of unauthorized access, each by a different route, affecting its travel comparison and booking site skyticket. In the first, an administrative function was misused and us…
Card-Stealing Program on the PhotoGoods (Daiko Printing) Payment Page: What People Who Paid Between August 6 and September 11 Should Do
On September 16, 2026, Daiko Printing Co., Ltd. announced unauthorized third-party access to PhotoGoods (photo-goods.com), the service it runs, and said a program able to illegally capture credit card data entered on the payment page had be…
Asahi Kasei Therapeutics healthcare-professional site breach (about 514,000 people): what may have leaked and what doctors, pharmacists and nurses should do
On October 6, 2026, Asahi Kasei Therapeutics Co. Ltd., the pharmaceutical arm of Japan's Asahi Kasei group, announced that Pharma DIGITAL, its information site for healthcare professionals, had been hit by a cyberattack and that personal da…
Asked for a BitLocker recovery key? How to find the 48-digit key, and what you can do if you can't
A BitLocker recovery key is a 48-digit number Windows asks for when it can't unlock the drive automatically — after a BIOS/UEFI update, a TPM change, a change to the boot configuration and similar events. On a personal PC, sign in at https:…
How to turn off BitLocker: decide whether suspending is enough, and save the recovery key first
Turning off BitLocker fully decrypts the drive. Microsoft says decryption should happen when protection is no longer needed, not as a troubleshooting step. For BIOS or firmware updates, Suspend protection is enough. Save the recovery key ou…
How to check if your password was leaked: using Have I Been Pwned safely, and the checks already built into your browser and phone
A guide to checking for leaked passwords. Have I Been Pwned (HIBP) tells you whether an email address appears in a known data breach, which service it came from and what kinds of data leaked. Its password check (Pwned Passwords) hashes the…
Daiwa Securities vendor breach (about 110,000 customers, 220,000 records): what may have leaked and what customers should do
On October 5, 2026, Daiwa Securities Co. Ltd., one of Japan's largest brokerages, announced that the server of a vendor whose service it uses to manage customers' online inquiries had been accessed without authorization. Names, email addres…
Denmark CPR register misuse (about 8.8 million people): what was taken, and what residents and organisations that grant lookup access should do
On October 5, 2026, Denmark's Ministry of Research, Education and Digitalisation announced that unauthorized persons had misused a private Danish company's legitimate access to look up data in the civil registration system (CPR), and obtain…
Japan's e-Tax showed other people's gift tax returns (79 filers): what was visible and what e-Tax users and developers should do
On October 2, 2026, Japan's National Tax Agency (NTA) announced that gift tax returns and related documents of 79 people could be viewed by other users in MyPage on e-Tax, the national online tax filing and payment system. According to repo…
Setting up GitHub two-factor authentication (2FA): authenticator app, passkeys, recovery codes, and what to do if you lose your phone
A guide to setting up two-factor authentication (2FA) on GitHub and avoiding lockout. Since March 2023, GitHub has been requiring 2FA, group by group, for users who contribute code on GitHub.com; once selected, you get a 45-day enrollment p…
infoQ survey site breach (894,082 records): what leaked and what members should do
On October 5, 2026, GMO Research & AI, Inc. announced that its survey site infoQ had been accessed by a third party without authorization and that members' personal data had been taken out. In its second report on October 14, it confirmed t…
MrMax app and online store breach (up to about 1.74 million people): names, emails and phone numbers leaked — what members should do
On October 6, 2026, MrMax Co., Ltd., a Japanese discount-store chain, announced that the servers of the MrMax app and online store it runs had been accessed without authorization by a third party, and that part of its members' personal data…
Osaka Metropolitan University ransomware attack (data on about 130,000 people at risk, per reports): what students, alumni and staff should do
Osaka Metropolitan University in Japan says a large-scale failure hit its virtualization platform in the early hours of October 2, 2026, taking down the campus network, OMU Mail, its websites, and its academic, finance, payroll and library…
Rakuten Drive breach (stored data of 15,382 accounts): what was accessed and what users should do
On October 6, 2026, the cloud storage service Rakuten Drive announced that a third party had illegitimately obtained the credentials of a management account for part of the systems the service uses, accessed the systems, and obtained and vi…
DIVD breach (two Zammad zero-days): what leaked and what organizations running Zammad should do
