Security Guides

#data breach #unauthorized access #job site #phishing #cloud #Japan

MyBRANDS Job Site Unauthorized Access and Possible Personal Data Leak (Up to About 135,000 Accounts): What Job Seekers and Employer Contacts With Names, Contact Details and Work History Should Do

iDA said on Oct 30, 2026 that names, contacts, work history and passwords (stored as a transformed value) on MyBRANDS may have leaked (up to 135,000 accounts).

Published 2026-11-02 Updated 2026-11-02 Last verified 2026-11-02 12 min read

On this page

For: anyone who has registered on the job site MyBRANDS as a job seeker or an employer contact, including people who have left the service. This article is based on the company's official notice and does not cover attack methods.

Bottom line

change passwords on services that share your MyBRANDS password, and check recruiter or scout messages through an official channel, not their links or numbers

According to the company, names, email addresses, phone numbers, profiles such as work history, and passwords (stored as a transformed value) may have leaked, in up to about 135,000 accounts. The key to decrypt encrypted items may also have been taken, so encryption is not a reason to relax.

Change the password on any service that shares your MyBRANDS password (employer contacts, also internal systems)
Do not use the links or numbers in calls, emails or texts about an "interview date", a "scout" or "document check"
Treat any contact that asks for login codes, passwords or money as fake
Send inquiries by email to the MyBRANDS office named in the official notice, not to the employer you applied to

Developing: this article will be updated as the organisation publishes more

Who is affected: anyone who has registered on the job site MyBRANDS as a job seeker or an employer contact, including people who have left the service.
Confirmed so farSee the table ↓: Data sent out
Listed as possibly affected
Name, email, phone, profile (such as work history)
Login password
Key to decrypt
Not yet confirmed: What the sent data actually contained (what was taken)
Details of how the misused key came to be used, and the cause
When all email notices will reach affected people
2 more
When the service will resume
Whether any misuse (secondary damage) occurs
What to do nowSee the steps ↓: Check whether you reused your MyBRANDS password
Job seekers: check recruiter and scout messages through an official channel
Employer contacts: warn colleagues and review the same person's accounts
2 more
Check anything claiming to be from the company without opening links in the message
Send inquiries by email to the MyBRANDS office
Where to verify (source)All sources ↓: iDA Co., Ltd., "Apology and notice regarding possible leak of personal information due to unauthorized access to MyBRANDS" (October 30, 2026; checked November 2; Japanese)
Last checked: As of November 2, 2026

Follow-up plans and what we checked

The company says it will announce on the notice page anything new it needs to tell people and the timing of resumption. On November 2 we checked the text of the October 30 notice (the company's site refuses automated access, so we read it in a browser). The text we retrieved contained no follow-up. The service is stopped and will not resume until safety is confirmed, it says.

What job seekers and employer contacts should do today

Check whether you reused your MyBRANDS password

The company asks people who use the same password as MyBRANDS on other services to change it there. For employer contacts this includes internal systems. It says no action is needed on MyBRANDS itself.

Give each service where you reused the password its own, different password (How to check if your password was leaked)
Turn on multi-factor authentication where you can
If you cannot remember them all, use a password manager

Job seekers: check recruiter and scout messages through an official channel

With your name, phone number, email address and work history together, someone can write a convincing message saying "we saw your background". If a message about an interview date, a document check or a scout arrives, do not use the link or phone number in it. Check on the employer's official site or the job posting's contact that you opened yourself.

The company says that in its contacts about this incident it will not ask for login codes, passwords or anything involving money. Do not go along with contacts that do.

Employer contacts: warn colleagues and review the same person's accounts

The name, email address and phone number of an employer contact can be the target of messages posing as business partners or applicants. Check whether you used your MyBRANDS password on internal systems and change it if so. Also tell colleagues to be careful with suspicious messages posing as job postings or applicants (this site's advice).

Check anything claiming to be from the company without opening links in the message

The company says its emails about this incident contain no links. Treat an email or text that has a link or asks you to log in as not being a notice about this incident (this site's advice). The company says its emails about this incident are sent from the addresses in section 6 of its notice. It says it will notify affected people by email in turn from October 30.

