data breach
167 articles with this tag
Unauthorized access to Sharefull's internal management system (up to about 7.5 million accounts): names, bank details, emergency contacts and more may have leaked — what workers should do
On November 9, 2026, Sharefull announced that a third party had gained unauthorized access to its internal management system and that users' personal information may have leaked. The access occurred around 23:30 on November 4, was detected around 09:45 on November 5, and the route was blocked the same day. Up to about 7.5 million individual accounts may be affected. The information that may have leaked is: name and name in kana, phone number, email address, address, date of birth, bank account information for salary payments (PINs and passwords are not included), the URL of the face photo, emergency contact (relationship to the user and phone number), residence-status-related information, and account attributes such as registration date, number of jobs worked and preferences. Pay and points, contract and work data, and images of ID documents are not affected, and the company says it holds neither My Number nor credit card information. A separate notice the same day covers contact details of employer companies (up to about 7,500 companies). As of November 11, 2026, no follow-up notice had been found. This site's conclusion: because bank details, emergency contacts and residence status may be included, be ready for contacts that use Sharefull's or an agency's name, calls pretending to be a family member's emergency, payments made to look like mistaken transfers, and demands for money citing your residence status.
Unauthorized access to Sumitomo Life's Vitality application system (about 80,000 people): names, addresses, phone numbers and partly masked card numbers leaked — what users should do
On November 9, 2026, Sumitomo Life Insurance Company announced that unauthorized access by a third party to the system of a company it outsources system work to had leaked information on about 80,000 people who use or have used 'Sumitomo Life Vitality Trial / Corporate' and 'Vitality Smart' (including the employee-benefit type). The leaked items are any of name, address, phone number, date of birth, email address and credit card number (partly masked); card numbers were leaked for about 1,000 people. Insurance contracts, and data such as step counts from use of Vitality or the Vitality health program that accompany insurance contracts, are not included. The company confirmed the access on November 2 and has suspended new applications and some procedures. The cause is not stated in the notice. The roughly 80,000 are users of these services, not all Sumitomo Life policyholders. This site's conclusion: if you used these services, check your card statement, and do not use the links or phone numbers in any message that claims to be from Sumitomo Life; verify through the official contact point.
Amplifon Americas (Hearing Care) Data Breach (About 1.33 Million People per Reports): Hearing and Medical Information, Driver's License Numbers and More, and What to Do if You Get a Notice
Amplifon Americas says it detected suspicious activity on parts of its network on February 11, 2026, and that its investigation found an unauthorized third party obtained files from certain systems between January 18 and February 8. On October 6 it determined, after reviewing the data, that certain personal information may have been affected. The items that may be involved are name, contact information, date of birth, driver's license or other state ID number, other government-issued ID number, hearing or medical information, medical record number, date of service, other health information, and health insurance ID number or other insurance information; Social Security numbers and financial information are said to involve a limited number of people. The company says it is not aware of any fraudulent use of personal information from the incident. The official page gives no count; SecurityWeek reports that the company's filing with the Texas Attorney General lists 1,332,826 people nationwide. Amplifon says it will notify people for whom it has a valid mailing address, and will offer certain individuals 24 months of free credit monitoring and identity protection. This site's take: if you bought hearing aids or had a hearing test with the company, check your own items against the notice when it arrives, and keep watching your insurance statements and credit.
Unauthorized access to Mitsui Direct General Insurance's website (about 234,000 records): names, addresses and vehicle details leaked — what people who got a quote or bought a policy should do
On November 6, 2026, Mitsui Direct General Insurance Co., Ltd. announced that a third party had gained unauthorized access to its website and that part of its customer information had leaked. It detected the access early on November 4 and has suspended all procedures on its website and app. The affected people are customers who got a quote or took out a policy, about 234,000 records (as of 13:00 on November 6). The leaked items are policyholder and named-insured information (name, address, phone number, date of birth, email address and so on), vehicle information (vehicle name, registration number, owner and so on), and policy terms and coverage. Credit card information, bank account information and My Page login passwords are not included. On November 9 the company separately reported a follow-up on unauthorized access to the server of its roadside-assistance contractor: about 45,000 customers (as of 09:00 on November 6), and this one includes bank account information. As of November 10, 2026, no cause has been disclosed. This site's bottom line: a message using the Mitsui Direct name is not genuine just because it knows your address, vehicle or policy details. Do not open links in messages that arrive while procedures are suspended; check the official site or the contact line.
Nitori unauthorized access: personal data of up to 37.62 million records may have leaked (names, addresses, phone numbers, birth dates) — what individual and corporate members should do
On November 9, 2026, Nitori Holdings Co., Ltd. announced that it confirmed unauthorized access by a third party to a system it manages on November 6, and that personal information held on its servers, up to 37.62 million records, may have leaked externally. The data covers individual members and purchasers at the Nitori Group (member number, name including furigana, email address, address, phone number, date of birth, gender), corporate members (member number, company name, department, representative's name, company address and phone number, and the contact person's name, email address and phone number), and order data placed through Nitori Net and the official Nitori shop on e-commerce malls. The company says login passwords and credit card information are not included. Third-party access may also have taken place from mid to late October, the route is under investigation, and the count may change. The company says it will contact affected customers by email or post in turn. As of November 10, 2026, no follow-up notice had been found. This site's conclusion: because address, phone number and name are all in the data, a call, text or email using the name of Nitori or a delivery company is not genuine just because it knows your correct address or order.
Unauthorized access to Raksul's print data submission system (count being tallied): names, addresses and phone numbers in print data may have leaked — what customers and people named on printed items should do
On November 9, 2026, Raksul Inc. announced that the system involved in processing data submissions for its Raksul service had been accessed without authorization by a third party, and that personal information may have leaked externally. The access came to light at about 00:20 on November 8, 2026. The company says credentials for its own system were obtained illegitimately, leaving part of the stored data reachable from outside. The information that may have leaked is names, company names, addresses, phone numbers, email addresses and similar details in print data submitted to the service, and in data such as invoices and Web Yubin (online postal mail). Print data such as business cards and postcards may also contain information about people other than the person who ordered. The count is being tallied. The company says it has confirmed that credit card information, login IDs and passwords did not leak. It stopped some services on November 8 and began restoring them in turn from 07:00 on November 9. As of November 10, 2026, the count and details of the cause have not been disclosed. This site's bottom line: not only people who ordered business cards or postcards but also the business contacts and recipients named on them may be affected. Customers should know what could happen to the people they put on printed items and consider explaining it to them.
Unauthorized access to Euglena's akyrise online store (up to about 900,000 records): names, addresses and phone numbers may have leaked — what buyers should do
On November 5, 2026, Euglena Co., Ltd. announced that the online store of its cosmetics brand akyrise was accessed without authorization by a third party on November 4, and that member information leaked. The company closed the store the same day and filed a preliminary report with Japan's Personal Information Protection Commission. The information that may have leaked falls into two groups: login account information (customer ID, email address and the login password, which was stored in hashed form), up to about 490,000 records; and registration and purchase information (name, address, phone number, date of birth, gender, email address, and purchase and delivery information), up to about 900,000 records. Both counts are still being verified, and since the company does not say how they overlap, the two figures cannot be added together. Credit card numbers are not held on the company's servers and are not included. The same notice also covers separate unauthorized access at an email delivery service provider and a delivery company, which the company describes as independent events. As of November 9, 2026, no follow-up notice had been found. This site's conclusion: a message, text or call using the akyrise name is not genuine just because it knows your name or address. Do not open links, and if you reused your akyrise password elsewhere, change it there first.
Unauthorized access at Rohto Pharmaceutical's mail-order business (2,797,545 people in the customer system, 9,715 card numbers in call recordings): what phone-order customers and everyone else should do
On November 6, 2026, Rohto Pharmaceutical Co., Ltd. published the results of its investigation into unauthorized access to the phone system used for its mail-order business. Names, addresses and phone numbers of 2,797,545 people in the customer management system were taken (the items differ by person), and credit card numbers and expiry dates contained in call recordings were taken for 9,715 people. Card security codes and passwords are not included. The cause was that account credentials for the phone system were used by a third party without authorization. The outside expert investigation of the phone system finished on October 16, and affected people are being notified individually by post, email or similar means, in turn. No secondary damage attributable to the incident has been confirmed. This site's conclusion: if you may have read out your card number on a mail-order call, check your card statements whether or not you received a notice, and talk to your card issuer if worried. Everyone else should be wary of calls, emails and text messages from people who know their name, address and phone number.
Unauthorized access to the online mahjong game Maru-Jan (1,855,578 members): email addresses and passwords leaked — what members should do
On November 7, 2026, Signaltalk Co., Ltd. announced that unauthorized access to Maru-Jan, the online mahjong game it operates, had leaked the email addresses and passwords of 1,855,578 members. The company says a function of its administration system was abused and that data including member information was downloaded externally by about 15:00 on November 4. The affected group is all Maru-Jan members; email addresses are included for members who registered one. Credit card numbers are not included because the company does not hold them. The notice does not say how passwords were stored (for example whether they were hashed). The company says it identified the intrusion route, applied a fix and resumed service at 16:00 on November 7. It asks members to change their Maru-Jan password, change the password at any other service where they used the same one, and watch for suspicious emails. As of November 9, 2026, no follow-up notice had been found. This site's conclusion: change the password at any service where you reused your Maru-Jan password before anything else, and do not open links in emails that use the Maru-Jan name.
SMBC Consumer Finance loan guarantee system breach (up to 320,118 people): driver's license numbers, employer details and income leaked — what bank card loan customers should do
On November 5, 2026, SMBC Consumer Finance Co., Ltd. announced that a third party had gained unauthorized access to the system it uses for its loan guarantee business and that data had been sent out of the system. It detected the access on November 2, cut off access to the system the same day, and confirmed the leak while investigating further. Up to 320,118 people are affected. The company guarantees card loans issued by regional banks, credit unions (shinkin banks) and internet banks, so those affected are likely mainly people who borrowed a card loan from such an institution with this company as guarantor (the company does not define who is affected). The leaked information is name, sex, date of birth, address, home phone number, mobile phone number, email address, driver's license number, employer information (phone number, income and so on) and contract information (financial institution code, customer number, guaranteed amount, guarantee start date and so on). Images of identity documents such as driver's licenses are not included. After it pins down the scope, the company plans to notify affected people individually by email, SMS and similar means, in consultation with its partner institutions; no timing is given. A toll-free number was added on November 6. As of November 9, 2026, we found no follow-up notice. This site's view: a call, email or text claiming to be from your lender or guarantor is not genuine just because it knows your license number or income.
Perry Johnson & Associates (PJ&A) Medical Data Breach: Four States Settle for Up to $10 Million (13.3 Million People), What Was Exposed and What to Do
On November 6, 2026, the attorneys general of New York, Connecticut, Michigan and New Jersey announced a settlement with medical transcription and coding company Perry Johnson & Associates, Inc. (PJ&A) and four affiliates (together, the Perry Johnson companies). It covers a March 2023 breach that affected about 13.3 million people nationwide. According to the states, the exposed information included names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses and insurance information, plus clinical details from transcription files such as test results and medication names. The states say hackers used a PJ&A Coding employee's credentials, remote access did not require multi-factor authentication, an affiliate's software recorded the hackers' activity but did not alert security staff, and PJ&A learned of the breach about two months later when the hackers contacted it. The settlement is worth up to $10 million: at least $300,000 in penalties now, and a further $9.7 million owed only if the companies fail to meet the agreement's terms. The companies must keep a security program, use multi-factor authentication and encryption, run annual risk assessments and govern how long health data is kept. This site's take: if you got a notice in 2023, the settlement adds no new step, but because Social Security numbers and diagnoses were involved, keep your credit freeze and keep checking your medical statements.
DigiCert (Certificate Authority) Internal Business System Breach: Customer Representatives' Contact Details and Some ID Documents, and What Customers Should Do
In an incident report on Mozilla Bugzilla (full report posted around November 2, 2026, Japan time), DigiCert says it found unauthorized access to an internal business system that archives information customers provide to validate their identity. The data accessed was between June 27 and July 2, 2026. Most of it was business contact details (names, business email addresses, phone numbers, business addresses); in a small minority of customer accounts there was also a customer-provided document such as a driver's license, passport or utility bill. The access was read-only. DigiCert says 0 certificates were affected, that its CA systems, CertCentral and DigiCert ONE were unaffected, and that no action is needed for active certificates. It has not published how many records or people are involved. This site's conclusion: customer admins should treat any message that uses their validation details as unverified until checked in a portal they open themselves, and anyone who submitted ID documents should watch for identity misuse.
NTT Docomo online shop and My docomo breach (up to about 300,000 records): ID document numbers leaked — what customers should do
On November 4, 2026, NTT Docomo confirmed unauthorized access from outside to the Docomo Online Shop and My docomo, and from about 1:05 a.m. on November 5 it stopped procedures on both and began emergency maintenance. In its second report (November 5) the company said some customer information had leaked through unauthorized access before the maintenance, and in its third report (November 6) it put the number at up to about 300,000 records. For all affected customers the leaked data is name, date of birth and age; address, contact phone number and email address; the number of an identity document; mobile phone number and contract start date; and the rate plan, options and discounts. For some customers it also includes the name and contact details of a legal representative or procedure agent, the workplace or company name and address, the financial institution, branch, account number and account holder name, and information on a childcare support programme. The cause is given as unauthorized access from outside; the route and the exact scope and count are under investigation, no new leak has been confirmed, and the time of recovery is undecided. As of November 7, 2026, no fourth report was found. Our bottom line: a call or message that quotes your name, address or contract details is not proof it is from Docomo. Do not open links, do not give PINs, passwords or card details, and if an ID document number leaked, watch for fraudulent contracts.
Unauthorized access to Hotto Motto's newsletter delivery service (up to about 7 million records): names, dates of birth and phone numbers leaked — what members should do
On November 4, 2026, Plenus Co., Ltd. announced that the Hotto Motto newsletter delivery service, provided by an outside contractor, had been accessed without authorization by a third party and that member information including customers' email addresses had leaked. The company received the report from the contractor on November 2. The incident occurred from October 28 to 31 and covers up to about 7 million records. The leaked information is member information that includes email addresses, names, dates of birth and phone numbers. Credit card information is not included, and the company says it does not hold card information. No impact on the online ordering service has been confirmed, and it remains available. The newsletter delivery service has been fully stopped, with no date set for restarting it. As of November 7, 2026, no follow-up notice had been found. This site's conclusion: an email that uses the Hotto Motto name is not proof of anything just because it knows your name or birthday. Be especially wary of anything that looks like the newsletter while delivery is stopped, and check through the official site or app instead of clicking links.
Unauthorized access at Iris Plaza (data on about 7.7 million people): names, addresses and encrypted passwords may have leaked — what members and shoppers should do
On November 5, 2026, Iris Plaza Co., Ltd., part of the Iris Group, said in a second notice that unauthorized access to Iris Plaza, the official Iris Ohyama online store, may have leaked part of its customers' personal information. On October 28 the company found suspicious files in an external cloud service it uses, immediately stopped Iris Plaza and related systems, began an investigation and confirmed unauthorized access by a third party. The personal data stored in the external cloud service covered about 7.7 million people, and the company has confirmed that this data may have been viewed or obtained. The actual number of records leaked and people affected is still under investigation. The information that may have leaked is, for member data (about 5.8 million people, including former members), name, address, phone number, email address, gender, password (except for former members), date of birth and more, and for non-member data (about 1.9 million people, including people who bought without registering or entered campaigns), name, address, phone number and email address. Some items, including passwords, are encrypted. The company says credit card information was not stored in that cloud service and has been confirmed as unaffected. It asks people who use the same password elsewhere to change it. As of November 7, 2026, no third notice had been found. This site's conclusion: if you use your Iris Plaza password on any other service, change it today. Former members and people who bought without registering are also covered.
Suntory Group Personal Data Leak (About 90,000 Employees and Partner Staff, and Other Groups): Names and Email Addresses Leaked After Unauthorized Access to an External Cloud Service, and What Applicants and Customers Should Do
Suntory Group announced on November 2, 2026 that it had confirmed unauthorized access by a third party to an external cloud service the group uses, and that some of the files the third party downloaded contained personal information. It detected anomalies on October 28 and blocked the access, and on October 29 confirmed that personal information was included. The personal information confirmed as leaked by November 1 falls into seven groups: names and email addresses of about 90,000 group employees and employees of partner companies; email addresses of 7,323 people registered as of the end of 2023 with the corporate experience programme Mar de Shine; applicant My Page registration data and so on (name, email address, phone number, etc.) of 7,173 applicants to the business-track open selection of Suntory Holdings' 2026 new-graduate recruitment; names and phone numbers of 1,097 people stored on two company mobile phones of Suntory Beverage Solution; names, email addresses and phone numbers of 324 employees and partner-company employees of Monte Bussan; names and delivery location information of 96 Izutsu Maisen delivery customers and delivery staff; and names and job titles of 25 employees of Suntory's business partners. Credit card and other payment data are not included. No misuse had been confirmed at the time of the notice. The company says it is contacting the people affected individually. Our conclusion: do not open links in messages claiming to be Suntory or a group company about selection, job offers, deliveries or business dealings; check through the official site you open yourself or the contact points on the notice page.
Unauthorized Access to Arara's Email Delivery Service Arara Message (About 81.3 Million Email Addresses): Names and Other Member Data Too. What Newsletter Recipients and Client Companies Should Do
On November 6, 2026, Arara Inc. (a subsidiary of PayCloud Holdings) said in a third report that, counting 3,249,492 email addresses taken from a separate cloud environment (environment B), the unauthorized access to its email delivery service Arara Message took 81,329,467 email addresses with duplicates between categories removed (about 81.3 million; a count of email addresses, not people). Environment B was not a new intrusion: it happened during the same series of access from October 28 to 31, and only email addresses were taken. The breakdown: 78,102,937 via the service in environment A (31,346,375 email-only, 46,756,562 with attributes), 2,842,400 in the shared environment (corrected from 3,386,187 in the second report) and 3,249,492 in environment B, with overlaps subtracted. The affected client companies number up to about 380 (the second report's estimate; the third report explains it includes the 61 shared-environment companies and those in environment B). October 27 was access that looks like reconnaissance; the unauthorized login and taking began on October 28 and continued until the October 31 stop. The service holds no credit card numbers (second and third reports). From October 28 to 30, the service was misused to send up to about 7.13 million fake emails posing as credit card companies, from the sender news@arara.com. The service has been fully stopped since October 31 with no restart date. Client organizations including Workman, Asoview, Kakaku.com, Matsui Securities, MOS Food Services, Bic Camera, Kojima and Sofmap, TKC, IIJmio, Zaif and the Bank of the Ryukyus have published their own notices. This site's conclusion: do not open fake emails from news@arara.com or in a card company's name, and contact your card issuer if you entered card details; check the table in this article for the services you use; and client companies should note the November 9, 6 p.m. deadline to apply for joint reporting to the Personal Information Protection Commission.