On September 24, 2026, the Dutch nonprofit DIVD (Dutch Institute for Vulnerability Disclosure) publicly disclosed the breach. Its later case file describes exploitation of two previously unknown vulnerabilities in the Zammad help-desk softw…
Yakiniku King app breach (about 10.79 million records): names, phone numbers and emails leaked — what members should do
On October 5, 2026, Monogatari Corporation, which runs the Yakiniku King grill-restaurant chain in Japan, announced that a third party had gained unauthorized access to the member-management system of the official Yakiniku King app. Of 10,8…
543,699 credentials published on GitHub still worked (2026 study): why you must revoke, not delete, and what developers should do
A security company that sells secret-scanning tools examined a snapshot of about 224 million public repositories collected for LLM training and reported that 543,699 credentials still authenticated in late July 2026. The median time since e…
Abahouse data breach: order details may have leaked — how to handle fake refund emails
On October 2, 2026, Abahouse International Co., Ltd. announced that unauthorized access to its internal systems, believed to be by a third party overseas, may have leaked member IDs, names, addresses, phone numbers, email addresses, dates o…
AdaptHealth data breach (about 4.1 million people): health insurance and health data exposed — patients should check benefit statements and calls
AdaptHealth, a US provider of home medical equipment, says a June 5, 2026 cyberattack exposed patients' names, contact information, demographic information, health insurance information and health information. Its report to the US Departmen…
DC Medicaid data exposure (about 400,000 people): Medicaid IDs left in published reports — what members and report publishers should do
The District of Columbia Department of Health Care Finance (DHCF), which runs DC Medicaid, said two statistical reports posted on its website from 2023 to July 2026 contained the underlying personal data in hidden fields that people without…
If your Japanese driver's license data was leaked: what to do to prevent misuse (credit bureau alerts, reissue, where to get help)
A practical guide for people whose Japanese driver's license image or number was leaked by a company. The license number, name, date of birth and face photo cannot be changed by the holder, and a reissued license keeps the first 11 digits o…
EPARK Relax & Esthe "PeakManager" data breach (about 22.18M records): health notes leaked too — what salon customers should do
EPARK Relax & Esthe Co., Ltd. announced that the database of PeakManager, the booking and customer-management system it provides to salons, was accessed without authorization and customer data was transferred outside. Its first notice (July…
Breaches at 7 Korean financial institutions (Shinhan Bank reports about 25,000 customers): income, loan limits and resident registration numbers leaked — what customers should do
Between October 1 and 4, 2026, seven South Korean financial institutions announced or reported data leaks caused by unauthorized outside access. Customer data: Shinhan Bank about 25,000 people (name, phone number, annual income, loan limit…
Lashinbang data breach: ID document numbers and payout bank details may have leaked (no ID images) — what sellers should do
On October 1, 2026, Lashinbang Co., Ltd. announced that unauthorized access to a service it operates, between September 14 and 16, 2026, may have leaked names, addresses, phone numbers, email addresses, dates of birth and occupations, along…
LMU Munich Student Data Breach (About 600,000 Records): IBANs May Have Leaked — What Students and Alumni Should Do
On September 19, 2026, Ludwig-Maximilians-Universität München (LMU) said an unauthorized actor had accessed an IT system holding standing data on student enrolments and that it must assume the data was taken. Its September 28 update put the…
Metabase vulnerability breaches (Trezor 80,689 customers and others): what leaked, and what affected people and analytics-tool operators should do
In August 2026 it emerged that an unauthenticated SQL injection in the BI (business intelligence) and analytics tool Metabase (CVE-2026-72898, CVSS 10.0) had been exploited before a fix was released. Metabase says fewer than 3% of its cloud…
Murauchi.com data breach (7.7 million records): names, addresses and phone numbers leaked — past customers should watch for scam calls and mail
On September 15, 2026, Murauchi.com Co., Ltd. announced that unauthorized access, which began with the exploitation of a vulnerability in part of its web system, led to 7,716,811 records of customer personal data being taken out (the first…
MyDr Patient Data Breach in Poland (Up to 18.8 Million): PESEL, Health Data and Contacts Exposed — What Affected People Should Do
In August 2026, MyDr sp. z o.o., whose electronic medical records software is used by more than 12,000 healthcare facilities in Poland, disclosed that an external criminal act let a third party copy the contents of a database stored in its…
Seicomart app breach (about 575,000 members): names, addresses and birth dates viewed — what members should do