Send inquiries by email to the MyBRANDS office

The company asks that inquiries about this incident go by email to the MyBRANDS office, not to the employer you applied to or the one that sent you a scout. It accepts them 24 hours a day, with separate contacts for job seekers and employers, and asks you to write from your registered email address. Use the addresses on the official notice page.

1. Call / email / SMS claiming to be a recruiter, scout or MyBRANDS

Name, work history, phone number are correct → do not decide here

↓

2. Skip the links and numbers; check on the employer's official site or the contact in the official notice

↓

3-A Nothing on the official side

Asks for login codes, passwords, money → do not comply

3-B The official side shows the same notice

Follow the official instructions

Judge by whether you can confirm it through an official channel you opened yourself, not by whether the details in the message are correct.

What happened (according to iDA Co., Ltd.)

This section is based on the company's notice "Apology and notice regarding possible leak of personal information due to unauthorized access to MyBRANDS" of October 30, 2026 (Japanese).

October 21 to 22, 2026
A cloud access key used by a contractor was misused by a third party (company's account). The company words this as having happened "while working on a vulnerability with the service stopped" (our translation)
October 26
Learned that there were records of data being sent outside from a copy of the database (company's account)
October 30
Notice published. As of the notice, it says it had reported to the Personal Information Protection Commission and consulted the police (no date given). Email notices to affected people start in turn from this day
November 2
This site checked the text of the notice. No follow-up stated

Up to 135K

Accounts in scope (including people who have left; as of October 30, 2026, per the company)

5 items + more

Name, email, phone, profile (such as work history), password (a transformed value) and more (company)

Not included

Credit card and bank account information (company)

From the company's notice

Affected information: Name, email address, phone number, profile (such as work history) and login password (a transformed value) and more of people registered on MyBRANDS, including people who have left. It varies by registration. Information of job seekers and employer contacts is covered
Not included: Credit card and bank account information was not held and is not included. Services other than MyBRANDS, such as iDA (ida-mode.com) and MyBRANDS Shinsotsu, are not covered
Encryption and the key: Name, email address, phone number and address were stored encrypted. The key to decrypt them may also have been taken
Company response: The service is stopped and will not resume until safety is confirmed. It reported to the Personal Information Protection Commission and consulted the police. It is investigating the cause with the contractor and working on preventing a recurrence
Secondary damage: No misuse of the information (secondary damage) has been confirmed so far

What is known and what is not

This is the state as of November 2, 2026. We will rewrite this table as updates appear.

Item	What the company said	Status
Misuse of the key	A cloud access key used by a contractor was misused by a third party on October 21 to 22	Company's account
Data sent out	There are records of data being sent outside from a copy of the database	Confirmed (company)
What the sent data contained	Could not be confirmed; all information it held is treated as in scope	Under investigation
Name, email, phone, profile (such as work history)	May have leaked outside	Possible (company)
Login password	The transformed value is among the information that may have leaked	Possible (company)
Address	Not named in the list (which ends with "etc."). The company treats all information it held as affected and names address among the items it stored encrypted	Not stated
Key to decrypt	May have been taken	Possible (company)
Credit card / bank account	Not held and not included	Not included (company)
Services other than MyBRANDS	Not covered	Not included (company)
Count	Up to about 135,000 (accounts, as of October 30), including people who have left	Up to (company's upper bound as of October 30)
Details of how the key came to be used	Not given	Under investigation
Misuse / secondary damage	None confirmed so far	Not confirmed (company)
Contact with affected people	Email notices sent in turn from October 30 (when all will have received them is not published)	Company's account
Regulators	The company says it reported to the Personal Information Protection Commission and consulted the police. We have not seen a statement from the authorities	Not stated (authorities)
Service resumption	Stopped; will not resume until safety is confirmed	Under investigation (timing not published)

How to read this: "may have leaked" and "encrypted"

The company writes that the information "may have leaked outside" (our translation); since it could not confirm what was sent, it is notifying on the basis that all information it held is covered. This site uses the company's wording. Also, items stored encrypted are not safe to treat as unread, because the key to decrypt them may also have been taken. It is safest to prepare as if they have been read (this site's advice).