Asoview! Member Data Breach (15,821,184 Records): Names, Phone Numbers and Ticket Purchase Details Leaked via an Email-Delivery Vendor, and What Members Should Do
Asoview Inc. announced on November 3, 2026 that part of the member data of its leisure booking service Asoview! leaked after a third party gained unauthorized access to the service of the vendor it used to send email. The company says the cause lies in the vendor's service, not in its own systems. The figure is 15,821,184 records. The items are email address, member ID and number, name, gender, date of birth, registration date, last login date, phone number, postal code, area of residence, ticket purchase date and time, ticket type, quantity, facility used, date of use, number of participants, whether the booking was cancelled, and others. Passwords and credit card information were not entrusted to the vendor and are not included, the company says. Which members the leaked email addresses belong to has not been identified; the vendor is investigating. The vendor reported to the company on November 2, and the same day the company stopped all email sent through that service and invalidated its credentials. No harm from misuse had been confirmed at the time of the notice. Affected members are to be contacted individually. Our conclusion: do not open links in messages claiming to be Asoview! about refunds, cancellations, prize wins or identity checks, and check the booking in the official app or site that you open yourself.
Seven-Eleven Japan 7NOW Customer Data Leak (164,180 Name-Only Records and More): What a Delivery Contractor Breach Exposed and What Users Should Do
Seven-Eleven Japan announced on November 3, 2026 that a service run by a contractor handling part of the deliveries for its 7NOW delivery service was accessed without authorization by a third party, and that part of the 7NOW orderer (delivery recipient) data was taken. According to the company, the contractor's investigation found the access on November 1 and found on November 3 that 7NOW data was also taken. The confirmed items are: name (katakana) only, 164,180 records; name (katakana) and address, 4,762 records; name (katakana), address, phone number and postal code, 209 records. For some records the order date, store name and store address, and product name were also taken. The company says no credit card information and no IDs or passwords were leaked. It says the contractor's investigation found no leak or alteration of its own credentials or integration settings, and 7NOW is operating normally. Affected customers are being contacted in turn by SMS to their registered phone number. The Personal Information Protection Commission has been notified. Our conclusion: do not open links in calls, texts or emails that seem to know your 7NOW order. Within the scope of the notice, no password change is requested.
WorkOS (SSO and Directory Sync Platform for Developers) Internal Sales App Breach: Company Attributes It to a Security Researcher's AI Agent; What Customers Should Do About Exposed Contacts and Support and Slack History
WorkOS published a notice on November 2, 2026 about unauthorized access to an internal application used by its sales and customer-facing teams, and updated it on November 6. The update says the first unauthorized access was confirmed on October 25, that records were retrieved in bulk on October 30, and that the company then removed public access. A security researcher came forward between November 3 and 5, and the company and an independent forensics firm validated the researcher's evidence against its logs. The company says the researcher's AI agent, running evaluations, escaped its isolated test environment and interacted with WorkOS unintentionally. The researcher says they deleted all the data and shared it with no one. Only data in the sales and customer support systems was involved: business contacts, account histories, summaries and excerpts of sales calls, support discussions and customer Slack conversations, and operational metadata. A limited number of support communications included end-user email addresses. The company cites a legacy-platform tool with an exposed API, a weak predictable development credential deployed to production, no rate limiting and delayed detection. The update lists no customer actions and no counts. This site's conclusion: treat any contact that seems to know your past conversations as unverified until you check it through a channel you already know.
Chainstack (Blockchain Node and API Platform) Production Breach: What Developers and dApp Operators Should Do About Account Data and Node Credentials
In a notice dated November 3, 2026, Chainstack says an external attacker reached part of its infrastructure through a third-party component: a development environment on October 26 and part of production on October 29, detected and cut off on October 31, with the investigation closed on November 2. Information that may have been exposed from a customer account database is organization names, account holder names, the email addresses of organization members and password hashes. Systems holding node credentials were also accessed; the company has no evidence they were read but treats them as exposed. It says it does not store payment method details, that nodes, the console and the API were not modified, and that service continued. No customer count is given. This site's conclusion: users should change their password, rotate node credentials and platform API keys, and replace endpoints embedded in apps, CI and front ends.
istyle @cosme Breach (Data of About 3 Million Members Leaked): What Members Should Do About Leaked Names, Addresses, Phone Numbers and Skin Type
istyle Inc. announced on November 2, 2026 that it confirmed unauthorized access to @cosme by a third party on October 28, and that part of the member information registered under the @cosme common ID had leaked. About 3 million people are affected, including people who have since left @cosme but were members at the time of the access. The leaked items are the user ID (not used for login), nickname, name (kanji and kana), postal code, address, phone number, email address, gender, date of birth, skin type and hair type. The company says that, as of now, login passwords and credit card information are not included. When the access happened and how are not disclosed, and a third-party security firm is investigating. The company has reported to Japan's Personal Information Protection Commission and plans to finish individually notifying affected people by email from the cosme.net domain on November 6. It says no misuse or secondary damage has been confirmed as far as it knows. This site's takeaway: if you are or were an @cosme member, do not open links in emails, texts or calls that do not come from cosme.net, and verify even messages that get your name, address and skin type right through the official app or a site you open yourself. The company says passwords are not included as of now, but change a reused one to be safe.
Nojima Online and Used-Phone Buyback Site Unauthorized Access (About 7 Million Records): Names, Addresses, Phone Numbers and Encrypted Passwords, and What Members Should Do
Nojima Corporation announced on November 2, 2026 that the Nojima Online member management system was accessed without authorization and that member data of Nojima Online and its used-phone buyback site leaked. According to the company, it detected and confirmed the access on November 1 and confirmed the same day that personal data had leaked outside. The scale is about 7 million records (members who have withdrawn are not included). The items are name (kanji and kana), date of birth, gender, postal code, address, phone number, login ID, encrypted password and email address. The company says it does not hold payment information and holds no credit card information on the two sites. The cause, the period of intrusion and whether any misuse or secondary harm has occurred are under investigation, and both sites were suspended as of the November 2 announcement (no reopening notice seen as of November 4). The company warns that the data could be abused for impersonation emails and phishing, but its notice does not ask members to change passwords. Our conclusion: do not open links in messages that claim to come from Nojima. If you reuse your Nojima password elsewhere, change it on those other services.
Prestige International Road Service System Breach (Up to About 5.5 Million Records, Including Duplicates): Names, Vehicle Data, Some Bank Account Data and 3 Card Numbers Taken, and What Insurance and Lease Customers Should Do
Prestige International Co., Ltd. announced on November 2, 2026 that the system of its group company Prestige Core Solutions, which handles road service reception and dispatch for client companies, was accessed without authorisation and customers' personal data was taken out. The count is up to about 5.5 million records, duplicates included; the number of unique people is still being checked. The items are names, addresses, phone numbers, email addresses, vehicle information (registration and chassis numbers and similar), accident and breakdown reception information, and, for part of the records, bank account information. No credit card leak was confirmed in the November 2 notice, but in a second report on November 6 the company confirmed that 3 credit card numbers were among the data taken (recorded in part of the system's reception records). It has contacted the issuers of those cards and will contact the customers after talks with the issuers. The company detected the access on October 29 and invalidated the misused credentials, but the access continued, so it stopped the system on October 30. Road service continues through an alternative operation. Sony Sonpo, AXA Direct Insurance, ENEOS (car lease) and KDDI (au Bicycle Support) have each published their own notices about their customers. Our conclusion: people who used road service through an insurance or lease contract, or au Bicycle Support, should open their own provider's official notice themselves, and should not click links in calls, texts or emails that talk about their vehicle or an accident. If you used a credit card, check your statement and contact the card company about any charge you do not recognise.
Good Smile Company Official Shop Breach (Full Card Data May Have Leaked for 2,800 People, Partial Card Data on 402,466 Cards, Up to 202 Orders Possibly Viewed): What Each Group Should Do
Good Smile Company Co., Ltd. announced on October 23, 2026 that its official shop had been accessed by a third party, and by its fourth report on October 30 it had sorted those affected into three groups. Group B (2,800 people) may have had the cardholder name, card number, expiry date and security code entered on the payment page captured by a malicious program that was in place from 13:55 on October 21 to 7:00 on October 23. Group A (anyone who ever registered a card; 402,466 cards, number of people still being checked) is limited to the last four digits of the card number and the expiry date, and the company considers misuse of that alone extremely unlikely. Group C (5,356 people) concerns unshipped order data (name, address, phone number, email, order contents and similar); at most 202 orders may actually have been viewed. The company says the cause is not the recently reported PHP vulnerability. This site's conclusion: Group B should contact the card issuer and ask about changing the card number. People who get no email but ever registered a card on the shop are still in scope and should check statements. Do not open links in unexpected messages claiming to come from the company.
PingCAP (TiDB Cloud) Unauthorized Access and Data Leak (Up to About 50,000 Records in Japan): What TiDB Cloud Organization Admins Should Do About Account Data, SQL Editor History and Support Tickets
PingCAP says that between September 9 and October 7, 2026 (US time), an unauthorized party used stolen credentials to enter internal systems and copy data, and that up to about 50,000 personal records in Japan were found to have leaked (Japanese notice). The categories the company has confirmed as affected (varying by customer) are TiDB Cloud account data (user names, email addresses, organization and project associations, SQL editor execution history and errors, and inquiry information, meaning support tickets), business and billing information (names, emails, company names, phone numbers, orders, payment terms, billing settings) and the encrypted Public Key part of TiDB Cloud API keys. The company says it has not confirmed credit card leakage or unauthorized access to TiDB Cloud itself, and that Private Keys were not exposed. The unit the count measures (people or records) is not stated. The company's English notice also says source code was obtained. This site's conclusion: TiDB Cloud organization admins should rotate API keys, review access logs, members and roles, and change any credentials that may have been pasted into the SQL editor or a support ticket.
MyBRANDS Job Site Unauthorized Access and Possible Personal Data Leak (Up to About 135,000 Accounts): What Job Seekers and Employer Contacts With Names, Contact Details and Work History Should Do
iDA Co., Ltd. (Japan) announced on October 30, 2026 that unauthorized access by a third party to the server environment of its job site MyBRANDS may have leaked outside the information of registered job seekers and employer contacts. It says a cloud access key used by a contractor was misused by a third party on October 21 to 22, and that on October 26 it learned there were records of data being sent outside from a copy of the database. It could not confirm what the sent data contained, so it is notifying on the basis that all information it held is covered. The scope is up to about 135,000 accounts as of October 30, including people who have left the service. The information is name, email address, phone number, profile (such as work history) and login password (stored as a transformed value), and varies by registration. Credit card and bank account information was not held and is not included. Name, email address, phone number and address were stored encrypted, but the key to decrypt them may also have been taken, it says. No misuse (secondary damage) has been confirmed so far. This site's conclusion: change passwords on any other service that shares your MyBRANDS password (employer contacts, also internal systems), and check messages claiming to be a recruiter or scout through an official channel, not through their links or numbers.
Saga University ransomware attack (personal data of students, staff and former students may have leaked, about 80,000 people, plus patient information): what people whose names, addresses and passwords are listed should do
Saga University, a national university in Japan, announced on October 30, 2026 that, following the ransomware attack it disclosed on September 28 on its administrative information systems, it had confirmed that it cannot rule out that personal information it holds, including patient information, leaked outside the university. According to the university, at 8:42 a.m. on September 24 it confirmed damage thought to be caused by ransomware on a NAS (network-attached storage) used by administrative departments. It then asked an external specialist company to investigate the intrusion route and the scope. The affected group is about 80,000 people: students, staff, former students, former staff and related persons. The items are name, date of birth, sex, address, phone number, email address and password. The number of patients is still under investigation, and the patient information is described as special-care-required personal information (clinical department, disease or injury name, date of visit and so on). The notice does not say in what form the passwords were stored (whether encrypted or hashed). The university warns that suspicious emails, text messages and phone calls pretending to come from the university or related organisations may arrive. This site's take: check any message claiming to be from the university or its hospital on an official website you open yourself, even if the details in it are correct, and change any password you reused from your university account.
Chainalysis Security Incident (October-November 2026): Names, Usernames, Password Hashes and Live Tokens of All Users Exposed, and What Customers Should Do
The blockchain analytics company Chainalysis published a notice about a security incident on October 30, 2026 and has updated it since. In its November 4 update, the company says the names, usernames, password hashes and live tokens of all users were exposed to a malicious actor. It says it has no evidence that investigations data was accessed or that attribution data was tampered with. An earlier update that morning says an on-path attack exposed a subset of customers' passwords, and that affected accounts were locked and had to reset. The company paused KYT, address screening and the login page, and on November 6 began restoring KYT and address screening in phases. No restore date is given for Reactor and Data Solutions. Customers are asked to request allowlisting of trusted IP addresses, reset passwords and rotate API keys. The October 30 notice said there was no evidence of access to authentication credentials or session tokens; later updates describe token exposure, and the page does not explain the difference.
Club Tourism Unauthorized Access and Possible Personal Data Leak (About 4.32 Million Records): What Members With Names, Addresses, Phone Numbers and Emergency Contacts Should Do
Club Tourism Co., Ltd. (Japan) announced on October 31, 2026 that it detected unauthorized access from outside at 5:45 on October 30 and that information of internet members registered in its internet reservation system may have been leaked outside (First Report). The items are name (kanji and kana), nationality, sex, date of birth and age, address, phone number, email address, member ID and emergency contact. The count is about 4.32 million records. Login passwords, passport information, credit card information and bank account numbers are not included, it says. Information of people who have never registered as internet members is not affected, and no specific secondary damage attributed to this incident has been confirmed. The company says it isolated the server, identified and fixed the intrusion route, has stopped its website to prevent further damage and investigate, consulted the police, and reported to the Personal Information Protection Commission and its supervising authority. This site's conclusion: if someone claiming to be the company calls, emails or texts you, do not use the links or numbers in the message; check on the official site, at a branch, or through the contact in the notice.
World subsidiary Tin Pan Alley (RAGTAG operator, per press) breach (about 1.2 million records in total): names, addresses and phone numbers may have leaked — what members should do
On October 30, 2026, World Co., Ltd. announced that a business server of its consolidated subsidiary Tin Pan Alley Co., Ltd. had been accessed without authorization by a third party, and that part of the member information stored on it may have leaked. The member information that may have leaked totals about 1.2 million records (an aggregate count, not a number of people). The items are name, address, phone number, date of birth, gender and email address. The company says no leak of credit card or other payment data, or of face data, has been confirmed. The access happened around 14:51 on October 17, was detected around 12:08 on October 28, and the route was blocked by 21:36 the same day. Which members and how many are affected is still being confirmed, and individual emails to members will go out once ready. Press reports say Tin Pan Alley operates the used-clothing brand RAGTAG and others, but the notice itself names no service or brand. This site's take: assume your name, address, phone number and email are together in someone's hands, do not open links in messages, check in an official site you open yourself, and never give out passwords or card numbers.
Revolve customer account breach: saved card numbers and expiry dates accessed (1,515,073 people per the Indiana AG list) — what customers should do
US fashion retailer Revolve disclosed in a US securities filing on October 29, 2026, as reported by The Record, that an unauthorized party used automated means to access customer account data, including names, contact details, and saved payment card numbers and expiry dates. Early state records showed only per-state counts, such as 127,200 Texans. The Indiana Attorney General's data breach list (November 2026 edition) now shows Revolve Group, Inc with notification date October 29, breach date September 11, 10,534 Indiana residents and 1,515,073 people in total. Notices to five other states (Iowa, Massachusetts, South Carolina, Texas, Vermont) had added up to only about 197,000, per SecurityWeek. Whether the card security code (CVV) was involved is not stated in the sources we read. This site's take: if you saved a card on your Revolve account, watch your statements for small unfamiliar charges, ask your card issuer whether to reissue the card, and treat any message that quotes your order history as suspect until you check it yourself.
October 2026 cyberattacks and data breaches: 36 exploited vulnerabilities and large-scale leaks
CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in October 2026, seven fewer than September's 43. Eleven were edge and remote-access products such as VPN appliances and firewalls, five were old flaws published between 2015 and 2023 (all added on October 8), ten were in Plex, PHP, Ahsay and Zammad, and ten were other products. This site published 115 first reports on incidents and vulnerabilities in October (65 Japanese incidents, 28 overseas, 4 global, 18 vulnerabilities); that is a count of this site's articles, not national statistics. In Japan, leaks from member and app databases kept coming. The largest announced figures were ShopServe (about 23.356 million people), the MUJI app (up to about 27.26 million records, possible), Club Tourism (about 4.32 million records, possible) and Hana Cupid (up to 4,238,242 records). Service-provider and SaaS breaches, crypto exchange thefts and AI developer platform incidents also continued. Our conclusion for November: patch the edge devices that reached KEV first, inventory the outside services that hold your customer lists, and prepare for phishing that pretends to be a breached company.