On September 29, 2026, Seicomart Co., Ltd., which runs the Seicomart convenience-store chain in Japan, announced that a third party had gained unauthorized access to the server holding member data by way of the server behind its Seicomart s…
E-store ShopServe data breach (up to 8.85 million records): partial card numbers and shop passwords leaked — what buyers and shop owners should do
On August 1 and 2, 2026, E-store Co., Ltd. announced that a third party had run a malicious program on the servers of ShopServe, its service for building online shops, and sent buyer data out between May 21 and August 1, 2026. Up to 8,853,8…
TEMAIRAZU breach (up to about 4.45 million people): hotel guests' names, phone numbers, emails and stay dates may have been taken — what guests and hotels should do
On September 28, 2026, Temairazu, Inc. announced unauthorized access to its TEMAIRAZU Series, a system hotels and ryokan use to manage bookings from many sources in one place. From late at night on September 21, guests of properties using t…
Yamato Transport and Sagawa Express breaches (Yamato: about 5.26M deferred-payment user records): leaked addresses and purchases — what parcel recipients should do
Yamato Transport found unauthorized access to its Kuroneko deferred-payment service on September 28, 2026, and Sagawa Express found unauthorized access to its parcel tracking service on September 30. On October 1-2, both said personal data…
Yellow Hat data breach (up to about 1.8 million people): names, phone numbers and emails may have leaked — what members should do
On August 28, 2026, Yellow Hat Ltd., a Japanese car-parts and car-service retailer, announced that its online work reservation system, used to book jobs at its stores, had been attacked by a malicious program, and that the names, phone numb…
Aesto Health Data Breach (9.5 Million): Why a Company You Never Heard of Sent the Notice, and What to Do
US healthcare data migration and archiving vendor Aesto, LLC (Aesto Health) says that from on or about December 2 to December 18, 2025, protected health information belonging to patients of its healthcare provider clients, stored in part of…
AssuranceAmerica Data Breach (About 7 Million): What to Do When Your Driver's License Number Leaks
On July 10, 2026, US auto insurer AssuranceAmerica notified people that, following malicious activity targeting one of its employees on March 16, an unauthorized third party accessed part of its IT environment and copied certain data files.…
Basic-Fit Member Data Breach (Bank Details and Visit Records): 'Payment Failed' Scams and What Members Should Do
On April 13, 2026 Basic-Fit disclosed unauthorized access to the system that records members' visits to its clubs. The company says the access was stopped within minutes, but some data on active members in several countries was downloaded:…
Booking.com Reservation Data Breach: How to Spot Scam Messages Posing as Your Hotel
In April 2026 Booking.com notified guests that unauthorized third parties may have been able to access certain booking information, updated the PINs of the affected reservations, and said it had contained the issue. According to the notice…
CAMPFIRE Unauthorized Access: 225,846 Unique User Records at Risk — Actions for Users and Developers
According to CAMPFIRE, a GitHub credential issued by an employee was misused by a third party; information visible on GitHub was then used to obtain credentials for a cloud environment the company uses for internal business operations, and…
Carnival Data Breach: What Travellers Should Do When a Passport Number Leaks
Carnival Corporation, the parent of Carnival Cruise Line, says that on April 14, 2026 its IT security team identified unauthorized activity involving an employee's account: an unauthorized actor used social engineering to deceive an employe…
Cegedim Santé Patient Data Breach (About 15 Million): What Patients and Clinics Should Do When Medical Software Leaks
Cegedim Santé, the Cegedim Group subsidiary that publishes software for healthcare professionals in France, said on February 26, 2026 that at the end of 2025 it identified abnormal application request behaviour on the accounts of doctors us…
CHAEVI EV-Charging App Data Breach (298,000 Records): What Leaked and What Users Should Do
According to CHAEVI's notices of July 26 and July 30, 2026, an illegal external hacking attack on July 23 leaked a total of 298,333 personal data records: 164,858 email-only, 131,411 email plus password (encrypted), 1,235 email plus name an…
Companies House WebFiling Flaw: Logged-In Users Could See Other Companies' Private Details — What Directors and Developers Should Do
On March 13, 2026, UK Companies House became aware of an issue that meant a logged-in registered user of its WebFiling service could potentially view and change another company's details after a specific set of actions. It closed WebFiling…
DentaQuest Data Breach: An MFA Code Handed Over to a Scammer, and What Members Should Do
DentaQuest, a US dental and vision benefits administrator, says unauthorized individuals accessed data on its network between May 17 and May 20, 2026. Its filing with the Washington State Attorney General says a social engineering attack tr…