What names, contact details and work history can be used for

The following is what such combinations can generally lead to. The company has not said any of it happened in this incident.

Name + email address + phone number: targets for convincing calls, emails and texts posing as a recruiter or scout
Profile such as work history: lets a sender write "we saw your background" in specific terms, making the message harder to doubt. Be careful also with fake messages that use the company you applied to or the job type you want
An employer contact's name, email and phone: targets for messages that look like business email, posing as partners or applicants
Password (a transformed value): in general, short or common passwords can sometimes be worked back from the transformed value. It can be material for logging in to other services that share the password (What is password hashing?)

The company says card and bank account information is not included. Still, treat any message that uses an interview or hiring process as a pretext to ask for card numbers, account PINs or copies of ID by email or chat as probably fake.

What operators should review

How the key came to be used has not been published. We list only general points that follow from the disclosed course of events (a key used by a contractor, a copy of the database, and a decryption key that may also have been taken).

Cloud keys given to contractors: use a separate key for each contractor, limit it to the operations and period needed (least privilege), recreate it regularly (rotation), and disable it when no longer needed. Take stock of keys that are no longer used
Where encrypted data and its decryption key live: if one set of permissions reaches both, encryption does not protect the data. Keep keys in a separate key-management service or under separate permissions, so that who can read the data and who can use the key differ
Database copies: protect copies made for testing or migration as strongly as production, and delete them when done. Limit who can create copies and the routes by which data can leave
Detecting large transfers out: the company says it learned that there were records of data being sent outside. Logging outbound transfer volume and alerting on it shortens the time to notice

These are general points and do not mean the company failed to do any of them.

Sources (public records)

The facts here rest on the public information below. We have not guessed at details that were not published or at what the sent data contained. The company's site refuses automated access, so we read the text in a browser.

iDA Co., Ltd., "Apology and notice regarding possible leak of personal information due to unauthorized access to MyBRANDS" (October 30, 2026; checked November 2; Japanese) — ida-mode.com

Update history

2026-11-02: First version, based on the company's October 30 notice (checked November 2, no follow-up found).

Latest breaking reports

All breaking reports →

FAQ

QWhat may have leaked in the MyBRANDS incident?

According to the company, the name, email address, phone number, profile (such as work history) and login password (a transformed value) of people registered on MyBRANDS, including people who have left, may have leaked outside. It varies by registration. The scope is up to about 135,000 accounts as of October 30, 2026. The company could not confirm what the sent data contained, so it is notifying on the basis that all information it held is covered.

QAm I affected?

Anyone who has registered on MyBRANDS as a job seeker or an employer contact, including people who have left the service, may be affected. The company says it will notify affected people by email in turn from October 30. Because some people will not receive the email, it also says so in its notice. It says services other than MyBRANDS, such as iDA and MyBRANDS Shinsotsu, are not covered by this unauthorized access.

QWere passwords or credit cards leaked?

The company says it did not hold credit card or bank account information, so none is included. Passwords were stored as a transformed value, and that value is among the information that may have leaked. Even a transformed value can sometimes be guessed back if the password is easy to guess (general point). If you use the same password on other services, change it there.

QIs the data safe because it was stored encrypted?

The company says it stored names, email addresses, phone numbers and addresses encrypted, but the key to decrypt them may also have been taken. If the key was taken too, encryption does not protect the data. This site advises preparing as if those items have been read.

QWhat caused it?

The company says a cloud access key used by a contractor was misused by a third party on October 21 to 22, 2026, and that there are records of data being sent outside from a copy of the database. How the key came to be used and other details have not been published (as of November 2, 2026).

QWhat if someone claiming to be a recruiter or scout contacts me?

Correct details such as your name, phone number and work history do not prove a message is real. Do not use the links or numbers in it; check on the employer's official site or the job posting's official contact that you opened yourself. The company says that for this incident it will not ask for login codes, passwords or anything involving money, and that its emails about this incident contain no links.