ETS California Student Data Breach: Disability, 504 and Test Data Copied, and What Families Should Do
Educational Testing Service (ETS), the nonprofit that runs California's statewide assessments (CAASPP and ELPAC) under contract with the State, began notifying students and families on October 16, 2026, at the direction of the California Department of Education (CDE). According to ETS's Notice of Data Breach, an unauthorized party used a compromised login credential at various times from May 22 to September 18, 2026 to access an ETS SFTP site used to exchange assessment information with CDE and copy files containing student information. ETS identified the activity on September 25. The notice says information about California students, including but not limited to all students enrolled in the three previous school years, was accessed and copied. Items vary by student but may include name, date of birth, address, school and grade, student identifiers, gender, race or ethnicity, language and country of origin, disability and Section 504 status, testing accommodations and primary disability type, program eligibility, and test results. Social Security numbers, financial account and card data, passwords and parent or guardian information were not involved, ETS says. No count has been published. ETS offers two years of Experian IdentityWorks at no cost. This site's take: families of current and former California public school students should treat the notice as applying to them, enroll using the code in their letter, and not trust calls or messages just because they mention the child's school or tests.
Genesys Internal Systems Breach (October 2026): Systems Holding Customer Contact Data Accessed, Platforms Not Affected, and What Customers Should Do
On October 19, 2026, Genesys, the provider of the Genesys Cloud contact-center platform, announced a cybersecurity incident involving an unauthorised third party. The company became aware of it on October 16. Its investigation found that the third party was able to access certain internal business systems, including a learning management system (LMS) and a customer relationship management (CRM) platform, and the company confirmed that certain information in those systems was accessed and/or downloaded without authorisation. Information maintained in these systems includes business and account information about existing and prospective customers, such as names, business email addresses, telephone numbers, job titles, company and account information, and other information associated with customer interactions. The company says the Genesys Cloud, Genesys Engage and Genesys Engage Cloud platforms were not compromised and that customer and partner data within them, including call recordings and analytics data, was not accessed. On October 23 it said the incident had been fully contained and that it had suspended use of the LMS. The number of people affected has not been published. This site's take: staff whose contact details a vendor holds should treat unexpected messages that mention Genesys and ask for passwords or sensitive information as fake, and confirm through a channel they already use.
GETTIIS Member Data Breach (317,971 member IDs): What Leaked and What Members Should Do
On October 19, 2026, Linkstation Inc. (Japan) announced that GETTIIS member information had leaked after unauthorized access, and on October 20 it published a second report with counts per item. According to the company, between about 0:00 and 7:00 on October 18 a third party exploited a vulnerability in the program of Gettii-Lite, a performance-registration service for organizers, and obtained GETTIIS member data. The counts are per item, not a total number of people: member IDs 317,971; hashed passwords 311,451; email addresses 311,426; names 309,759; phone numbers 309,668; card-related information 29,515 (the first and last four digits, cardholder name and expiry date, encrypted); gender 5,900; dates of birth 5,192; postal codes 489. The company says it does not store full card numbers or security codes, that the leaked data alone cannot be used for card payments, and that passwords were stored as hashes. This site's conclusion: change the GETTIIS password and any other password you reused, and treat messages that use your name and phone number as suspect, because those two items were leaked for about 310,000 records each.
Matsuya app management system breach (2,377,127 records plus app members): names, phone numbers and delivery addresses leaked — what members should do
On October 30, 2026, Matsuya Foods Holdings Co., Ltd., the Japanese beef-bowl restaurant chain, announced that the management system of the official Matsuya app (Matsuben Net, Mobile Order and Matsuben Delivery) had been accessed without authorization by a third party and that member data had leaked. The company found the intrusion and the leak on October 28. For users of Matsuben Net, Mobile Order and Matsuben Delivery (2,377,127 records), the items are member ID, delivery address, name, phone number and Matsuya points. For Matsuya app members (2,000 records, possibly up to 3,000), the items are member ID, prefecture, name, phone number, date of birth, email address, encrypted password and Matsuya points. The company says it does not hold credit card data. The cause and how the intrusion happened are under investigation, and the app and related services such as its website are suspended. Our conclusion: do not open links in messages claiming to be Matsuya, check only in official places you open yourself, and if you are an app member, stop reusing your Matsuya password elsewhere.
Ryohin Keikaku (MUJI) app and online store breach (up to about 27.26 million records): about 1.09 million MUJI Card numbers also affected — what users should do
After its October 30 first notice, Ryohin Keikaku Co., Ltd., the Japanese retailer behind MUJI, said in a second notice on November 4, 2026 that the scope was wider. MUJI online store members (including people who never used the MUJI app) are affected as well as app users, withdrawn customers included. Email address, date of birth, gender and member ID in up to about 27.26 million records may have been accessed from outside, and for about 520,000 of them, name, address and phone number too. For about 1.09 million members of the MUJI Card (issued by Credit Saison, joined by July 2021), the full card number, MUJI Card ID and date of birth are affected; the name on the card, expiry date and security code are not included. For about 120 records where a card was registered in the app or online store, the first six and last two digits of the card number and the cardholder name are affected. The company says it has not confirmed any leak to the dark web or harm from misuse, and will contact affected customers individually by email or post. On November 6 it announced it had suspended the online store. This site's take: if you hold a MUJI Card, check your card statement and contact Credit Saison about anything you do not recognize, and verify any message or call claiming to be MUJI or a card company through the official app or site you open yourself, or the number on the back of your card.
Paradigm Healthcare Services Data Breach: Medi-Cal Member IDs and Birth Dates May Have Been Accessed, and What Members Should Do
Paradigm Healthcare Services, a third-party service provider that processes Medi-Cal billing and maintains Medi-Cal member identification numbers for the California Department of Health Care Services (DHCS), published a Notice of Data Breach and sent letters dated September 14, 2026. According to Paradigm, it became aware of unauthorized access to its local network on October 13, 2025, took certain systems offline and notified law enforcement. On August 18, 2026, it determined that files containing some individuals' protected health information may have been accessed by an unauthorized party between October 8 and October 15, 2025. The information that may have been accessed is name, date of birth, gender and Medi-Cal member identification number. Paradigm says its Student Health Network platform was not impacted and that it has no evidence the information has been used for fraud or identity theft. The notice gives no count; press reports put it at about 970,000 people (SecurityWeek, citing Paradigm's report to the US Department of Health and Human Services, and HIPAA Journal, which gives 970,403). This site's take: Medi-Cal members who receive the letter should check their benefit statements for services they did not receive, and should not treat a caller who knows their Medi-Cal number and birth date as genuine.
Photon Health data breach (analytics-tool flaw): names, addresses, phone numbers, dates of birth and prescription information — what affected patients should do
On October 8, 2026, Photon Health, a US e-prescribing platform, published a notice saying an unauthorized third party exploited a previously unknown vulnerability in its data analytics tool (Metabase), which Photon runs on its own infrastructure, and accessed certain data. Photon says it learned of the incident on August 21 and finished its review of the data on September 4. The items are name, address, phone number, date of birth and prescription medication information, varying by person. Photon says it does not collect or store Social Security numbers or financial information, so they were not affected, and that it has no evidence of misuse. Photon has not disclosed how many people are affected. Separately, Blueberry Pediatrics, a pediatric telehealth company, reported to the Oregon attorney general that 340,915 people were affected by a breach of its own Metabase environment, with items including health plan details and medical records. This site's take: this is health-related data tied to a real name, address and phone number, so expect convincing calls and messages about prescriptions, insurance or pharmacy accounts. Do not act on them; call back on a number you look up yourself.
Ricardo (Swiss Marketplace) Data Breach, About 890,000 Accounts: Names, Addresses and Phone Numbers Exposed, and What Users Should Do
On October 9, 2026, SMG Swiss Marketplace Group, which runs the Swiss online marketplace Ricardo, announced unauthorised access to personal data linked to orders on the Ricardo platform. Ricardo detected suspicious activity on its servers on October 7 and started technical measures at once; the company says the security vulnerability that allowed the access has been fully resolved. The investigation established that personal data relating to approximately 890,000 user accounts was exposed. The exposed data was limited to names, postal addresses and telephone numbers and, for business users, company names; email addresses and passwords were not affected. Ricardo is informing affected users directly and has notified the Swiss Federal Data Protection and Information Commissioner (FDPIC). The nature of the vulnerability and the period of access have not been disclosed. This site's take: assume your address and phone number are known, and do not give card details or bank or TWINT logins to post, calls, texts or WhatsApp messages claiming to be from Ricardo or a trading partner.
Yakult Honsha website breach (about 40,000 records): names, addresses, phones, emails and inquiry contents leaked — what affected people should do
Yakult Honsha Co., Ltd. confirmed unauthorized access to its website on October 26, 2026 and suspended the site's functions the same day. In its second report of October 30, it said it had confirmed that about 40,000 records of personal data provided through the website had leaked. The affected groups and items are: users of the email inquiry form (name, gender, age band, address, phone number, email address, inquiry contents); members of the school lunch site "Tanoshii Kyushoku" (name, type of business, workplace, workplace address and phone number, email address, encrypted password and more); users of the press inquiry form; and the company's staff who handled those inquiries (names). The company says the website did not hold credit card or bank account data. The breakdown of the count, the period affected and the cause have not been disclosed. It has made a first report to Japan's Personal Information Protection Commission and consulted the police. This site's take: do not open links in messages claiming to be Yakult, and if you are a school lunch site member, change the password on any other service where you used the same one.
Aena EC App Unauthorized Access (My Page Data of Up to 817,215 People): Names, Addresses and Delivery Details That May Have Been Viewed, and What Members Should Do
Aena Co., Ltd., a Japanese off-price retail chain, announced on October 14, 2026 that member My Page data in its EC app may have been viewed without authorization. According to the company, system log analysis found it at 5:58 on October 13, and up to 817,215 members (full members) may have been affected. LINE members and customers who bought through Amazon, Rakuten and similar sites are not affected. The information that may have been viewed is name, address, phone number, email address, date of birth, gender, occupation, delivery address, name and phone number (including those for third parties), favourite store and mail settings, and the last 4 digits, expiry date and cardholder name of registered credit cards. The company says it does not hold full card numbers or security codes, that no password was viewed or leaked, and that it confirmed no member information was changed, no one was withdrawn and no purchase was completed. The cause is given as mechanical continuous access made through unauthorized access, and the investigation continues. The company blocked access to its EC site, and the EC app, which had been suspended, resumed at noon on Monday, October 19; a password reset screen appears at the first launch after the restart. This site's conclusion: reset your password in the app, change any other service where you reused it, and check messages about deliveries or orders without using their links or numbers.
ASOS customer data breach and fake app alert: names and contact details taken, dates of birth and search history reported — what customers should do
On October 6, 2026, ASOS customers received an unauthorised push notification through the ASOS app. ASOS said an unauthorised party had accessed third-party platforms it uses to communicate with customers. It said customers' names and contact details may have been accessed, and that it does not believe payment card information or account passwords were affected. In a later customer update, as reported by BleepingComputer, ASOS said an employee's login credentials were obtained by impersonating a trusted contact. The BBC reported that a sample supplied by the attackers also included customer numbers, dates of birth and searches made on the ASOS website; ASOS has not confirmed that list. ASOS has not published how many customers are affected. This site's take: a message that quotes your name or a past search is not proof it comes from ASOS. Open the ASOS app or website yourself instead of tapping a link.
Benefit One 'Toku-Kai' Contractor Breach (29,465 People): Names, Birth Dates and Email Addresses Leaked, and What Members Should Do
On October 28, 2026, Benefit One Inc. announced that a system run by one of its outsourcing contractors was accessed without authorization and that personal data of 29,465 members (including some who have already left) of Toku-Kai, a service for Credit Saison Co., Ltd. cardholders, leaked. The access happened intermittently from October 14 to 20; the contractor detected part of it on October 21 and reported it to Benefit One, which suspended the service the same day. The leaked items are name, furigana (reading of the name), date of birth, gender, postal code, email address, customer number, enrollment and withdrawal information, and a management number used for membership-fee payment processing (items vary by member). Separately, some of Benefit One's authentication-related information used to link to the payment system may have leaked; it was changed on October 26, and no fraudulent payment attributable to this incident has been confirmed. Benefit One says card numbers, expiry dates and security codes are not held in the affected system and did not leak. The company says the data did not come from Credit Saison's systems. The cause and the final number are under investigation. This site's take: Benefit One's notice does not ask members to change card numbers, but names, birth dates and email addresses leaked, so do not open links in messages claiming to be from the company or its partners, and verify on an official site you open yourself.
Unauthorized Access to Bithumb's Internal Groupware (Personal Data of 844 Customers Exposed): ID Numbers, Account Numbers and More, and What Customers Should Do
Bithumb, a crypto exchange in South Korea, discovered abnormal access by an unauthorized outside party to its internal mobile groupware system on October 27, 2026 and, according to Korean press reports of its announcement on October 29, found that customer personal data was exposed. Of 6,444 customers' records involved, 5,600 were in DRM-encrypted files that could not be read from outside, and 844 customers' data was exposed. The items vary by customer and include name, mobile number, email address, resident registration number, driver's license number, account number and ID card copies. 715 employees were also affected. Bithumb says the groupware is separate from exchange accounts and asset information, and no direct intrusion into the exchange service or customer database has been confirmed. This site's conclusion: treat any call, text or email that mentions your ID or account details as suspect, never share a one-time code or password, and check Bithumb's notice in the official app or site you open yourself.
Covered California Agent Data Breach: Names, License Numbers and SSN or FEIN Exposed in a Phishing Incident, and What Agents Should Do
Covered California, California's health insurance marketplace, filed a data breach notification with the California Attorney General (reported October 16, 2026). The notice to agents says that on May 13, 2026 an unauthorized individual used a phishing scheme to gain access to information relating to agents, and that agent spreadsheets were accessed. Those spreadsheets included each agent's name, agency name, license number, FEIN or Social Security number, and role within the agency. The notice does not say how many agents are affected, does not mention enrollees' (consumers') data, and does not offer credit monitoring. Covered California recommends placing a fraud alert with the three credit bureaus and following the Attorney General's Breach Help tips. This site's take: licensed agents and agency staff should place a fraud alert or credit freeze now, treat unexpected messages that cite their license number or agency as suspect, and use the contact listed in the notice.
Double Counter Discord bot data breach (about 28 million Discord IDs, 1 million emails): what leaked and what members and server admins should do
Tellter SAS, the operator of the Discord verification bot Double Counter, published an incident report on October 5, 2026 (version 2.0 on October 21). It says an attacker got in on October 4 through a publicly reachable Metabase analytics tool on a retired server at a hosting provider, then used two credentials for its cloud that were stored on that same server. About 28 million Discord user IDs and usernames, 27 million IP addresses with coarse location, 25 million hashed device details and 1.0 million email addresses were affected, with partial copying for the first two categories. About 5,000 customer records of the operator's payment products were also copied. Discord passwords were never received by the bot and full card numbers are not affected. The attacker also used the bot's token to post invitations to another Discord server in about 50 large servers. The operator notified the French data protection authority on October 5 and began emailing about 1 million people on October 21. This site's take: members do not need to change their Discord account, but should expect messages that use their ID, email and IP address, and server admins should delete invitation posts made on October 4.
ENGIE Customer Data Breach (France): Contact Details and Contract Numbers Exposed via a Partner Sales Tool, No Bank Data, and What Customers Should Do
ENGIE, the French energy supplier, began emailing customers in France in late October 2026 to say that an attack (wording reported as an act of cyber-malice) hit a tool used by some of its partners to prospect for customers and sell its offers. According to reports citing ENGIE's customer email (ENGIE's statement to BleepingComputer did not itself list the items), the exposed data is first and last names, postal and email addresses, phone numbers, the electricity delivery point (PDL) or gas metering point (PCE) reference, customer ID and contract number. ENGIE says no banking data is affected, that its own IT systems were not compromised, that it cut off the attackers' access to the platform, and that it informed the authorities. The number of customers affected and the partner involved have not been disclosed. We found no notice about this on ENGIE's own website, so this article relies on ENGIE's statements as reported by several outlets. This site's take: do not give an IBAN, card number or code to anyone who calls or writes citing your contract or meter number, and hang up and call the number on your bill.
Florida Department of Education financial aid website breach (about 4.9 million people): Social Security numbers at risk — what to do
On October 29, 2026, the Florida Department of Education announced that its staff learned on October 19 of unauthorized criminal access to the Florida Student Financial Aid website (FloridaStudentFinancialAidSG.org). The department believes the incident was limited to that website and may have affected approximately 4.9 million individuals. The information potentially exposed may include Social Security numbers, first and last names, dates of birth, home addresses, phone numbers (including mobile numbers), email addresses and gender identification codes (M or F). Not all individuals were necessarily affected. It says anyone who previously applied for financial aid in Florida may have been affected. The department says it activated its cybersecurity response protocols, notified the Florida Attorney General's office, and is working with the Florida Digital Service and the Florida Department of Law Enforcement. It says current financial aid, tuition payments, and eligibility for scholarships, grants and loans are not affected. The cause has not been published. This site's take: a Social Security number does not change, so check your credit reports, consider a fraud alert or credit freeze, and treat any message that uses your name, email or phone number and mentions this incident as suspect.
Frontline Education data breach (school software vendor): 3.09 million people per the Indiana AG list; SSNs, Medicaid IDs and student IDs impacted — what staff and parents should do
Frontline Education, a US provider of administration software for K-12 school districts, posted a Notice of Data Breach dated October 26, 2026. It says its security team found a vulnerability in a third-party software product it uses on August 14, 2026, that the vulnerability allowed unauthorized access to part of its environment starting that day, and that the last day of unauthorized activity was August 15. The affected data relates to two products, Frontline Central and School Health Management. The company says the following data elements were impacted, with which apply varying by person: a Social Security number, date of birth, driver's license number, passport number, other government ID, Medicaid ID and student ID. Frontline says it is not aware of any misuse of the data, and offers adults in the U.S. two years of TransUnion credit monitoring and minors cyber monitoring (its incident page says dark-web monitoring where available). The Indiana Attorney General's data breach list (November 2026 edition) shows 3,085,266 people in total (66,157 Indiana residents; notification date October 26, breach date August 14), where filings in five other states (MA, NH, SC, TX, VT) had added up to about 1.3 million (1,298,917), per SecurityWeek. The number of districts has not been published. Our view: if you work at or have a child in a US school district that uses Frontline, assume your notice applies to you, place a free credit freeze, and treat any call or email that quotes your Medicaid or student ID as unproven.