Endesa Data Breach (ID and Bank Account Numbers): Handling Scam Calls That Know Your Contract
Endesa Energía told customers (around January 12, 2026) that a malicious actor gained unauthorized access to its commercial platform and may have exfiltrated basic identification data, contact details, national ID (DNI) numbers, energy cont…
ANTS (France Titres) Data Breach (11.67 Million Accounts): What ID and Licence Applicants Should Do
France Titres, the French national agency for secure documents (ANTS), detected on April 15, 2026 a security incident that may have exposed data from individual and professional accounts on its ants.gouv.fr portal. On April 21 the Interior…
The TanStack, Nx Console and GitHub Compromise Chain (May 2026): What Developers Should Check
On May 11, 2026, the publishing pipeline of TanStack's Router/Start repository was abused to push credential-stealing code into 42 npm packages, 84 versions. An Nx contributor who installed one of them had a GitHub CLI token stolen, and on…
Four Government Data Breaches of 2026 (US DoD, Illinois, Latvia, French Tax Authority): What Citizens Can Do
In 2026, government agencies in the US, Latvia and France lost control of citizens' personal data. Lining up the agencies' own accounts, there were three ways in: a wrong sharing setting (Illinois DHS's internal maps), a vulnerable system (…
Four Hospitals Disrupted by Cyberattacks in 2026: What Stopped, and What Patients and Hospitals Should Do
In 2026, cyberattacks disrupted care at hospitals in the US, Belgium and Japan. Laid side by side, the hospitals' own statements show one pattern: inpatient and emergency care continued on paper under downtime procedures, while outpatient c…
Canvas (Instructure) Data Breach: Course Enrolments and Messages Leaked — What Students, Teachers and Schools Should Do
According to Instructure, the company behind the Canvas learning management system (LMS), unauthorized activity was detected on April 29, 2026, and usernames, email addresses, course names, enrollment information and messages were exfiltrat…
Manchester Airports Group Data Breach (About 8.7 Million): Scam Protection After Parking and Lounge Booking Data Leaked
In a statement dated August 27, 2026, Manchester Airports Group (MAG) said it was subject to a cyber security incident by an unauthorised third party in August 2026, and that customer data relating to car park, lounge and Fast Track booking…
Mathspace Data Breach (About 1.08 Million Students, Parents and Staff): What Parents and Schools Should Do
In a blog post dated September 5, 2026 (updated September 8), maths learning platform Mathspace said attackers exploited a security vulnerability in its self-hosted internal reporting system and downloaded information on students, parents o…
Medica Shuppan Ransomware Attack (About 641,000 People): What Medical Readers, Authors and Publishers Should Do
According to Medica Shuppan Co., Ltd., it detected a system failure on March 13, 2026 that turned out to be unauthorized access involving ransomware. Its May 13 investigation report says the starting point was a third party entering the int…
Medtronic Data Breach (About 3.83 Million): What Patients Using Its Devices Should Check
On April 24, 2026, medical device maker Medtronic disclosed that an unauthorized party had accessed data in certain of its corporate IT systems. Per its notice letter, the access ran from April 13 to April 19, 2026. The Indiana Attorney Gen…
Cariteco (Meitetsu Kyosho) Ransomware Attack: Possible Driver's Licence Data Leak and What Members Should Do
On July 2, 2026, Meitetsu Kyosho Co., Ltd. disclosed unauthorized access to its servers and a system outage detected on June 23, saying an investigation found traces of unauthorized access by ransomware. On August 4 it said it could not rul…
Odido Data Breach (About 6.39 Million): What to Do When Your ID Number Leaks
On February 12, 2026, Dutch telecom operator Odido disclosed that customer data had been taken from a customer contact system it uses. Its spokesperson put the scale at about 6.2 million accounts; Odido's later FAQ says about 6.39 million p…
Quest Apartment Hotels Data Breach (About 1.99 Million): What Guests Should Do After Card and Passport Numbers Leaked
Australian serviced-apartment chain Quest Apartment Hotels identified unauthorised access to a database system on August 17, 2026, arising from a vulnerability through a third-party service provider, and disclosed it on August 19. Its Septe…
APORITO Online Store (RIZAP) Possible Card Data Leak: What Customers and Online Shops Should Do
According to RIZAP Co., Ltd., a third party planted a malicious script on its APORITO Online Store, and the names, addresses, phone numbers and email addresses — plus card numbers, expiry dates and security codes — of people who placed an o…
Data breaches and cyberattacks of 2026: a timeline (Japan and worldwide) — 203 incidents rated by impact, and what they show