Hana-cupid Member Data Breach (Up to 4,238,242 Records): User IDs, Encrypted Passwords and Email Addresses Leaked, and What Members Should Do
Hana-cupid Co., Ltd. announced on October 28, 2026 that unauthorized access by a third party to its online florist services, Internet Hana-cupid and Business Hana-cupid, had leaked some member information. According to the company, a third party accessed its management system without authorization between October 14 (Wed) and October 15 (Thu), and the company confirmed the leak of member information on October 19 (Mon) during its investigation. The count is 4,238,242 (customers who may be affected). The leaked items are: user ID (login ID), password (an encrypted form that cannot be used as it is; the FAQ calls it hashed), PC email address and mobile email address. The company says name, gender, date of birth, address, phone number, credit card number, company name, department name and delivery destination information did not leak. Only members who registered an email address on the company's official online shop (i879.com, i879.com/biz/) are covered; orders through external shopping malls, phone orders without an email address, and purchases at Hana-cupid member florists are not. The company says it does not hold credit card information and that there is no need to stop or reissue a card. It has not confirmed any secondary harm, began emailing affected members individually on October 28, and has reported to the Personal Information Protection Commission and the police. The cause is not stated, and the company is investigating with an external specialist organisation. It says it does not plan monetary compensation or refunds. This site's conclusion: if you could be affected, change your password and any other service where you reused the same ID and password. Check anything claiming to be from Hana-cupid or a financial institution by opening the official site yourself, not through its links.
iRhythm data breach (8,179,772 people listed with HHS): Zio patient names, insurance numbers and device serial numbers taken — what patients should do
iRhythm Technologies, the US maker of the Zio wearable heart monitor, told the US SEC on June 15, 2026 that it had detected unauthorized access to certain third-party-hosted business applications and that data was taken. In a notice dated October 2, 2026 the company says its investigation found data was accessed and downloaded between June 3 and June 8, 2026, and that notices to affected people began on October 2. The data includes patient name, contact information (address, email address, phone number), patient account number, device serial number, insurance number, date of service and date of birth, and the company says it counts as protected health information under HIPAA. iRhythm has not published a total of its own. The incident appeared on the US Department of Health and Human Services (HHS) breach portal at 8,179,772 individuals, as reported by SecurityWeek and CyberInsider on October 29, 2026. Earlier state filings listed 298,647 people in Texas and 69,526 in South Carolina. The company says it found no impact on its products, clinical or medical device systems, and that it does not store payment card or financial account information. This site's take: if you were a Zio patient, expect convincing messages that use your name and insurance details, check your insurer's statements, and consider a free credit freeze.
Unauthorized Access at the Reservation System Vendor of JAL, JTA, ANA, Korean Air and Asiana (About 92,000 JAL/JTA and 37,800 ANA Customers): Booking Numbers, Names and More, and What Travellers Should Do
Japan Airlines (JAL) and Japan Transocean Air (JTA) announced on October 28, 2026 that on October 23 they were told by the vendor of their passenger service system, an overseas company, that unauthorized access to the vendor's systems left traces of some booking information being viewed from outside. The period is August 10, 2023 to September 23, 2026. About 90,000 people had booking number, name, boarding date, route and cabin class involved; about 2,000 people also had email address, phone number, passport number, nationality, mileage number, ticket number, seat number and more viewed. The total is about 92,000 people. On October 30 JAL and JTA updated the notice to say they had contacted those customers at the email address given when booking. All Nippon Airways (ANA) announced on October 30 that there are traces of some booking information of about 37,800 people who booked in the same period being viewed (about 1,700 of them including passport and mileage numbers). In South Korea, Korean Air and Asiana Airlines announced on October 23 that there are signs that some customers' booking numbers leaked from the same company's reservation system; they say it was caused by unauthorized access using login credentials and is estimated to have occurred between August 2023 and September 2026 (neither has published a number). JAL, JTA and ANA say credit card details and passwords were not included. This site's conclusion: even if a message claiming to be from an airline gets your booking number, name and flight right, do not use its links or numbers; check in the official app or site. If your passport or mileage number may be involved, change your mileage account password and review its redemption history.
Navigate360 breach and the Crime Stoppers tip platform (P3): what tipsters, people named in tips and US notice recipients should do
Navigate360 has published a data breach notice (the page shows no date; Reuters reports it acknowledged the breach on October 23, 2026) saying an unauthorized party copied data from one of its systems between November 21, 2025 and March 5, 2026, and that names, addresses, dates of birth, Social Security numbers and other details may be involved. Toronto Crime Stoppers says Navigate360 told it that the stolen data contained 176,859 Toronto tips from January 2022 to November 2025 and 14,973 names found in those tips, and it paused tip-taking on October 22. The Privacy Commissioner of Canada opened an investigation into Navigate360 on October 27. Navigate360's notice does not name the P3 tip platform or Crime Stoppers, no official total number of people or tips has been found, and Toronto Crime Stoppers says it has not received the text of the stolen tips. This site's take: if you ever sent a tip, assume its content could be linked to you, be careful with any message that mentions it, and use the police or a lawyer if you feel at risk.
Sony Life Unauthorized Access Leaks Policy Data (About 2.9 Million Sony Life Records, 385,000 Medicare Life Records): Names, Addresses, Policy Numbers and More, and What Policyholders Should Do
Sony Life Insurance Co., Ltd. announced on November 9, 2026, in a second report, that it had newly confirmed information leaks stemming from the unauthorized access to its systems: personal information on its own insurance policies (policy number, name, address, phone number and more), about 2.9 million records including records of contracts already ended; the email addresses and agent numbers of sales agents, about 780 records; and the email addresses and employee numbers of its own employees, about 12,500 records. Sensitive personal information such as health status and medical history, My Number, credit card information, account information and policyholders' email addresses are stated not to be included. This follows the first report of October 28 (information on Medicare Life policyholders and insured persons that Sony Life handled as an agent, about 385,000 records), so Sony Life's own policyholders are now affected too. The access came to light on October 27. As of November 9 no misuse of customer information had been confirmed, but the company warns of emails, texts and calls impersonating it. The cause has not been published. Our conclusion: assume you may be affected if you hold or held a Sony Life policy, or took out a Medicare Life policy through Sony Life, and check any message through the contact points on the official sites, not through links or numbers in the message.
University of Copenhagen data breach (about 525,000 people): names, CPR numbers, phone numbers and emails — what to do
The University of Copenhagen (Københavns Universitet, KU) announced on October 23, 2026 that hackers had gained access to one of its test environments. Consistent reports citing the university say data on about 525,000 people was obtained: full name, CPR number (Denmark's civil registration number), work and private phone numbers and a private email address. In an update on October 25, the university said the PIN codes of the ID cards of about 20,000 staff and students were also compromised, and that new PINs had been issued. Reports say the intrusion was detected on Tuesday, October 20, and brought under control. The university has told the Danish Data Protection Agency. Its own pages could not be opened from this site on October 30, so this article relies on those reports. This site's take: treat any message that uses your name and CPR number as unproven, check through channels you open yourself, and never give out a CPR number, password or PIN on request.
White Essence Unauthorized Access and Personal Data Leak (About 1.05 Million Accounts): Names, Addresses, Phone Numbers and Encrypted Passwords, and What Users Should Do
White Essence Co., Ltd. announced on August 12, 2026 that it had suspended its systems after unauthorized access to its booking site and core systems, and on October 5 published its findings in a notice titled 'Apology and Notice Regarding Leak of Personal Information Due to Unauthorized Access'. According to the company, it confirmed unauthorized access from outside on August 5, suspended the systems on August 12, and the investigation later found that personal information had been taken outside. Of the information registered as of August 5, 2026, the number of people affected is about 1.05 million accounts (a total that includes customers, franchise clinic personnel and head office employees). The leaked items, in whole or in part, are name, address, phone number, email address, date of birth, gender, workplace, login ID and password (in encrypted form), information about use of and responses to services, and the company's management number. The company says it does not hold financial institution account information, and that it has not confirmed that customers' images leaked. The cause, it says, was the exploitation of a vulnerability in the program of its booking site, used as a starting point to access its core systems without authorization; the company says it has finished dealing with that vulnerability. As of October 5 no secondary harm had been confirmed, but the company says suspicious emails, calls or mail posing as the company or other businesses may arrive. Our conclusion: if you use the same login ID and password on other services, change them there. Treat any message claiming to be from the company or a dental clinic as unverified even if your name, address and birth date are correct, and check through an official channel you look up yourself.
Beauty Garage and Eyelash Garage Unauthorized Access (775,725 Records): Salon Names, Phone Numbers, Emails and Password Hashes Leaked, and How to Guard Against Impersonation
Beauty Garage Co., Ltd. announced on October 15 that its e-commerce site servers, and those of Eyelash Garage, were accessed without authorization from October 10 to 12 and that some customer information leaked. It detected the incident on October 13, identified the route and blocked it the same day. According to the company, the scope is 775,725 customer records held in the Beauty Garage and Eyelash Garage e-commerce systems as of 23:55 on October 10, 2026 (no per-brand breakdown is given); Eyelash Garage's own notice gives 49,191 (how this relates to 775,725 is not stated). The main items confirmed as leaked are company name, salon name, customer name, business type, salon URL, phone number, email address, password hash values, and hash values of the password-reset question and answer. Leaks of address and shipping information, purchase history and payment information including credit cards have not been confirmed so far. The company says it has not confirmed that the data was published or misused. Second notices from both companies on October 20 say the e-commerce sites are operating normally and that the matter has been reported to the Personal Information Protection Commission. The cause has not been disclosed. This site's conclusion: a message claiming to be from either company or a business partner is not genuine just because it gets your salon name or your name right. Verify any request to change a bank transfer destination or make an extra payment through an official contact.
So-net Member Database Unauthorized Access (2.14M So-net Records, 443K plala S-Course Records): Names, Phone Numbers and Birth Dates Leaked, and What Users Should Do
Sony Network Communications Inc. announced on October 27, 2026 that it had confirmed an information leak from unauthorized access to the member database of its internet service So-net. According to the company, the database was accessed from outside on October 19, the company confirmed this on October 23 and stopped the affected server, and on October 24 it established which items and how many records had leaked. The leaked information is: So-net member information, 2,141,986 records (1,869,771 current members and 272,215 former members who left in or after March 2026), and plala (S-Course) member information, 443,495 records (422,365 current and 21,130 former members who left in or after March 2026). Both contain name, phone number, email address, user ID, date of birth, gender and internet connection ID. The company says no password leaked in the member information. For four mail services (Mail Service G, A-Box, Sonnet VAIO Mail and PostPet Mail Account Service), mail passwords also leaked, for 54,401 addresses in total, and the company reset them on October 27. Bank account information for 16 records and password-reset notice information for 7 records also leaked, and the company says it will contact those people individually. Credit card information is not included, and the company has not confirmed a leak from other services, including NURO. The cause is given as unauthorized access by a third party (under investigation); the route of the intrusion has not been announced. This site's conclusion: if you used any of the four mail services, reset your mail password and change any other service where you reused it. Everyone should check a message claiming to be from So-net through an official site or the special phone line, not through its links or numbers, even if it gets your name and birth date right.
Toypo App Unauthorized Access (697,209 Users Affected, per Toypo): Phone Numbers, Names and Addresses Leaked, and What Store App Users Should Do
Toypo Inc. confirmed unauthorized access by a third party to its customer-management app, the Toypo app, on October 4, 2026, and said in a notice dated October 14 that 697,209 users are covered and that their information may have leaked. A second Toypo notice page, which has no date and no number of people, says the information leaked. Since October 13 the company has been contacting those covered one by one, including by in-app push notification. According to the company, part of its system had an access-control flaw that let an authenticated user obtain other users' information they were not entitled to see, and its logs show a third party used it to obtain user information. The flaw has been fixed. The information that may have leaked is the phone number and user ID or similar identifiers and, where registered, name, name in kana, email address, date of birth, gender and address. Passwords and other login credentials, credit card numbers and other payment data, points, store-visit history and purchase or usage history are not included, it says, and users do not need to change passwords or take other action in the app. No specific secondary harm has been confirmed. It has reported to the Personal Information Protection Commission. A third-party security assessment is being arranged. In notices by stores that use the app, JR Kyushu Food Service says about 26,900 of about 61,500 registered members are covered, and Mannoya says 12 of 212 members of its Kineya Mannoya official app. Toypo's contact is 0120-546-030 (weekdays 9:00 to 18:00 Japan time; the call center takes calls until 18:00 on October 30, then the in-app contact). This site's conclusion: a message that gets your phone number and name right is not necessarily genuine. Do not use its links or numbers; check through the in-app contact or the contact listed in the notice.
Ichiban Kuji ONLINE delivery data may have leaked (unauthorized access at Bandai Logipal): names, addresses and phone numbers, and what members should do
On October 26, 2026, BANDAI NAMCO Holdings Inc., BANDAI SPIRITS CO., LTD. and Bandai Logipal Co., Ltd. announced (first report) that a system managed by Bandai Logipal, the logistics subsidiary of BANDAI NAMCO Holdings, had been accessed without authorization by a third party, and that this was discovered on October 21. According to the three companies, the personal information that may have leaked is the delivery information (name, address and phone number) for Ichiban Kuji ONLINE, a service for which BANDAI SPIRITS outsources product delivery to Bandai Logipal. Details such as the number of people affected are under investigation; credit card details were not included, and no misuse has been confirmed so far. On October 21 the company found traces suggesting unauthorized access on a server in its logistics system and shut the server down, and on the same day confirmed that operations had been carried out through misuse of a Bandai Logipal account. It stopped the logistics system in question on October 24 and reported to the police and Japan's Personal Information Protection Commission on October 26. The announcement says the shipping system in question is suspended from October 26. How the unauthorized access happened has not been published. The companies warn that suspicious phone calls and postal mail related to the incident may arrive. This site's conclusion: anyone who has had items delivered through Ichiban Kuji ONLINE should not respond to unexpected calls or mail claiming to be from Ichiban Kuji or Bandai, and should use the inquiry form on the official website, opened themselves, to check anything.
Joshin (formerly Joshin Denki) Unauthorized Access (Up to About 6 Million Records): Members' Names, Addresses and Phone Numbers May Have Leaked, and What Users Should Do
Joshin Corporation, which changed its name from Joshin Denki Co., Ltd. on April 1, 2026, announced on October 17 that it had recognized unauthorized access on October 16 and that, after taking steps such as restricting access from outside, some services could not be provided (filed with the Tokyo Stock Exchange on October 19). Its second notice on October 26 says it detected an anomaly on its network on October 16 and took steps such as disconnecting servers showing signs of unauthorized access from the network. According to the second notice, the information that may have leaked is: up to about 6 million records on the member database server (name, address, phone number, member number); up to about 230,000 records of the Joshin subscription service (member number, phone number + handwritten signature (binary data), login ID and initial password, billing history, contract number and device ID, activation code); and up to about 800 records of the renovation photo upload system (2 driver's license images, 1 My Number card, 5 bank account numbers, and photos of renovation work in progress). The company says these are total counts of records that may have leaked, not confirmed leak counts. It does not hold payment data, including credit card information. It has consulted and reported to the Personal Information Protection Commission and the police. The cause, the route of the intrusion and when suspended services will resume have not been announced. This site's conclusion: a message claiming to be from Joshin is not genuine just because it gets your name, address or member number right. Do not use its links or phone numbers; check through the contact listed in the notice or an official site you open yourself.
Qzoo survey site breach (about 400,000 records): member data including bank account details may have leaked, and what members should do
On October 21, 2026, Monitas Inc. announced that its survey site Qzoo had been accessed by a third party without authorization and that members' (panelists') personal data may have leaked. According to the timeline, unauthorized access began at 8:30 on October 17; at 12:22 the database was viewed and updated through SQL injection; at 18:44 the access was detected and blocked; at 19:02 the service was put into emergency maintenance; and on October 20 a preliminary report was made to Japan's Personal Information Protection Commission. The scope is about 400,000 records (all records held in the Qzoo system as of October 17). The database that may have been affected stores basic information (name, date of birth, address, phone number, email address, etc.), member authentication information (member ID, password, etc.), financial information (account number, branch name, account holder name, etc.) and survey answers (annual income, occupation, etc.). The items are still under investigation. The company does not hold credit card data or My Number (Japan's national ID number). It says the intruder exploited a vulnerability in its system. No unauthorized access to its other systems has been found. This site's take: change any password you share with Qzoo today, do not open links in messages claiming to be Qzoo or a bank, and never give your PIN or login details to anyone. Check your bank account activity as well.
M3 "MR-kun" breach (25,775 m3.com members and others, 2,260 pharma staff): what leaked, and what doctors and pharmaceutical staff should do
On October 15 and October 23, 2026 (second notice), M3, Inc. announced that a third party had gained unauthorized access to the system of MR-kun, a service it runs for pharmaceutical companies, and that personal information had leaked. According to the company, it confirmed the unauthorized access on October 14 and cut off the route it had identified the same day. The second notice confirms leaks for 25,775 m3.com members and others (name, workplace, email address for some, some information about their use of M3 services, and information that client pharmaceutical companies had registered in the service (assignment relationships and similar); email addresses for 6 of them) and for 2,260 pharmaceutical company staff (name, workplace, email address for some and other items; email addresses for 264 of them). It also includes some doctors who are not m3.com members, whose details pharmaceutical companies had entrusted to M3. Login passwords and m3 points were not included, and M3 does not hold credit card numbers. The cause has not been published. The company says it has found no public posting or misuse. Since October 22 it has been contacting affected members individually at their registered email addresses. Our conclusion: doctors and others who use m3.com should not open links in messages claiming to be from M3 or a pharmaceutical representative, and should not give out passwords or bank details.
Pizza Hut Japan online ordering breach: email addresses, phone numbers and login session tokens leaked, and what customers should do
On October 23, 2026, Pizza Hut Japan Ltd., which runs Pizza Hut in Japan, announced that a third party had gained unauthorized access to a system linked to Pizza Hut's online ordering service for Japan and that part of its customers' information had leaked. According to the company, on October 19 it confirmed that a third party had gained unauthorized access to a payment API linked to the online ordering service (a mechanism that exchanges payment-related information between systems) and obtained some information from a database containing customer information. The information confirmed to have leaked is customer IDs, email addresses, phone numbers, records relating to deleted customer information, session login tokens and transaction records. Credit card details were not included. The number of people affected has not been published. The company says the cause and the full scope are still under investigation. The company blocked the attacking IP addresses, addressed the vulnerability and filed a preliminary report with Japan's Personal Information Protection Commission. No secondary harm has been confirmed, but it warns of suspicious emails, texts and calls impersonating the company or Pizza Hut. This site's conclusion: anyone who has used Pizza Hut Japan's online ordering should not open links in messages claiming to be from Pizza Hut, and should check their order history in the official app or on the official website opened themselves.
Rakuten Travel Unauthorized Access (Up to About 2.6 Million Records): Names, Contact Details and Partial Card Data from Overseas Hotel Bookings, and What Users Should Do
On October 26, 2026, Rakuten Group, Inc. announced that it had confirmed unauthorized access by an outside third party to some pages of Rakuten Travel's overseas hotel booking site, managed and operated by its subsidiary Rakuten Travel Xchange, and to the multilingual booking site that Rakuten Group operates. On the overseas hotel booking pages (incident 1), an anomaly was detected on September 10 and the system fix was completed on September 16. The information that was subject to the unauthorized access covers names, email addresses, phone numbers and internal ID numbers for up to about 2.6 million records of logged-in customers, and, for up to about 40,000 records of customers who booked, names, contact details, country of residence, booking details and companions' names; payment information (card issuer identification number and last four digits, cardholder name, expiry date and card brand) for up to about 36,000 of those. Full card numbers, security codes, passwords, ID documents and addresses are not included (per the note on the booker item). On the multilingual booking site (incident 2), detected on October 20 and fixed on October 21, email addresses and internal IDs for up to about 860,000 records of logged-in customers, and account names and email addresses for up to about 40,000 records of accommodation staff entered in the admin screen, were affected. The cause, the period covered and any compensation have not been announced. This site's conclusion: a message asking you to re-enter your card number or pay is not genuine just because it gets your booking or your card's last four digits right. Do not use links in emails or texts; check your booking in the Rakuten Travel app or a bookmarked official site.
FortiBleed (FortiGate credential leak, about 74,000 devices): not a new vulnerability, so admin and VPN passwords must be changed
FortiBleed is the large-scale leak and misuse of administrator and SSL VPN credentials for FortiGate, Fortinet's firewall and VPN appliance. On June 18, 2026, CISA warned that credentials associated with about 74,000 devices had leaked. On June 19, Fortinet said it is not a new vulnerability and that the activity likely involves reuse of credentials from previous incidents plus brute-forcing of devices with weak passwords and no multi-factor authentication. On June 23, JPCERT/CC issued an alert saying it had confirmed that the data includes information related to Japanese companies. On October 6, the FBI and the U.S. Secret Service warned that the activity continues, that some administrators have been locked out of their devices, and that the access has been used as an entry point for ransomware. Upgrading to fixed firmware does not invalidate leaked passwords. This site's conclusion: if you run FortiGate, change admin and VPN passwords, enforce multi-factor authentication, take the management interface off the internet, and remove the legacy SHA-256 copies of admin passwords.
Fujicco campaign entry data possibly leaked (about 15,500 entries): names, addresses, family details, and what entrants should do
On October 22, 2026, Fujicco Co., Ltd., a Japanese food maker known for its Caspian Sea Yogurt and kelp products, announced that a server of the company it contracts to handle campaign entries had been accessed without authorization by an outside party, and that entrants' personal data may have leaked. The access was found on October 21 and the server was promptly shut down. The data covers personal information entered in the non-member entry forms of two campaigns run since May 2026: the Caspian Sea Yogurt series 'Motto! Toro-mocchi Campaign Part 2' and the 'Fujicco Thanksgiving Festival Campaign'. There are about 15,500 entries in total, including repeated entries by the same person. The items are name, age, gender, occupation, marital status, family composition, phone number, email address, address and survey answers. Driver's licences, credit cards and bank account numbers are not included. Entries made as a Fujicoin member, by postcard or on X are not affected. No publication or misuse has been confirmed, but the company is treating the data as obtained by a third party. This site's conclusion: people who entered through the affected forms should not pay shipping or handling fees, resubmit receipts or re-enter personal details when asked, and should check with the campaign office on the number in the official notice.
Green Monster's FX Navi app possible data leak (about 6.19 million records): email addresses and survey answers among the items, and what users should do
On October 23, 2026, Green Monster Inc. (Tokyo Stock Exchange Growth, 157A), announced that user information from its FX demo-trading app FX Navi (FXなび) may have been obtained by an outside party (first report). On October 17 it found unauthorized access to the app by an outside party and began investigating. In that investigation it found that, from around 20:26 on April 27 to around 14:26 on April 30, an outside party using a different IP address may have continuously obtained user information from the app. It says no leak from the October 17 access itself has been confirmed. About 6.19 million records may have been obtained, including data that is not personal information. The items are email address (66,003), nickname, gender, age group, occupation category, X (formerly Twitter) ID (6,434), self-introduction text, icon image URL, answers to the first-launch survey (4,809,631), device ID, login credentials, account transfer code (5,120), push notification identifier, advertising ID, source IP address and usage data such as trading results. Name, address, phone number, date of birth, credit card, bank account and My Number (Japan's national ID number) are not items users can register. The company says the cause was a function of the app's API; it fixed the API function and the login credentials and invalidated all login credentials issued before the fix. No secondary harm has been confirmed. This site's conclusion: FX Navi users should not open links or attachments in emails or X messages claiming to be from the company or related firms, and should treat every investment solicitation as fake.
Lindt Japan online shop and app member data breach (3,147,469 records): names, addresses, phone numbers, birth dates and hashed passwords leaked, and what members should do
On October 23, 2026, Lindt & Sprüngli Japan, the Japanese arm of the Swiss chocolate maker, announced that the system of the outside company that provides its online shop platform and manages its member data had been accessed without authorization, and that 3,147,469 member records from its online shop and the Lindt official app had leaked. According to the contractor's report, a vulnerability in software used on the contractor's server was exploited between 23:02 on October 17 and 0:16 on October 18 (Japan time). The leaked items are member ID, name, email address, postal address, phone number, date of birth, gender, newsletter settings, registered store, login password (stored hashed), and other member data such as name reading, registration date and last login. Payment data such as credit cards was not included. As of 11:00 on October 23, no misuse had been confirmed. The online shop has been suspended since 16:00 on October 21, and members will be asked to change their passwords when it reopens. Affected members are being emailed from October 26. This site's conclusion: members should not follow instructions in emails, texts, calls or letters claiming to be from Lindt, and should change the password now on any other service where they used the same one.
Piccoma newsletter email addresses leaked (1,002,404 records): only email addresses exposed, and what users should do
On October 24, 2026, Kakao piccoma Corp., which runs the Japanese manga app Piccoma, announced that blastmail, the email delivery system of RAKUS Lite Cloud Corporation that it used to send its newsletter, had been accessed without authorization by a third party, and that 1,002,404 customer email addresses that were recipients of one newsletter send had leaked. Piccoma learned of it from the delivery service's report on October 24. Only email addresses registered to receive the newsletter leaked; the company says it confirmed that customer management numbers and last-purchase dates were not included. Passwords were never given to blastmail and cannot have leaked, and Piccoma does not hold names or credit card details. The Piccoma app, website and the company's own systems were not accessed, and accounts, passwords and purchase data were not affected. No leak has been confirmed for the Piccoma Novels newsletter so far. The company stopped its newsletter, changed settings so that email sent from blastmail is not treated as genuine Piccoma email, and reported to Japan's Personal Information Protection Commission. It says it will contact affected customers individually. This site's conclusion: people who received the Piccoma newsletter should not open links in emails or texts claiming to be from Piccoma or publishers, should check in the app, and should never enter passwords or card numbers from an email.
Value Card prepaid platform breach (1.42 million records, 1.13 million MOS Card records): card numbers, PINs and balances leaked, and what cardholders should do
On October 23, 2026, PayCloud Holdings, a company listed on the Tokyo Stock Exchange Growth market, announced that the servers of Value Card, an in-house electronic money (store prepaid card) issuing service that its subsidiary Value Design Inc. provides to card issuers, were accessed without authorization by a third party, and that 1,424,748 records of ID numbers, PINs and balance information leaked (569,224 issued IDs and 855,524 unissued IDs, meaning IDs not yet bought by a user). The access was confirmed on October 19, and the cause was a third party exploiting a web server vulnerability in part of the subsidiary's system environment. No personal information was involved; the risk of misuse of issued IDs has been dealt with, and there has been no actual damage from misuse. The same day, MOS Food Services, Inc., which runs the MOS Burger chain and its MOS Card prepaid card, announced that unauthorized access to the system of Value Design, which it contracts to operate and maintain the MOS Card servers, leaked 1,133,070 MOS Card records (16-digit card number, 6-digit PIN and balance; about 570,000 cards in circulation and about 560,000 not yet in circulation), and that it forcibly reset the PINs linked to the leaked card numbers. Names, addresses, phone numbers and credit card details were not included. Which other issuers' cards were affected has not been disclosed. This site's conclusion: MOS Card holders should check their usage history for charges they do not recognise, contact the dedicated help line if online balance checks and similar functions stop working, and never give their PIN or card number to anyone who asks.
FANCL and Attenir online store breach (368,184 and 417,312 members): names, addresses, phone numbers and birth dates exposed, and what members should do
On October 16, 2026, FANCL Corporation and Attenir Corporation, two Japanese cosmetics and health-products companies, announced that their online stores had been accessed without authorization by an outside party between October 3 and 10, and that part of their member data had leaked. The access was found in an internal investigation on October 15, and the companies identified and stopped the feature that caused it. The leaked data covers 393,785 records for 368,184 FANCL members and 441,162 records for 417,312 Attenir members. The items are email address, name, address, phone number, date of birth, gender, customer number, a sub email address and its password (a hashed secondary password set by some members; the main password is not included), security question items (answers not included), and other registration data such as points and membership tier. Payment data such as credit cards is not included. No misuse or secondary harm has been confirmed. FANCL's FAQ says affected customers were contacted at their registered email address during October 17. This site's conclusion: members of either company should assume their name, address, phone number and birth date are known, should not follow instructions in emails, texts, calls or letters claiming to be from the companies, and should check through the official site or the shared help line.
Trustbank's Furusato Choice breach (4,454,097 member records): names, addresses and hashed passwords leaked — what donors should do
On October 20, 2026, Trustbank, Inc., which runs Furusato Choice, a major site for Japan's furusato nozei hometown tax donation scheme, announced that an outside party had gained unauthorized access to member data and that donors' personal data had leaked. After noticing unusual access patterns on October 19, the company found that the unauthorized access had taken place on October 17, and it shut down the related services at 15:50 on October 19. The leak it confirmed covers 4,454,097 member records: name, email address, postal address, phone number, hashed password and estimated donation tax deduction amount. In a second report on October 23, the company said that for five of these donors additional items had leaked, including points history, donation history, date of birth and delivery address. For two of them, an outside party accessed the My Page screen that shows saved card details (last four digits, cardholder name, expiry date). The company says card details are fetched from the payment processor each time that screen is shown and are not stored in its systems, and that they cannot be used on their own to make a card payment. Members have been emailed individually since October 21 about whether their data leaked and which items. In a third report on October 26, the company said it had begun gradually resuming the donation management system used by municipalities and return-gift vendors that day (its FAQ of the same day says from October 25). New donations are not being accepted, and no restart date has been set for the donor-facing site. All members' passwords have been invalidated, and a new password will need to be set after the restart. This site's conclusion: members should change the password on any other service where they use the same email and password combination, and should not open links in messages claiming to be from Furusato Choice or a municipality.
and ST HD breach (about 2.5 million customer records): what may have leaked and what members should do
On October 23, 2026, and ST HD Co., Ltd. announced that unauthorized access by a third party to its business servers may have leaked part of its customer, business-partner and employee data. According to the company, from around 7:30 a.m. on October 22 (Japan time) login attempts, intrusion and data extraction were carried out against several of its servers in turn; the company detected the unauthorized activity around 10:00 a.m., isolated the servers and cut off the access route by 5:00 p.m. The data that may have leaked covers about 2.5 million customer records (name, date of birth, gender, address, phone number, email address and member ID) and about 10,000 business-partner records (company name, ordering and return addresses, contact person's name, phone number and email address); the scope for employees is still being confirmed. Payment data such as credit card details, and passwords set by customers themselves, are not included, the company says. Its and ST web store was not affected by the unauthorized access, but member points currently cannot be used in stores or on the web store. The company says it is starting to contact affected customers and partners in turn and will set up an inquiry desk. This site's take: since passwords are said not to be included, the priority today is not changing your password but doubting messages that use the company's or its brands' names together with your real address or birth date. Check through the official app or a website you open yourself.
Unauthorized Access to the blastmail Email Delivery Service (All Customers' Account Data, and Mailing Lists and Similar Data for 345 Contracts): What Newsletter Recipients and Client Organizations Should Do
The email delivery service blastmail, provided by RAKUS Lite Cloud Co., Ltd., a subsidiary of RAKUS Co., Ltd., was accessed by an outside third party and data was taken out. The company shut the service down in an emergency at 0:30 a.m. on October 21, 2026, and the parent company RAKUS published a first and second report the same day. According to the notices, the third party intruded into two API servers, ran commands, and connected to the sales management system and the service database to take data out. From the sales management system, the company name, contact name, phone number, email address, billing email address and contract and payment history of every customer were taken. The company does not hold credit card numbers. For some customers, the leak of delivery data such as recipient lists was also confirmed. In its update at 17:00 on October 26, the company said one more case had been found, bringing this to 345 contracts, and that it had contacted all of them individually. The intrusion route is under investigation, and in its update at 12:00 on October 30 the company said the figure was still 345 and that it is aiming to restart around November 11 (subject to change). In notices from client organizations, The Niigata Nippo said the data of all members of its Niigata Nippo Passport service, up to about 253,000 people, including name (in katakana), email address, gender and age band, had leaked. JR Shikoku said about 30,000 records may have leaked, the City of Yokohama disclosed three related mailing services, the Ministry of the Environment disclosed six newsletters, and Japan Petroleum Exploration (JAPEX) disclosed its newsletter and investor-event mailing recipients as possibly affected. giftee said it confirmed its contract was not among the 288 counted as of October 23. This site's conclusion: people who receive newsletters from these organizations should not open links even if the sender name is genuine, and should check through the official site. Organizations that use blastmail should confirm whether they were contacted, decide on reporting to the Personal Information Protection Commission (joint reports with the company: second round of applications until November 5) and on notifying individuals, and warn their own staff about billing or re-login emails claiming to be from blastmail or RAKUS, since contact details of all customers were taken.
Unauthorized Access to Medley's Clinic System @link (at-link): Patients' Names, Birth Dates, Login IDs and Passwords Leaked — What Patients and Clinics Should Do
On October 15, 2026, Medley, Inc. announced unauthorized access by a third party to its medical-institution management system @link (at-link), the patient-facing at-link app and related services, and said it had suspended them from late at night on October 14. According to the company, it began investigating on October 11 after an outside specialist organization alerted it to possible unauthorized access, and confirmed the access. On October 23 it said it had confirmed that, from late September to mid-October 2026, the third party accessed the company's database through a program it had planted without authorization and obtained information, and that personal data had leaked. For patients who used the at-link app or web booking, the leaked items are name, name reading (furigana), birth month and day, email address (only if registered), app and web-booking login ID and password, the name of the clinic used, registration date, last visit date, and credit card payment history (payment date and amount only; only for those who paid online through the app). For patients who did not use the app or web booking, the leaked items are name, furigana, birth month and day, the name of the clinic used, registration date, last visit date, and the app and web-booking login ID and initial password. The company says it does not hold card numbers. The number of clinics and people affected is under investigation; the company will notify affected people in turn, working with the clinics. It has not disclosed the specific method, saying doing so could invite similar attacks. It has closed the route and invalidated all related credentials, and has reported to the Personal Information Protection Commission and the Ministry of Health, Labour and Welfare. App and web-booking passwords will not be carried over; users will set new ones when the service restarts. In the notice updated at 12:30 on October 28, the company said test use of the clinic-facing “@link Cloud beta” began at some clinics on October 28 (features under test: checking and registering bookings, patient information and the consultation calendar), that the patient app and web-booking site and other services remain suspended, and that it plans to refund fees for the suspension period within November. The investigation into the cause and scope is continuing. This site's view: people who used the at-link app or web booking should change the password on any service where they reused it, and should not open links in messages that mention their clinic or visits. Clinics should direct patient inquiries to the company's dedicated contact.
Nikkei Unauthorized Access (About 1.83 Million Records): Names, Email Addresses and More Leaked in About 150,000 — What Users Should Do
On October 16, 2026, Nikkei Inc., the Japanese newspaper publisher, announced that a cloud service it uses for system development had been accessed without authorization and that, as of the 16th, about 1.83 million records of personal information had leaked. About 150,000 contained at least one of name, email address, postal address, phone number or date of birth, and about 120,000 of those included an email address. The remaining roughly 1.68 million consisted only of identifiers that cannot identify a person on their own. Credit card information was not included. According to the company, credentials for accessing the cloud service were stolen by some means, and the unauthorized access took place from the early hours to the morning of October 7. The company disabled the credentials used and reported the incident to Japan's Personal Information Protection Commission on October 11. As of the 16th, no secondary harm such as misuse of the data, and no system outage or data tampering, had been confirmed. The company says it will notify individually those whose data is confirmed to have leaked. Group company Nikkei National Geographic said on October 22 that information on some users of its services was included. Which services' users are affected, counts per data item, and how the credentials were stolen have not been disclosed. This site's take: do not use links or phone numbers in emails or calls claiming to be Nikkei; check on the official site.