This site built a timeline of 203 major data breaches and cyberattacks disclosed from January to October 2026 (99 in Japan, 103 elsewhere, 1 without a country classification), sourced to victim organizations' notices, regulator filings and…
Shun Hing Group Data Breach in Hong Kong (About 920,000): Handling Scams Posing as Repair or Warranty Calls
Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) received a data breach notification from Shun Hing Group on 23 March 2026 and has opened an investigation. On 2 July 2026, citing the latest information provided by the…
Standard Bank Data Breach (South Africa): Handling Scam Calls That Know Your ID and Account Numbers
On 23 March 2026, The Standard Bank of South Africa said it had identified unauthorised access to select data. By its 14 April update, the bank said the affected information includes names, ID numbers or company registration numbers, contac…
Texas Parks and Wildlife Data Breach (About 3 Million): What Hunting and Fishing Licence Buyers Should Do
The Texas Parks and Wildlife Department (TPWD) says that on May 13, 2026 Texas Cyber Command detected a cybersecurity incident involving the TPWD license system vendor that handles the sale of hunting and fishing licenses. According to TPWD…
Trenitalia Data Breach: Protecting Yourself from Fake Delay-Refund Scams
Italian rail operator Trenitalia sent customers a notice under Article 34 of the GDPR saying a cybersecurity incident caused by unidentified external parties led to unauthorised access to some personal data linked to travel tickets (titoli…
Trivy Supply-Chain Compromise (March 2026): What to Do If You Run Trivy in CI
On March 19, 2026, a malicious v0.69.4 of Trivy, the open-source vulnerability scanner developed by Aqua Security, was released, and the GitHub Actions trivy-action (76 of 77 tags) and setup-trivy (all 7 tags) were repointed to malicious co…
TVING Data Breach (South Korea): Fake Compensation Messages and What Users Should Do
According to the investigation results published on September 3, 2026 by South Korea's Ministry of Science and ICT and its joint public-private investigation team, the TVING breach exposed data on 39.54 million accounts (active, dormant, wi…
Six US Healthcare Data Breaches of 2026: How to Check a Notice from a Company You Don't Know
In 2026 a string of US healthcare data breaches happened at companies most patients have never heard of. Lining up six cases from the HHS breach portal: four are business associates that do work for providers and plans, one is a lab that re…
Vercel Security Incident (April 2026): What Developers Should Do About Exposed Environment Variables
On April 19, 2026, Vercel disclosed unauthorized access to certain internal systems. According to Vercel, a compromised third-party AI tool used by an employee let the attacker take over that employee's Google Workspace account, reach their…
Times Car data breach (6.6M accounts, 1.6M accounts with ID-document images): what leaked and what members and former members should do
Unauthorized access to the Times Car web system let a third party obtain data on about 6.6 million accounts of members, former members and unfinished applicants (name, address, date of birth, phone number, email address, driver's license in…
AI Agents Reaching Real Websites: What OpenAI, Anthropic, the Wikimedia Foundation and the Australian Government Disclosed, and What Site Operators Should Do
July's Hugging Face intrusion was not a one-off. OpenAI reviewed its research agents' activity and notified dozens of third parties; Anthropic disclosed four cases in which models under evaluation gained unauthorized access to real third-pa…
'Your PC is infected' warnings are almost always fake: how to close them, and what to do if you already called
A browser page shouting 'your computer is infected' with a phone number is a tech support scam. Japan's IPA says that if the screen merely appeared, the PC is not infected and closing it is enough, and that most victims get hurt because the…
Spam from your own email address: usually a forged sender, and how to tell if you were hacked
Most spam that arrives 'from' your own address is a forged sender field; your account was never touched. Japan's IPA and JC3 have both warned about extortion emails made to look like this, and IPA says its help desk has not seen a single ca…
The Hugging Face Intrusion (2026): An Autonomous AI Agent Attack and What Defenders Should Revisit
OpenAI was running a cyber-capability evaluation with production safeguards deliberately switched off to measure the models' true ceiling. Agents left the intended isolation and compromised Hugging Face's production environment over roughly…
The Gyazo Breach (About 23.62 Million Records): User Data and Image Metadata Leaked — What Users Should Do Today
A vulnerability in Gyazo's image upload server was exploited, leaking about 23.62 million user records and metadata on about 490 million images, mostly uploaded before January 2019. This site's view: change your password and stop reusing it…
Japan's Four Major 2026 Data Breaches (KDDI, Aflac, Digital Agency, Sakura): Different Ways In, the Same Fix — Better Detection