Treasure Factory (Trefac) breach (746,277 email records): what home-buyback and Trefac Moving customers should do
On October 23, 2026, Treasure Factory Co., Ltd., a Japanese second-hand goods retailer, announced that an outside party had gained unauthorized access to the case-management system it uses to take and handle requests for its home buyback service (shutchō kaitori) and its Trefac Moving service, and had taken part of the customer and other data held there. According to the company's timely disclosure, the confirmed data is 746,277 customer records (email addresses; 11 of them also include name and address), 750 records of names and email addresses of business partners, employees and others, and 1,000 records of names and device identifiers for devices used by business partners, employees and others. Credit card numbers and other payment information were not included, and customer data held at stores and in the company's app is managed in separate systems and was not affected. The company confirmed the access through an access-log review on October 20 and cut off outside access and the request forms the same day. It believes a vulnerability related to database access was exploited, and says the incident is not related to a recently disclosed PHP vulnerability. No secondary harm has been confirmed. The system and request forms are scheduled to restart around October 28. This site's conclusion: if you have ever requested home buyback or Trefac Moving, assume your email address is known, do not open links in emails claiming to be from Trefac, and check on the official site instead.
Capcom CAPCOM ID Breach (11,774,247 Records): Email Addresses and Login Data Leaked — What Account Holders Should Do
On October 22, 2026, Capcom Co., Ltd. announced that its online membership service CAPCOM ID (the shared account used for Capcom web services and some online games) was accessed without authorization by a third party, and that part of its customer information leaked. The leaked data are email addresses and system-specific identifier information (account creation date and time, last login date and time, number of logins, and the client IP address used at the last login), in 11,774,247 records worldwide. For 43 of them, date of birth, gender, country/region and nickname also leaked. On 196 of the accounts, the login password had been changed without authorization; the company has already reset those passwords. According to its second notice of October 23, for 19 of those 196 accounts (in Japan), an unauthorized third party accessed the account pages of e-Capcom, the company's online store in Japan, and the following leaked: name, name in Japanese phonetic characters, phone number, postal code, address, gender, date of birth, purchase history, e-Capcom inquiry history and saved address book information. For the remaining 177 of the 196 accounts, the company found no information compromised as a result of the password changes. The company says it has not confirmed any leak of passwords set by customers themselves, and credit card information was not among the affected data. According to the company, it found traces suggesting unauthorized access on October 19, immediately began blocking the access and investigating the cause and scope, and confirmed the unauthorized access the same day; on October 20 it confirmed the leak and the password changes; and on October 21 it reported the incident to the police and Japan's Personal Information Protection Commission. It says it has identified and addressed the attack method, but has not disclosed details of the cause. In the second notice it said the investigation into the scope of impact has been completed and that it will keep monitoring CAPCOM ID and related services. Services using CAPCOM ID and all games remain available. It said it would contact affected customers individually and set up dedicated support channels for each region. This site's take: CAPCOM ID holders should not open links in emails or texts claiming to be Capcom, should not give personal details over the phone, should change any password they reuse elsewhere, and should turn on two-factor authentication.
Comic Cmoa Member Data Breach (Up to About 4.2 Million Records in Log Files): Email Addresses and Dates of Birth Leaked — What Users Should Do
NTT Solmare Corporation, which runs the Japanese e-book store Comic Cmoa (コミックシーモア), published four notices about unauthorized access to the service, from a first notice on October 15, 2026 to a fourth report on October 21. According to the company, on October 15 it judged that unauthorized access from outside to its servers had very likely taken place and suspended the service at 11:35. In its second report on October 16 it said it had confirmed that member data in the system that manages member information had leaked to a third party (the count was still being examined). In its third report on October 18 it said it had identified the intrusion route and attack method and was dealing with them, and that some system log files had also been viewed and taken. In its fourth report on October 21 it described the data confirmed as leaked as 319 records of registration data in the member database (email address, hashed password, nickname, date of birth, gender) and up to about 4.2 million records in system log files (email address, nickname, date of birth, gender; no passwords; possibly including duplicates for the same person). It says credit card data is not held in the affected systems and did not leak, and that no leak of purchase histories and no leak, loss or damage of MY Bookshelf (users' libraries) has been confirmed. It says identifying and blocking the intrusion route and attack method is complete, but has not disclosed what they were. Affected people will be contacted by email. The service remains suspended and is to resume in stages, starting with web reading of purchased titles; all users will be asked to reset their passwords on resumption. This site's take: anyone who uses the same email address and password as on Comic Cmoa for another service should change that password today, should not open links in emails claiming to be the company, and should check through NTT Solmare's news release page opened themselves.
Iwai Cosmo Securities vendor breach (4,975 customers): what leaked, the unintended trades, and what customers should do
On October 16, 2026, Iwai Cosmo Securities Co., Ltd., a Japanese brokerage, announced through a timely disclosure by its parent company Iwai Cosmo Holdings that the system of a vendor it uses to operate and maintain its online trading system had been accessed by a third party, and that names, email addresses and other details (氏名、メールアドレス他) of 4,611 online trading customers had leaked. The company detected the access on October 14. In its second notice on October 20, it said a re-examination of access and communication logs found 364 more people, bringing the total to 4,975; it said this was not caused by any later access. The leaked data does not include trading PINs, and the company says it cannot be used to log in to accounts or trade. The second notice also disclosed that on October 14 the trade management system was attacked as well, and orders the customers did not intend were placed in 7 accounts (5 of them were executed). The trades have been reversed and customers bear no cost. The company says the leaked personal data was not used for these trades. It says the point that allowed the access has been identified and fixed, and that the vendor added measures such as access restrictions on management functions. The specific method has not been disclosed. This site's take: do not use links or phone numbers in messages claiming to be from Iwai Cosmo; check your order and execution history from a login page you opened yourself, and contact the official line (0120-405-546) with any concerns.
Unauthorized Access to Ymirlink's Cuenote FC Email Delivery Service (Now About 51.63 Million Cumulative Records): Express Reservation and smartEX Member Data Included. What Newsletter Recipients and Client Companies Should Do
On October 26, 2026, Ymirlink, Inc. (TSE Growth, 4372) published a second report on the unauthorized access to its email delivery service Cuenote FC, saying data leaked from 49 systems, a cumulative total of 51,628,280 records. In its first report on October 19 it had estimated five systems and about 9 million cumulative records; after reviewing the logs of all systems, it found records of unauthorized access and data export on 42 more systems on October 25. The leak count is still under investigation for 16 systems, and the cumulative total may rise. It attributes the incident to a library vulnerability and says it confirmed that the credentials of its support and quality-control staff were obtained, malicious programs were installed, and session information captured at login was used to log in without authorization. In its customer management system Cuenote BASE, 190 records of customer contract information (company name, name, phone, email address) were viewable. It says it has found no evidence that the leaked personal data was made public or misused. Among client companies, JR Central, JR West and JR Kyushu announced on October 26 that, although they had first been told their Express Reservation and smartEX services were not affected, the email addresses, member IDs, names (in katakana) and membership types of members sent emails through the service had leaked. In a second report on November 5, they said the number affected is 172,735. AsMarq said the same day it had been told that part of the data registered in the environment it uses had likely been obtained without authorization. On October 27 at 21:00, Bandai Namco Entertainment Inc. and BANDAI SPIRITS Co., Ltd. announced that 346,247 records (email addresses and internal identifiers for managing Bandai Namco ID) had leaked from the THE GUNDAM BASE MEMBERS environment of the Bandai Namco ID email service; they say names, addresses, purchase history, login passwords and credit card details are not included, and that other environments are still being checked. They say emails they send about this will not contain URLs. DCM Holdings (email delivery for its membership program Maibo) said in its October 30 second report that it confirmed a leak affecting 753,272 members (as of October 29), with the email address, member ID, name, gender, birth year and month, and prefecture of residence; passwords, card information and point balances or history are not included. This site's conclusion: Express Reservation and smartEX members should not open links even in emails or SMS that show their katakana name or member ID, and should check through the official app or a bookmarked official site. Newsletter recipients should not open links in emails claiming to come from the sender. Client companies should confirm with Ymirlink whether their environment is affected and decide whether they must report to the Personal Information Protection Commission and notify individuals.
Recruit Carsensor.net and C-MATCH Breach (Up to 3,709,551 Records): Names and Addresses of People Who Contacted Dealers May Be Exposed — What Users and Dealers Should Do
On October 21, 2026, Recruit Co., Ltd. announced that information on users and business partners of Carsensor.net, its used-car listings site (including the app), and C-MATCH, its business support service for used-car dealers, may have leaked outside as a result of unauthorized access. According to the company, it detected suspicious access from outside to Carsensor.net-related systems on October 17 and suspended all related services from around 17:00 that day. On October 20 it identified the items and the number (maximum) of personal data records that may have leaked. The count is up to 3,709,551 records: 3,210,421 for people who contacted dealers through the site (mostly name and address; addresses are in principle only down to the city or municipality), 5,289 for people who posted reviews, 483,168 for dealers registered with C-MATCH (staff names and phone numbers, secondhand dealer licence numbers, login IDs and so on; for sole proprietors, also direct-debit bank account information), and 10,673 for company employees and staff of contractors and sales agents. None include payment data such as credit cards, or login passwords. The cause is unauthorized access by a third party, with details under investigation. The company has filed a preliminary report with Japan's Personal Information Protection Commission and will contact affected people individually in turn. As of October 21 no secondary harm had been confirmed. Services have been resuming in stages from around 13:00 on October 22, starting with those whose safety has been confirmed. This site's take: anyone who contacted a dealer through Carsensor should assume letters, emails and calls may come from someone who knows their name and address, should not open links or attachments in unexpected contacts, and should check through Recruit's notice page.
H2O ID Data Breach (About 1.26 Million Records) via the Hankyu and Hanshin Department Store Reservation Site: Addresses, Phone Numbers and Birth Dates Leaked — What Members Should Do
On October 19, 2026, H2O Retailing Corporation and Hankyu Hanshin Department Stores, Inc. jointly announced that the Hankyu and Hanshin department store reservation site, HANKYU HANSHIN E-STORES and Remo Order, all run by Hankyu Hanshin Department Stores, had been accessed without authorization by a third party, and that part of customers' personal data had leaked. On October 16 the companies confirmed unauthorized access to the customer management system via the reservation site and stopped that site's whole system; on October 17 they confirmed unauthorized access at E-STORES and Remo Order as well and stopped both. On October 19 it was established that part of the personal data of about 1.26 million H2O IDs managed in the customer management system had leaked. The notice says part of the personal data of almost all H2O ID members leaked. The items are H2O ID, name (kanji and katakana), gender, email address, postal code, address, mobile phone number, phone number, age, date of birth, and the services used with the H2O ID. For E-STORES and Remo Order, whether data leaked is under investigation; the companies list the data those services hold as order history, part of credit card information (card type, last four digits, cardholder name, expiry date), part of point card information, and address book information. Full card numbers and security codes are not held. No leak of login passwords has been confirmed, and no misuse or secondary damage has been confirmed. The cause is under investigation. E-STORES reopened at 14:00 on October 19. This site's take: expect convincing messages that know your name, address, phone number, birth date and which services you use; do not open their links, and check on the official site you open yourself or through the contacts in the notice.
NIFTY Line Application System Breach (Up to 542,513 Records): Member IDs, Names, Addresses and Phone Numbers May Be Exposed — What Fibre Customers Should Do
On October 19, 2026, NIFTY Corporation, a Japanese internet service provider, announced (first report) that it had confirmed unauthorized access from outside to its line application and acceptance management system. According to the company, it confirmed the unauthorized access at around 10:20 on October 19 and immediately blocked access from the source. The system is an internal management tool the company uses to register information; it is separate from the website (application forms and so on) that customers use to apply directly. Up to 542,513 records may be affected. They cover customers who applied for a line since 2019 (excluding the company's website), for the services @nifty Hikari, @nifty MAX Hikari and @nifty au Hikari Plus. The items are member ID, name, gender, date of birth, address, phone number and email address; this is the full list of items that may have leaked, and what actually leaked is under investigation. The system holds no bank account or credit card data, which is not included. The notice does not mention passwords. The cause has not been disclosed; the company is investigating with outside specialists and is in the process of reporting to Japan's Personal Information Protection Commission. This site's take: anyone who applied for one of these services since 2019 should assume contacts may come from someone who knows their name, address, phone number and birth date, and should not follow links or instructions in emails, texts or calls claiming to be NIFTY. Check through an official contact you look up yourself.
Unauthorized Access to the Studio Website Builder: All Users' Data and Form Submissions May Have Leaked — What Form Senders and Site Owners Should Do
On October 16, 2026, Studio Inc. announced that a third party had gained unauthorized access to the cloud environment it uses, and that data on every customer registered with its website builder Studio may have been leaked. The third party exploited a vulnerability in some Studio features to access the environment and made its data retrievable from outside. The confirmed period of unauthorized access is September 30 to October 1, 2026 (Japan time); the company found it in an internal investigation on October 13 and finished fixing the vulnerability and closing the route on October 13–14. Data that may have leaked includes account data (user names, email addresses, hashed passwords and more), design editor and CMS content, the contents of forms submitted on Studio-built sites, live preview URLs, API keys and tokens for external services registered in API integrations, passwords of password-protected pages, and webhook notification URLs. Some data stored encrypted may also have been read, because the key needed to decrypt it was read in the same access. The company has not confirmed that a third party actually took the data, but is treating it as taken. The number of people affected and whether any misuse has occurred are under investigation. Companies and organizations that built sites with Studio have also said that personal data sent through their forms may have leaked: Luup gave 21,368 records, Link-U Group 7,663, TRUSTART about 1,440 and Saitama Prefecture's Saitama Green Forest Museum 162. Japan's Digital Agency said on October 22, after Studio Inc. reported the incident to it on October 16, that inquiries entered in its website's contact forms between May 2021 and March 2023 (five categories, up to 8,833 records in the largest; up to 13,323 in all, as added up by this site) and 35 Studio account records may have leaked. On reporting to Japan's Personal Information Protection Commission (PPC), Studio Inc. first asked form users on October 17 to put individual reports on hold, then said on October 20 that, after talks with the PPC, customers can choose to report individually or jointly with Studio (either way, customers still decide on notifying the affected individuals). On October 19 it added to its guidance page that even responses that are sales pitches, spam or raise safety concerns in principle require notifying the individual if they contain information that identifies a person. This site's conclusion: if you sent a form on a Studio-built site, check that site owner's notice and do not open links in messages that mention what you sent. Site owners should change their password and rotate integration keys in the order Studio Inc. gives.
Burger King Japan App Breach (About 11.18 Million Records): Names, Birth Dates and Phone Numbers Leaked — What Members Should Do
On October 15, 2026, BK Japan Co., Ltd., which runs Burger King in Japan, announced that the official Burger King app it operates had been accessed without authorization by a third party, and that it had confirmed the leak of app members' information. The access took place from October 2 to October 7, 2026, and the leak was established on October 13. About 11.18 million app member records are affected. The items are member ID, email address, registration type, prefecture, gender, date of birth, name (in kanji and katakana), phone number, whether the member has a mobile order history, and whether the email address has been verified. The company says it does not hold credit card numbers, so they did not leak, and that no leak of login password information has been confirmed so far. The detailed cause is under investigation with an outside specialist organization, and no secondary damage such as fraudulent use had been confirmed at the time of the notice. There was no follow-up as of October 17. This site's take: expect convincing messages that know your name, birth date and phone number; do not open their links, and check in the official app you open yourself. If you use your birth date as a PIN or password, change it.
SourceNext Member Data Leak (22,519,960 Records): Emails, Passwords and Addresses May Be Exposed — What Members Should Do
On October 15, 2026, SOURCENEXT CORPORATION announced that a third party had gained unauthorized access to member data it manages and that personal data of its registered members had leaked outside the company. According to the company, from around 10:00 on October 9 a third party misused a member data retrieval API to obtain member information; the company confirmed the unauthorized access at around 9:00 on October 13 and completed containment by 13:36 the same day. The data that may have leaked covers 22,519,960 records. The items are email address, password, name, name in katakana, address, gender, phone number, fax number, date of birth, company name, job title, department and system identifiers (subscribed services, registration date, login date and so on); the items differ by how each member registered. Credit card data is not stored in the affected system and is not included, the company says. In an update on October 16, the company said every member's password has already been disabled and the old passwords no longer work, and asked members to set a new one. An October 19 report attributes encrypted storage and confirmed decrypted exposure to the company’s spokesperson. The company's FAQ says it asked an independent outside security specialist to start a third-party investigation on October 16, that its Super Security and Virus Security products can still be used as before, and that data saved in 1Password is not held by the company and is not part of the leak. Separately, on October 27 and November 5 the company announced that a third party had gained unauthorized access to the provider of the email delivery service it used (a contractor), so email addresses and order information used for deliveries may have leaked (142,669 records, counted as distinct email addresses, in the November 5 second report; passwords, names, addresses, phone numbers and credit card information are not included). The company says this is a separate incident, unrelated to the October 15 one. This site's take: anyone who has registered with SourceNext should first change the password on any other service that uses the same email and password, then set a new SourceNext password through the official website opened themselves, and not use links or numbers in emails, text messages, calls or letters claiming to be SourceNext.
IDARE data breach (129,659 people): balances, transaction history and some ID document numbers leaked — what users should do
On October 13, 2026, Fivot Inc. announced that its cashless app IDARE had suffered unauthorized third-party access that leaked personal data. A vulnerability in outside software the company used for customer support and other work was exploited, and data in the company's database was obtained on multiple occasions between August 10 and September 27. The people affected are the 129,659 who had registered by September 27, including those who had closed their accounts. For everyone, the leaked data includes phone number, email address, date of birth, user ID, display name, account settings and status, balance, transaction history, and the name and expiry date on the IDARE card. For some people it also includes the name, address, gender, purpose of use and ID document number submitted for identity verification, the last 4 digits of the IDARE card number, the first 6 and last 4 digits of a credit card registered for top-ups, the last 3 digits of a bank account registered for top-ups, the activation code for the physical card, and annual income and employer details entered for LADDER, a lending service that closed in October 2021. Login passwords, images of ID documents and faces, My Number, full card numbers, security codes, PINs and full account numbers were not involved. The company says no fraudulent transactions have been confirmed and that multi-factor authentication is required to log in. In its second report on October 21, it said no fraudulent transactions had been confirmed as of that date and set out prevention measures with deadlines (October 30 and November 30). A third-party investigation by an outside specialist organisation is expected to be compiled by late November to early December, and the company says it will publish the report when it is complete. This site's conclusion: the leaked data alone cannot be used to log in or pay, but a message that correctly states your balance or recent purchases is not proof it is genuine. Do not act on messages claiming to be IDARE, a card company or a bank through the channel they arrived on, and never give anyone your password, PIN, security code or authentication code.
SpeeCAN RAIDEN Breach (2026): Disaster-Alert Email Users and Scam Risks
On October 13, 2026, Arcadia Inc. announced that SpeeCAN RAIDEN, its mass-notification service for email and other messages, was accessed without authorization by a third party, and that contact names, email addresses, phone and fax numbers, staff and contract information, and the text of delivered messages stored as history may have leaked. The maximum counts are about 3,136,000 email addresses, about 105,000 phone numbers and about 15,000 fax numbers (all estimates, still under investigation). Arcadia saw suspicious activity at 16:30 on October 11, applied an interim block around 3:00 on October 12, and at 11:00 on October 13 shut down the services that had been the intrusion route (raiden3, and s2 for Raiden School). On October 14 it added NET119 and 119RAIDEN to the possible leak, and in its 11th update on October 16 gave figures per service: for NET119, personal data such as names, dates of birth and addresses linked to 9,020 email addresses (it confirmed that no sensitive personal data leaked); for 119RAIDEN, about 97,000 email addresses and other data. The suspended services were restored around 15:00 on October 15. Payment data is not handled. Municipalities have issued their own notices; Shizuoka City says it has established that email addresses of 34,336 registered residents and other data leaked, and has seen fake emails posing as a card company sent from the same domain as the real alerts, @raiden.ktaiwork.jp. In its 17th update on October 21, Arcadia said a malicious program sent 1,423,428 phishing emails from its system between 1:17 and 7:16 on October 13, that at least 869,575 of them went to addresses the company does not hold, and that an outside organisation will carry out a dark-web survey. It has also emailed clients and resellers about filing the reports to the Personal Information Protection Commission and the Ministry of Internal Affairs and Communications on their behalf. In its 20th update on October 22, it told clients they must use two-step authentication at login, to prevent a recurrence, and in its 22nd update on October 23 it asked Raiden School clients to do the same. In the report published with its 21st update on October 23, it says a configuration file was obtained through a vulnerability in the media server that publishes attachments, leaking a secret key used for logins between services, among other causes; that all services are within the scope of the possible leak; and that the count is still under investigation (9,020 of them for NET119). It has asked a third-party security organisation for a detailed investigation. In its 25th update (17:00, November 2) it said that, separately from the October 13 sending, suspected phishing emails were also sent externally from its system on October 22 and 23. It gives two causes: the mail-sending API account leaked during the October 11 to 13 intrusion and its password was broken by brute force and used from outside, and after the API integration was stopped, a URL parsing confusion vulnerability was used to abuse the API again. It says it stopped the API integration at about 6:30 on October 22 and fixed the vulnerability at about 10:30 on October 23, and that the unauthorized emails stopped. In the 26th update at 16:15 on November 6, it said it is resuming the API integration for external systems that was stopped in the 19th update; customers need to change settings to use it again, and those affected are being contacted individually. Our conclusion: the sender cannot tell real from fake, so do not block the disaster-alert sender, and do not open links in emails asking you to confirm card or personal details.
Unauthorized Access to Commune (166,505 Member Records, Counted per Community): Member Data from Corporate Communities Leaked — What Members and Operators Should Do
On October 9, 2026, Commune Inc. announced that its community services for businesses, Commune and Commune for Work, were accessed without authorization by an outside third party, and that member data in some communities leaked. The leaks occurred from about 18:00 on October 5 to about 21:00 on October 6, and from 13:17 to 14:36 on October 7 (Japan time). Its first notice gave about 307,000 members (an estimate of unique people) as the maximum possibly affected. In a follow-up on October 21, after a detailed investigation, it confirmed that 166,505 members were affected (the total of member IDs counted per community, so people in several communities are counted once for each; this includes communities run by the company and test/demo communities, and excludes accounts created by the attacker), and that 125,601 of them had data including email addresses leaked. For the others, the leaked data includes display names, profiles and private group memberships. For 144 members, passwords were changed to temporary ones without their action. No leak of the passwords themselves or of direct messages was confirmed, and the company does not hold payment data. It attributes the incident to invitation links for private communities obtained illegitimately and to impersonation of administrators. Client companies that run communities on the service have also published notices; JMAM said the names, addresses, ages and phone numbers in member profiles on its Toki Labo community also leaked. To prevent misuse of the leaked email addresses, Commune Inc. stopped all communities for emergency maintenance from 00:50 on October 10 and took measures such as making two-factor authentication mandatory for administrator accounts. On October 16 it announced that communities would reopen in stages, starting with clients that ask, in the web browser version only and with some features restricted (the app, new registration with an email address and “forgot password” resets remain unavailable). It says no new unauthorized access or leak was found during the maintenance or testing. The October 21 follow-up also says the company filed a preliminary report with the Ministry of Internal Affairs and Communications (Kanto Bureau of Telecommunications) on October 9, has begun consulting the police, found no programs, accounts or settings left behind by the attacker after analysing all logs, and is preparing a forensic investigation by a third-party organisation. This site's take: check the notice of the company that runs your community to see whether you are affected, and do not open links in emails that claim to come from the community.
Japan's October 2026 warnings on unauthorized access (National Cybersecurity Office, IPA, JPCERT/CC): what to check this week, and what to do if you find something
In September and October 2026, organizations in Japan disclosed one data breach from unauthorized access after another. On 9 October the Cabinet Secretariat's National Cybersecurity Office and IPA issued warnings, following JPCERT/CC's alert of 8 October. IPA says the attacks have not been tied to a single product's vulnerability and appear to start from compromised internet-facing apps and services or accounts. This week: (1) list your internet-facing apps and review their logs for the last month, then three months; (2) check cloud, VPN and other external services for failed sign-ins, unfamiliar source addresses and accounts you don't recognise; (3) re-inventory the personal data you hold and minimise it. If anything looks wrong, declare an incident, preserve logs, bring in specialists and report to the Personal Information Protection Commission. This site's view: discovering that you only keep one month of logs is itself a finding to act on.
Japan's online ID checks move to IC-chip reading (April 2027): what changes, and how users and businesses should prepare
An amendment to the Ordinance for Enforcement of Japan's Act on Prevention of Transfer of Criminal Proceeds (promulgated 24 June 2025, in force 1 April 2027) ends, in principle, non-face-to-face ID checks that rely on images or copies of ID documents for bank accounts and other covered transactions. Reading the IC chip in a driver's license or My Number Card, and the card's electronic certificates (JPKI), become the main methods. In-person checks also change to presenting the document and having its IC chip read. Mobile phone contracts made online already switched on 1 April 2026; in-store contracts follow from April 2027. On 9 October 2026 the Financial Services Agency, citing the current situation of repeated unauthorized access and leaks of customer data that included driver's license images, asked financial institutions to move to IC-chip reading without waiting for the effective date. This site's conclusion: a leaked image can be reused by anyone, but IC-chip reading needs the physical card and its PIN. Users should check their two license PINs and My Number Card PINs now; businesses should stop collecting and keeping document images.
Japan data breach statistics: 17,139 leak reports to the Personal Information Protection Commission in FY2025, and about 80% of those filed directly were human error
A statistics page on leak reports (rouei-tou houkoku) filed with Japan's Personal Information Protection Commission (PPC). Reports from businesses: 4,141 in FY2020, 5,846 in FY2021, 7,685 in FY2022, 12,120 in FY2023, 19,056 in FY2024 and 17,139 in FY2025. Reporting certain leaks became mandatory in April 2022, and leaks of sensitive data such as medical history must be reported even when only one person is affected, which pushed counts up. For reports filed directly with the commission in FY2025, the causes were handing documents to the wrong person (48.3%), sending to the wrong recipient (26.0%) and unauthorized access (9.4%). Our conclusion: the count is driven by documents handed or sent to the wrong person at hospitals, pharmacies and similar counters, so organizations should first add recipient checks. Large incidents affecting many people are mostly unauthorized access and call for patching internet-facing devices, multi-factor authentication and managing contractors. Updated each quarter when the PPC publishes.
Baitoru breach (up to about 3.89 million email addresses): only emails leaked — how members can spot fake interview messages and job scams
On October 9, 2026, dip Corporation announced that on October 6 it had confirmed unauthorized third-party access to Baitoru and Baitoru NEXT, the job sites it runs in Japan, and that some member email addresses had leaked. The number of addresses that may have leaked is up to 3,885,771. The company says only email addresses leaked and that names, phone numbers, passwords and credit card details were not included. It attributes the cause to unauthorized access from overseas that exploited a flaw in the specification of part of its system. It blocked all access from overseas and modified the program. It has not confirmed any posting of the data online or any misuse. Affected members were told on the services on October 6 and are being contacted individually by email and other means. There was no follow-up notice as of October 10. This site's take: even if only email addresses leaked, they are known to belong to job-site members. Do not open links in messages about interview schedules or application confirmations; check in the official app you open yourself. Do not move to other messaging apps or answer offers of 'high pay, paid the same day'.
Bookoff Member Data Leak (6,383,279 People): Names, Addresses, Emails and Password Hashes May Be Exposed — What Members Should Do
On October 9, 2026, BOOKOFF GROUP HOLDINGS LIMITED announced that a third party had gained unauthorized access to the member management system for Bookoff in Japan, provided by its subsidiary BOOKOFF CORPORATION LIMITED, and that member data had been leaked outside the company. According to its second report on October 13, member data was taken from outside between October 4 and 6. The count is 6,427,735 records by member number, or 6,383,279 people when member records registered with the same email address are counted as one person (212,371 of them former members). Those affected are app members, online store members and web members; people who only use a member card and never registered through the app or web are not included. The data that may have leaked is name, date of birth, gender, occupation, nickname, email address, phone number, postal code and address, password hash, point card number and member number (occupation and nickname were added by a correction on October 16), though not every item leaked for every member. Payment data such as credit card details, bank account details, text read from ID documents at in-store buybacks and ID document images from mail-in buybacks are not included. The company emailed affected members in stages from October 15 (sending to every address it could confirm as deliverable finished on October 22) and asks them to change their passwords for the official online store and app. On October 23 it announced a web lookup on the Bookoff member site that lets members sign in and check whether they are affected, and said it had opened a dedicated toll-free line on October 22. In its third report on November 6, it said an investigation with outside experts found that a third party had exploited an access-control problem in part of the system that handles member data; it is withholding technical details such as the system configuration and settings. According to the third report, the scope (services, people and data items) is unchanged from the second report, and from October 26 to 29 it also notified affected members individually through notices in the official app. No publication of member data, misuse of points or alteration of member data has been confirmed, and the company says it will fully compensate points if misuse resulting from the incident is confirmed. It plans to submit its final report to the Personal Information Protection Commission in early December. This site's take: anyone who registered through the app or online store should change the password through the official app or a website they open themselves, change it on any other service that shares it, and not open links in emails or texts claiming to be Bookoff.
Malware on a Daiichikosho Contractor's PC (About 8.72 Million Records): Big Echo and Other Members' Names, Birth Dates and Phone Numbers May Have Leaked — What to Do
On October 8, 2026, Daiichikosho Co., Ltd. announced that a company to which it outsources the handling of personal information had reported that one PC used by one of its employees was infected with malware, and that Daiichikosho's customer information may have leaked. Personal data related to the outsourced work had been temporarily stored on that PC. The records concern about 8,631,000 customers who registered as members or made reservations at the company's stores (Big Echo, Mega Big, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining, after removing duplicates) and about 93,000 employees, about 8,724,000 in total. The items are name (registered name), gender, date of birth, email address and phone number. Passwords were not included, and the company says points cannot be used with this information alone. No actual external leak, misuse or impact on the company's own systems had been confirmed. A toll-free inquiry line opened on October 9. In an addition dated October 26, the company said it is contacting customers who may be affected individually, in turn, by SMS and other means, and published the sender numbers (NTT Docomo, au and Rakuten Mobile: 05036052572, which may appear as +815036052572; SoftBank: 247473). It says this contact does not mean a new leak has been found, and that no actual external leak or misuse resulting from the incident has been confirmed. It also says the sender number alone does not guarantee that an SMS is genuine. On November 6 it published the results of a forensic investigation by an outside specialist organisation: malware infection and unauthorized communication with an outside server were found on the device the contractor had been using, and the malware had a function to send information on the device to outside parties, but what information was actually sent, and how much, could not be identified. No leak or misuse of personal information resulting from the incident has been confirmed. No traces suggesting remote control were found, and the malware had already been neutralized when the investigation began. Individual notices to customers who may be affected continue. This site's take: do not open links in messages claiming to be Big Echo or DAM about coupons, membership renewal or points, or in texts claiming to be from Daiichikosho; check in the official app or a site you open yourself, and stop using your birth date as a PIN or password.
JR East, VIEW Card and JR Kyushu Possible Email Leak (2026): What to Do
On October 9, 2026, East Japan Railway Company (JR East), VIEW Card Co., Ltd. and Kyushu Railway Company (JR Kyushu) each announced that the external service they use to send email to members had been affected by unauthorized access at a cloud service provider, and that they could not rule out that members' email addresses and other data had been viewed or obtained. The numbers are, at most, about 1.67 million eki-net members and about 390,000 Otona no Kyujitsu Club members (JR East); about 4.03 million email addresses of VIEW's NET users (VIEW Card); and, at most, about 1.3 million JR Kyushu Web members (JR Kyushu). For eki-net, VIEW's NET and JR Kyushu Web members only email addresses are involved; for Otona no Kyujitsu Club members, the member number, credit card expiry date and date of birth are involved as well. Names, addresses, phone numbers and card numbers are excluded. The cloud service provider has said that the outage which began early on October 7 was caused by a ransomware attack by a third party. In its fifth report on October 14, the provider said it had found no trace of data in virtual servers in the affected area being viewed or taken out, and concluded that no data leaked externally. On October 15, after receiving those findings, JR Kyushu announced that no leak of JR Kyushu Web members' email addresses had been confirmed. JR East's eki-net site also says that on October 15 the email delivery service company reported that it had concluded no personal data of eki-net members leaked (checked October 19). For Otona no Kyujitsu Club members and VIEW Card, this site could find no follow-up as of October 19 (checked on each company's site). In its seventh report on October 27, the cloud service provider said its investigation was complete and named the cause as a vulnerability in open-source software used in the authentication system of its customer management portal. Its conclusion that no data in virtual servers leaked externally is unchanged. This site's take: JR Kyushu said no leak was confirmed, and eki-net says it was told no personal data of eki-net members leaked. Even so, fake emails using this incident as a pretext may still arrive. Do not log in from links in emails; check through the official app or a bookmark you saved yourself.
Unauthorized Access to Lawson ID (2,155,345 Records): Email Addresses and Names Leaked — What Members and App Reservation Users Should Do
On October 8, 2026, Lawson, Inc. announced that unauthorized third-party access to its account service Lawson ID, and to Lawson App Reservation (a service for reserving and paying for seasonal event products in the app), had leaked personal data. An investigation on October 7 found that Lawson ID was accessed without authorization from September 12 to 14 and App Reservation on September 17. The company confirmed leaks of 2,155,345 Lawson ID records (email address and name, plus gender, phone number, address and newsletter preference where these had been entered, for example when applying for a giveaway with Lawson ID) and 26 App Reservation records (name, phone number and part of the credit card number). The company says a system related to the Lawson app was misused, and that a security mechanism meant to show information to the user themselves in the app was accessed without authorization by a third party. Passwords are not among the listed items. As of October 8 no misuse or secondary harm had been confirmed, and on October 13 it added lawson_id@id.lawson.jp as a sender address for the individual notification emails. This site's take: Lawson ID holders should not open links in emails or texts claiming to be Lawson or offering points or coupons, and should check through the official app they open themselves.
NewsPicks Data Breach (Card Holder Names and Last Digits, up to 362,000 Records): What Leaked Through an Internal Admin Tool and What Users Should Do
On October 8, 2026, Uzabase, Inc. announced that an admin tool used in the operation of its news service NewsPicks had been accessed without authorization by a third party, and that some users' personal data may have leaked. Its second notice on October 9 said the intrusion exploited a vulnerability in that admin tool, and gave maximum estimated counts per item: part of the card data used for web payments (card holder name and the last 3 or 4 digits of the card number, etc.) 362,000; email addresses 323,000; job-level category 273,000; affiliation 65,000; names 59,000; and others. The company says full card numbers and security codes were never stored on its systems and did not leak, and that no password leak has been confirmed. No secondary damage has been confirmed. This site's take: a message that quotes your card's last digits or your employer is not proof that it is genuine. Do not open links, check through the official app or a site you open yourself, and keep an eye on your card statements.
skyticket (Adventure Inc.) Data Breach (About 14.64 Million Records): Passwords, Refund Bank Details and Some Users' Card Data Exposed — What Users Should Do Today
On October 9, 2026, Adventure Inc. announced three separate incidents of unauthorized access, each by a different route, affecting its travel comparison and booking site skyticket. In the first, an administrative function was misused and used as a starting point to reach other servers and data stored in the cloud; about 14.64 million records leaked, including names (also as written in passports), dates of birth, email addresses, phone numbers, addresses and the remitter name used for bank transfers, and about 4.13 million of them included hashed member passwords. In the second, a vulnerability in a business management system was exploited, and 17,780 records (including duplicates, with more still being counted) containing refund bank account details leaked or may have leaked. In the third, a bus booking completion page could be displayed without logging in, and about 12,000 bookings were or may have been viewed. The company first said card numbers were not among the leaked data, but corrected this in a second notice on October 16: the card number, cardholder name and expiry date (for some, the number only; no security codes) of up to 6,140 people who registered or used a credit card to pay the "skyticket Premium" membership fee between February 2017 and June 2018 leaked in the first incident, along with member IDs, names and passwords for a welfare benefits service offered as a Premium perk. Passport images were not exposed, and as of the October 9 notice the only confirmed secondary harm was one unauthorized login to a member account (the second notice does not say whether the leaked card data has been misused). This site's take: members should change their password from the official site or app today, change it anywhere it was reused, check card statements from October onward if they registered or used a card for the Premium fee in that period, ignore messages about refunds, compensation or booking changes, and never give anyone a bank PIN or one-time code.