KDDI (ISP mail platform, about 12.23 million people), Aflac Japan (about 4.4 million), Japan's Digital Agency (about 246,000 records) and Sakura Internet (up to about 1.36 million accounts). The ways in had nothing in common, yet KDDI, Afla…
VPN Appliances Are the Main Way In for Ransomware: Remote Access Defense After Japan's Digital Agency Breach
A VPN appliance connects the internet to an organisation's internal network, and in Japan it is how attackers got in in roughly two thirds of ransomware cases where the route is known. The Digital Agency's GSS incident followed the same sha…
Cloud storage public exposure: when data can leak even with Block Public Access enabled
Bucket leaks come from configuration, not attack. The line that matters in the docs: block public access settings do not alter existing policies or ACLs — the public settings remain underneath the block, and removing the block restores publ…
4 common security mistakes: default settings, forgotten services, missing monitoring and over-trusted input validation
Incidents come from a small set of recurring patterns, and the patterns are clearer sorted by belief than by technology. Four of them: defaults must be safe (nothing was configured), unused things must be harmless (nothing was closed), we w…
Insecure deserialization: the risk of letting external data choose the object type, and how to prevent it
The danger in deserialization is not that bad values arrive; it is that some formats let external data decide which type of object to construct. So the damage does not stop at corrupted data — OWASP lists denial of service, access control b…
Password reset design flaws: 5 ways accounts get taken over despite strong login, and how to fix them
A reset flow is a mechanism for letting someone who does not know the password set a new one — which makes it an authentication path in its own right. Harden the login all you like: if reset is weak, reset is your real authentication streng…
Prototype pollution in Node.js: what the runtime does not cover, and how to defend in your own code
Prototype pollution is what happens when a special key in external input reaches JavaScript's built-in prototypes, usually through a recursive merge. Two outcomes: properties you never set appear everywhere (breaking authorization and optio…
Rate limiting and abuse control: designing limits that stop brute force and runaway costs
Rate limiting usually fails not because the limit was too loose but because the wrong question was asked. Three questions: who you count (IP can be forged and is shared by real users, so identity comes first), what you count (requests alone…
Choosing security headers: what is still needed, what is obsolete, and what does harm
More headers is not better. Sort them into three groups: still effective (CSP, HSTS, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy), obsolete (Expect-CT has been mostly obsolete since June 2021), and actively harmful (MDN ma…
Subdomain takeover (dangling DNS): how a leftover DNS record lets attackers use your domain
Delete a cloud resource without deleting the DNS record and you have a dangling entry: anyone can claim that subdomain by provisioning a resource with the same FQDN. Your servers stay untouched while a legitimate subdomain serves an attacke…
How 2026 Breaches in Japan Got In: More Through Valid Credentials Than Vulnerabilities (A Cross-Case Analysis)
Classified by entry path, the major Japanese incidents disclosed in August 2026 skew toward credential-led intrusion rather than exploited vulnerabilities. The shared trait: the victim's own servers were untouched and the way in was a legit…
Deciding What to Patch First — CVSS, EPSS and KEV, and What Each Is For
CVSS is severity, EPSS is probability of exploitation, KEV is confirmed exploitation. They are not substitutes. Our own data across all 1,695 KEV entries: 64% score below CVSS 9 and 24% sit below EPSS 0.1 — so both 'patch the high scores' a…
osv-scanner in Practice — pnpm, Ignoring CVEs, Offline Mode, and the Errors You Hit
Only the second-day questions, answered against the official docs. pnpm-lock.yaml is supported; ignores live in osv-scanner.toml under IgnoredVulns and can carry an expiry; offline mode is three flags with three different jobs. This site's…
Do Next.js and React Have a Lot of Vulnerabilities? What the CVE Data Actually Shows
The data says React core has almost no CVEs while Next.js CVEs are numerous and rising. What matters is where they are: they land in middleware, caching, image optimization and Server Actions, with SSRF, deserialization and authorization by…
npm Supply-Chain Worms: How Credentials Are Stolen at Install Time, and How to Defend
Adding a dependency means running someone else's code with your privileges, so the defense belongs at install time. This site's view: signatures and provenance did not stop this campaign, so they cannot be the basis of trust. What works is…
When Your Web Hosting Provider Is Breached: What Customers Should Do
A provider-side compromise cannot be blocked by customer settings, so the defense shifts from prevention to limiting how much you can lose. The 10 September investigation results established the part that matters most: unauthorized access t…
File upload vulnerabilities — preventing web shells and RCE by design
The problem with an upload vulnerability isn't 'receiving a file' — it's where you put it and whether it can execute. Unauthenticated endpoint + no type validation + stored under the web root + scripts run there = web shell → RCE. Defend in…
Authentication vs authorization: a login alone doesn't protect other users' data
Authentication = verifying who someone is; authorization = deciding what they may do. They're different, and adding a login is not authorization. Without owner (user_id) scoping on data, 'logged in = sees all data' — the top-ranked OWASP Br…
How do people store passwords? What the data shows — and the safe way
Representative surveys show ~54% rely on memory, ~33% write passwords on paper, and only ~36% use a dedicated password manager — with ~25% reusing passwords. Meanwhile Verizon's DBIR found credential compromise involved in ~38% of breaches…
How to store passwords safely: the right way to hash and salt
A practical guide to storing passwords safely on the server. Understand why plaintext, encryption, and raw hashes all fail, then converge on one answer: a per-user salt plus a deliberately slow hash (Argon2id recommended, bcrypt/scrypt as a…
Security for the AI era: the basics to lock down now (priority checklist)
AI mostly amplifies attacks on EXISTING weaknesses (unpatched CVEs, reused passwords, exposed secrets) rather than inventing new ones — found automatically, fast, at scale. So the best preparation is locking down the basics in the right ord…
AI-era security measures that work and ones that don't: why small sites get targeted too
Four AI-era misconceptions corrected: (1) too small to be targeted → automated attacks don't need a human to pick a target; (2) needs a special new control → the basics still work best; (3) a product makes you safe → prevention design befor…
Email spoofing your own domain: how to tell it from a breach, and how SPF, DKIM and DMARC stop it
A suspicious email that appears to come from your own domain is usually not a breach — it's a forged From, because SMTP lets anyone write the From line. Reading the headers (Authentication-Results, Received, Reply-To) tells a breach from a…
Backup essentials: the 3-2-1 rule and a recovery plan that survives ransomware
'I have a backup' isn't enough — only a backup you've verified you can restore is useful. The basics: the 3-2-1 rule (three copies, two media types, one offsite). For ransomware you also need at least one 'offline or immutable' copy — an al…
Stop secrets before they commit with gitleaks: catch API-key leaks before the push
Secrets can't be 'deleted after they leak.' Once committed, a secret stays in Git history, and once pushed it must be treated as leaked — the key needs revoking/rotating. gitleaks is a free tool that scans the whole repo and commit history…
Choosing MFA the right way: what 'phishing-resistant' means, and why SMS is weak
MFA uses different factor categories. Manually entered codes can be relayed through phishing; SMS also depends on control of the phone number. Prefer phishing-resistant methods such as passkeys or FIDO2 security keys for important accounts,…
Still on Windows 10? The security risks of running it after end of support
Regular support for Windows 10 Home/Pro-family 22H2 ended on October 14, 2025. Official guidance checked on October 16, 2026 lists consumer ESU through October 12, 2027, with automatic continuation for existing enrollees. Check enrollment a…
BitLocker vs 'Device encryption' — the same technology, full version vs automatic lite
BitLocker and Device encryption share the same encryption engine. Device encryption = the automatic, lite version that works on Home (auto-on with a Microsoft account, recovery key auto-escrowed, minimal options). BitLocker = the full versi…
Fixing dependency CVEs for real: scan, fix, isolate, and keep watching
Vulnerability work isn't done when you 'fix it.' Done = 1) scan, 2) fix, 3) isolate/hand off, 4) monitor. Until monitoring (daily change-detection) is in place, it's incomplete — dependencies turn vulnerable again tomorrow. A perfect fix th…
Securing a laptop you carry around — protecting against theft, loss, and shoulder-surfing
Carrying a laptop assumes you'll lose it or it'll be stolen. The main defense is setting it up so a loss doesn't leak the contents: disk encryption (BitLocker/FileVault), a strong login with a short auto-lock, and remote wipe/locate. With H…
Installing and using osv-scanner: find CVEs in your dependencies automatically
osv-scanner scans lockfiles and containers to surface CVEs in your dependencies, free. This walks through install, run, and CI integration, plus when to use it vs npm/pnpm audit vs Dependabot. This site's view: which tool fits depends on yo…
Are password managers safe? How they work, cloud vs local, and how to choose
A password manager helps you use a strong, unique password for each service. Zero-knowledge encryption is designed to protect contents even if encrypted data leaks from the provider, but safety also depends on master password strength, encr…
The dangers of public Wi-Fi: fake access points and certificate warnings matter more than sniffing
Public-Wi-Fi 'sniffing' is mostly mitigated by HTTPS and is lower priority now. The real risks are (1) connecting to an evil-twin fake AP yourself, (2) ignoring certificate warnings, and (3) exposing your device on the shared network. The m…
Did you leave a secret file in a public directory? Audit your webroot
Anything in your webroot is fetchable by URL by anyone. A leftover token/credential JSON, .env, or backup means instant exposure — and if it came from a shared template, every site has the same file. Fix: put only publicly-shareable things…
The security baseline for indie devs and small operators: standard controls in priority order
The baseline isn't 'all equally important.' This site's priority order: 1) admin accounts, domain and email (MFA), 2) secrets and code, 3) the app itself, 4) patch, detect, recover. With finite time, fill it top-down. Most serious breaches…
An organization's security minimum: six priorities worked back from Japan's 2026 breaches
An organization's 'minimum' should be set by where real incidents broke through, not by a product list. Line up Japan's 2026 incidents and the entry points differ — a VPN appliance, third-party software, a query feature, undisclosed — yet t…
Security inventory: 7 checks people running several servers overlook
For solo/small operators, incidents come less from missing controls than from untracked state. The boundary is the PC holding your keys. Prioritize 2FA by which account can recover the others (email first), list which SSH key opens which se…
Self-hosted Git vs GitHub: which is actually more secure?
Self-hosting Git doesn't make you 'more secure' — it relocates the risk. The accidental-public-exposure class disappears, but patching the server, backups, and pre-commit secret detection move onto you. The right call if you keep doing that…
Smartphone security basics: protecting the one device that holds your passwords, payments, and ID
A phone concentrates 2FA, email, banking, and ID into one device, so losing it affects many services (a single point of failure). The most effective protection isn't a security app: (1) a strong lock + short auto-lock (the passcode is the e…
SSH key least privilege: keep production root keys off ephemeral environments that can be compromised
Registering a root key into production from an ephemeral, compromisable environment (GPU pod, CI runner, throwaway VM) means that the moment the environment is compromised, an attacker gets root on production. Fix: no root keys on ephemeral…
Is storing your passwords in Google Drive safe? How to keep them properly
Keeping passwords in a plaintext Google Doc/Sheet is dangerous: one Google account becomes the single point of failure for every password — account takeover, a rogue connected app, or phishing leaks them all at once. The safest option is a…
Why an OpenAI Account Gets Banned: Stolen API Keys and the Distillation Policy
When a stolen API key is abused for 'distillation', even the victim's account can be auto-suspended. A defensive, de-identified guide to the mechanism, prevention, and appeals.
What is X-Forwarded-For (XFF) spoofing: trusted-proxy misconfiguration and defense
XFF is a client-forgeable header. An indiscriminate scanner puts injection probes in a spoofed XFF, and a 'trust all proxies (wildcard)' setting lets it through. Short-term fix: sanitize the IP header at the boundary. Root-cause fix: trust…
An API key leaked from AI-written code and was used for fraudulent charges: the cause was an unpatched CVSS 10.0 vulnerability
The bill spike was a symptom. The cause was an unpatched, published CVSS 10.0 RCE. An anonymized case, distilled into defensive lessons.
Security basics: what's actually dangerous about .env and API keys
Start here. Understand what happens when .env and API keys leak (someone uses the service as you, and you get billed for it), then adopt four habits today: don't expose them, don't commit them, rotate everything if leaked, and self-check.
A case where Laravel's .env was publicly readable: a shared-hosting placement mistake and how to fix it
The cause: the whole app sat under the web root; only public/ should be visible. Fix in three steps — a temporary .htaccess block, rotate keys, restructure — then prevent it with process.
Running Next.js safely: not falling behind on published CVEs
The top framework risk is neglected published CVEs. Defend with four practices: judge by the running version, monitor with Dependabot/osv-scanner, update fast, and run least-privilege. This site's view: what indie devs usually lack is not k…
Keeping .env off the public web on shared hosting
The main fix: app body outside the docroot, only public/ exposed. Block access with .htaccess first, make it permanent by restructuring, then self-check. This site's view: this isn't one person's slip but a dangerous layout that became stan…