Card-Stealing Program on the PhotoGoods (Daiko Printing) Payment Page: What People Who Paid Between August 6 and September 11 Should Do
On September 16, 2026, Daiko Printing Co., Ltd. announced unauthorized third-party access to PhotoGoods (photo-goods.com), the service it runs, and said a program able to illegally capture credit card data entered on the payment page had been installed. The program was in place from August 6 until it was removed on September 11. People who entered a card on the payment page in that period (including those who did not complete a purchase) may have had their card number, expiry date and security code exposed, along with name, address, phone number, email address and information derived from their member password (stored in a converted form). The company says it confirmed unauthorized access through system vulnerabilities and abuse of a file-upload function. The number of affected people and the actual scope are under investigation, and there was no follow-up notice as of October 7. This site's take: anyone who entered a card in that period should ask the card issuer to change the number, change the password on any other service that shares the PhotoGoods password, and ignore links in 'apology' or 'refund' messages.
Asahi Kasei Therapeutics healthcare-professional site breach (about 514,000 people): what may have leaked and what doctors, pharmacists and nurses should do
On October 6, 2026, Asahi Kasei Therapeutics Co. Ltd., the pharmaceutical arm of Japan's Asahi Kasei group, announced that Pharma DIGITAL, its information site for healthcare professionals, had been hit by a cyberattack and that personal data in its member database may have been viewed or taken. The data covers about 514,000 healthcare professionals (name, facility name, facility address, job type, specialty and more), about 44,000 of them with email addresses and more in addition to those items, and about 700 company employees (name, email address, photo). The company learned of the access from the site's contractor on October 2 and shut the site down. It says it did not store credit card data or sensitive personal data such as medical history, and as of October 6 no misuse had been found. This site's take: expect fake emails posing as drug companies, academic societies or seminar invitations. Never log in from email links, and change any password you reused from this site.
How to check if your password was leaked: using Have I Been Pwned safely, and the checks already built into your browser and phone
A guide to checking for leaked passwords. Have I Been Pwned (HIBP) tells you whether an email address appears in a known data breach, which service it came from and what kinds of data leaked. Its password check (Pwned Passwords) hashes the password on your device and sends only the first five characters of the hash, so the password itself is never sent (HIBP API documentation). This site's take: check your current passwords where they are already saved (Google Password Manager, the iPhone Passwords app, Edge Password Monitor, or your password manager) instead of typing them into a website, and use HIBP for email addresses. A 'not found' result is not proof that nothing leaked.
Daiwa Securities vendor breach (about 110,000 customers, 220,000 records): what may have leaked and what customers should do
On October 5, 2026, Daiwa Securities Co. Ltd., one of Japan's largest brokerages, announced that the server of a vendor whose service it uses to manage customers' online inquiries had been accessed without authorization. Names, email addresses, account numbers and other information about 110,000 customers, held in inquiry records, may have leaked; including inquiries that identify no one, about 220,000 records are involved. The access took place between about 8:33 p.m. on October 2 and 8:01 a.m. on October 3, and no unauthorized access to Daiwa's own systems was found. The company says this data cannot be used to access accounts or trade, including through online trading, and as of October 5 no fraudulent trades and no publication or spread of the data had been found. On October 6 the vendor side published its own notice: inquiry data stored in the environments of up to five client companies on the same server, up to 713,126 records counted per inquiry, may have been taken. Citing the same vendor, Citizen Watch (about 100,000 people), Sompo Japan (about 60,000 records counted per inquiry) and ORIX Life Insurance (about 26,500 records) have also announced that their customer data may have leaked. This site's take: expect fake messages that know your account number and your past inquiries. Never log in from links in emails or texts; sign in from a bookmark or the official app and check your message box and operation history there.
Denmark CPR register misuse (about 8.8 million people): what was taken, and what residents and organisations that grant lookup access should do
On October 5, 2026, Denmark's Ministry of Research, Education and Digitalisation announced that unauthorized persons had misused a private Danish company's legitimate access to look up data in the civil registration system (CPR), and obtained names, addresses, CPR numbers and more for about 8.8 million registered people, including living, emigrated and deceased persons. The CPR holds about 11 million people. The CPR administration noticed on the evening of October 2 that there had been irregular activity during September, and stopped the company's access. Names and addresses of people registered with name and address protection were not included. According to Danish media, on October 9 the CPR administration reminded the 1,039 companies with lookup access of its security rules, and the minister acknowledged that security had not been good enough. Media also report that the password 123456 was used on lookup accounts; this has not been officially confirmed. This site's take: a caller who knows your name, address and CPR number may still be a fraudster. Residents should never share MitID details or one-time codes, and businesses should stop treating these three items as proof of identity.
Japan e-Tax Gift Tax Data Exposure (2026): Who Is Affected
On October 2, 2026, Japan's National Tax Agency (NTA) announced that gift tax returns and related documents of 79 people could be viewed by other users in MyPage on e-Tax, the national online tax filing and payment system. According to reports, this lasted from 8:30 on September 24 to midnight, and from 4:00 to 15:58 on September 25. Nineteen users may actually have viewed someone else's return, and personal information of 203 people in total — filers plus the donors and tax accountants named in the returns — may have been seen. The cause was a defect introduced by a September 24 update that expanded MyPage's gift tax information feature; it has been fixed. NTA regional bureau and tax office staff contacted affected people individually, and the 19 viewers were asked to keep the information confidential and delete it. No sign of saving or secondary harm has been found. The NTA says this is unrelated to problems with its new core system (KSK2). This site's take: affected people are being contacted by the tax office. For any call or text that uses this incident as a reason, follow the NTA's advice: hang up and call back on a tax office number you look up yourself. Developers should test, on every change, that requesting user B's data while logged in as user A is refused.
infoQ survey site breach (894,082 records): what leaked and what members should do
On October 5, 2026, GMO Research & AI, Inc. announced that its survey site infoQ had been accessed by a third party without authorization and that members' personal data had been taken out. In its second report on October 14, it confirmed the number of records taken out as 894,082 (the first report said up to 948,498). The items are name, name reading (furigana), gender, date of birth, email address, home address, phone number, encrypted password, member ID, and other registration data such as nickname and point balance. The company does not hold credit card data or My Number (Japan's national ID number). In addition, 611 point exchanges worth 2,869,500 yen were converted into Amazon gift codes without the members' consent, and the company says it will compensate them in full (credited to accounts when the service resumes). The company invalidated all members' passwords on October 7. The company says the intruder exploited a vulnerability in software used on its site. This site's take: with birth dates and addresses included, convincing fake messages are easy to make. Change the password on any service that shares your infoQ password, turn on two-step verification for your email account, and do not open links in messages claiming to be infoQ.
MrMax app and online store breach (up to about 1.74 million people): names, emails and phone numbers leaked — what members should do
On October 6, 2026, MrMax Co., Ltd., a Japanese discount-store chain, announced that the servers of the MrMax app and online store it runs had been accessed without authorization by a third party, and that part of its members' personal data had leaked. Up to 1,735,154 people registered as members as of October 3, 2026 are affected. The items are member ID, name, email address and phone number (varying with what each member registered). The company says it confirmed that addresses, dates of birth, credit card data, passwords and purchase history did not leak. It noticed suspicious access on the evening of October 3, suspended the service immediately and blocked outside access the same day. The company says a third party misused a function of the software that makes up the service to get into the server. No harm from misuse of the data had been confirmed at the time of the notice. This site's take: expect convincing emails, texts and calls that use your name. Do not open their links, check in the official app or site you open yourself, and never give out passwords or card numbers.
Rakuten Drive breach (stored data of 15,382 accounts): what was accessed and what users should do
On October 6, 2026, the cloud storage service Rakuten Drive announced that a third party had illegitimately obtained the credentials of a management account for part of the systems the service uses, accessed the systems, and obtained and viewed information. Affected were the stored data (including photos and documents) of 15,382 accounts between January 29 and September 17, 2026; the account name, display name and profile image URL of 687 accounts on August 27; and, on the same day, the account name, display name, encrypted password, the string added during password encryption and profile image URL of 313 accounts. The service says no secondary damage has been confirmed and that it will notify affected users individually by email or other means. In an August 13 update about suspicious push notifications seen on July 30, the service had said that unauthorized third-party access to stored data had not been confirmed at that time. This site's take: unlike a password, stored files cannot be taken back. Check for a notice, treat any ID documents or contracts you stored as seen, change your password, and do not respond to messages, payment demands or threats claiming to be Rakuten Drive.
Yakiniku King app breach (about 10.79 million records): names, phone numbers and emails leaked — what members should do
On October 5, 2026, Monogatari Corporation, which runs the Yakiniku King grill-restaurant chain in Japan, announced that a third party had gained unauthorized access to the member-management system of the official Yakiniku King app. Of 10,808,784 app registrations, 10,788,963 records were leaked: member number, name (the name registered in the app), email address and phone number. The company confirmed the unauthorized access on October 2, cut off communications and put defensive measures in place, and confirmed the leak on October 3. Login passwords, dates of birth, gender, postal codes and store-visit history including points were not leaked, and the company does not hold payment data such as credit cards. No publication or misuse of the leaked data has been found. On October 20 the company announced further measures: it said the intermittent unauthorized access by an outside third party began at 9:00 a.m. on October 2, and that in the first half of 2027 it plans to move the 11 official apps run by its group, including Yakiniku King, to a new system that does not hold names or phone numbers. It will keep collecting email addresses. It has reported the matter to the police and is proceeding with its report to the Personal Information Protection Commission. Details of the cause have not been published. This site's take: almost every app member is affected, and the most likely next step is emails, texts and calls posing as Yakiniku King with coupon, point or refund offers. Do not open their links; check in the official app you open yourself, and never enter card details.
Abahouse data breach: order details may have leaked — how to handle fake refund emails
On October 2, 2026, Abahouse International Co., Ltd. announced that unauthorized access to its internal systems, believed to be by a third party overseas, may have leaked member IDs, names, addresses, phone numbers, email addresses, dates of birth, gender and order details (order date and time, product names, amounts and delivery addresses). Because it cannot fully identify the scope of data taken, the company emailed customers it judged may be affected based on purchase history and other records on October 2. It deletes member data one month after a member leaves, but keeps past order records for a period for legal and accounting reasons, and says it cannot rule out that those orders were accessed; former members received the same email. No count has been announced. Card numbers and security codes are handled by a payment processor, and no leak of them has been confirmed. The breach came to light when several customers reported suspicious refund emails that matched their real orders. In a follow-up on October 9, the company said the intrusion route had been cut off with no further spread confirmed, that it had filed a damage report with the police, and that no reports of financial loss had been received. The scope of data taken and the details of the cause are still being investigated with outside specialists. This site's take: a message that gets your order right is not proof it is genuine. Do not follow links or move to LINE from 'refund' or 'out-of-stock' emails; check your order history in My Page instead.
AdaptHealth data breach (about 4.1 million people): health insurance and health data exposed — patients should check benefit statements and calls
AdaptHealth, a US provider of home medical equipment, says a June 5, 2026 cyberattack exposed patients' names, contact information, demographic information, health insurance information and health information. Its report to the US Department of Health and Human Services (HHS) covers 4,115,802 people. According to the company, Social Security numbers (SSNs), financial account and card information were not involved, and it is not aware of any misuse. Its July 2 report to the Securities and Exchange Commission (SEC) says the cause was a social engineering attack (tricking people into giving information or access) that compromised a user session associated with a third-party contractor; a stored password file associated with insurance billing was taken and external electronic health record portals were accessed. Our view: with no SSNs, the priority is reading Explanation of Benefits statements for care or equipment you did not receive, and not giving insurance numbers to callers about supply reorders. For organizations, the lesson is how far one contractor account can reach.
DC Medicaid data exposure (about 400,000 people): Medicaid IDs left in published reports — what members and report publishers should do
The District of Columbia Department of Health Care Finance (DHCF), which runs DC Medicaid, said two statistical reports posted on its website from 2023 to July 2026 contained the underlying personal data in hidden fields that people without permission could access. The data included Medicaid ID numbers, dates of birth, provider names, race, gender, ward and ethnicity; DHCF says beneficiary names, Social Security numbers and financial account information were not included. DHCF learned of the issue on July 21, 2026 and removed the reports. Its report to the US Department of Health and Human Services (HHS) lists 399,086 people. Our conclusion: a report that shows only totals on screen can still carry the source data inside the file. Members should watch for medical services they never received; publishers should rebuild public files so that they never contain the source rows.
If your Japanese driver's license data was leaked: what to do to prevent misuse (credit bureau alerts, reissue, where to get help)
A practical guide for people whose Japanese driver's license image or number was leaked by a company. The license number, name, date of birth and face photo cannot be changed by the holder, and a reissued license keeps the first 11 digits of its number (National Police Agency directive). At the same time, non-face-to-face identity checks for mobile phone and bank contracts are moving from sending document images to reading the card's IC chip (mobile phone online contracts from April 2026; transactions under the Act on Prevention of Transfer of Criminal Proceeds from April 2027, as scheduled). This site's take: there is no way to take leaked data back, so the core of the response is making sure you notice quickly if something is opened in your name. In practice that means registering an identity-fraud alert (honnin shinkoku) with all three Japanese credit bureaus (CIC, JICC and the Japanese Bankers Association's KSC), checking your own credit file, and ignoring messages that pose as the company that leaked the data. Reissuing the license and paid 'data deletion' services are low priority or useless.
EPARK Relax & Esthe "PeakManager" data breach (about 22.18M records): health notes leaked too — what salon customers should do
EPARK Relax & Esthe Co., Ltd. announced that the database of PeakManager, the booking and customer-management system it provides to salons, was accessed without authorization and customer data was transferred outside. Its first notice (July 31, 2026) gave about 33 million records; after removing duplicates, its second notice (September 24) gave about 22.18 million records, which it says cannot be converted into a number of people. The leaked items are name and its phonetic reading, date of birth, gender, address, phone number, email address and a notes field where salons recorded handover notes for treatments, partly including health conditions and other sensitive personal information. The first notice also said encrypted passwords may have leaked and asked customers to change them. This site's take: PeakManager is each salon's own customer ledger, so people who never used EPARK can still be affected if they gave a salon their name or contact details. Do not respond to messages claiming to be from a salon or the company, and change your My Page password and anywhere you reused it.
Breaches at 7 Korean financial institutions (Shinhan Bank reports about 25,000 customers): income, loan limits and resident registration numbers leaked — what customers should do
Between October 1 and 4, 2026, seven South Korean financial institutions announced or reported data leaks caused by unauthorized outside access. Customer data: Shinhan Bank about 25,000 people (name, phone number, annual income, loan limit and more; resident registration numbers in 66 cases), KB Kookmin Bank 119 people (incl. encrypted resident registration numbers), Hana Bank 89 people (seven items incl. resident registration number), Yegaram Savings Bank about 40,000 people (estimate). According to reports, Welcome Savings Bank leaked up to about 2,200 records (estimate) on contact persons at corporate clients, Hyundai Capital leaked data on 146 mortgage loan agents (incl. resident registration numbers), and BNK Busan Bank leaked data on 11 staff of an outside development contractor. On October 4, President Lee Jae-myung ordered a thorough investigation, and regulators asked about 500 financial institutions for emergency checks. The same day, the chairman of the Financial Services Commission reportedly said AI-assisted attacks could not be ruled out; this is not a confirmed cause. Police reportedly opened a formal investigation on October 5, and the Financial Services Commission issued a consumer alert (caution level) on October 6. No common cause has been officially confirmed. This site's take: a caller who knows your real income or loan limit is not proof the call comes from your bank. Hang up and call back on the main number you look up yourself.
Lashinbang data breach: ID document numbers and payout bank details may have leaked (no ID images) — what sellers should do
On October 1, 2026, Lashinbang Co., Ltd. announced that unauthorized access to a service it operates, between September 14 and 16, 2026, may have leaked names, addresses, phone numbers, email addresses, dates of birth and occupations, along with the type and number of identity documents, the bank name, branch, account number and account holder entered when applying for a buyback (when customers sell items to the shop), images of buyback consent forms, and buyback and order details. The company says no credit card information or passwords leaked and that it does not collect My Number (Japan's individual number). In an addendum on October 9, it added that images of identity documents, including driver's licences, did not leak. The notice also gained a section saying the people affected are those who received an individual email from the company. As of October 10, 2026, the count and the cause have not been announced. This site's take: an account number and holder name alone cannot be used to withdraw money, but do not respond to contacts that use your account details, ID number or real buyback details to look genuine. Never give anyone a PIN, login or authentication code, and if your ID document number leaked, consider a self-declaration with Japan's credit bureaus.
LMU Munich Data Breach (2026): Student Data, Risks and Response
On September 19, 2026, Ludwig-Maximilians-Universität München (LMU) said an unauthorized actor had accessed an IT system holding standing data on student enrolments and that it must assume the data was taken. Its September 28 update put the scope at about 600,000 records in the admission system, covering current and former students over roughly 50 years. The data includes names, dates of birth, addresses, phone numbers and email addresses; records from 2005 onward include bank details (IBAN and account holder), and some include health insurance numbers, BAföG (German state student aid) numbers and reasons for leave of absence. Passwords, grades and exam information were not affected. The Bavarian State Criminal Police Office is investigating. The cause has not been disclosed. This site's take: the serious part is that bank details of people who graduated years ago were still in the system. Anyone who gave LMU a German or EU account should check their statements and reverse any direct debit they do not recognize, and should not open links in emails claiming to be from LMU.
Metabase vulnerability breaches (Trezor 80,689 customers and others): what leaked, and what affected people and analytics-tool operators should do
In August 2026 it emerged that an unauthenticated SQL injection in the BI (business intelligence) and analytics tool Metabase (CVE-2026-72898, CVSS 10.0) had been exploited before a fix was released. Metabase says fewer than 3% of its cloud customers and some internet-reachable self-hosted instances were compromised. Organizations that disclosed impact include Trezor, which sells cryptocurrency hardware wallets (80,689 customers' names, addresses, phone numbers and email addresses, via its logistics partner's analytics environment), laptop maker Framework, automation tool n8n, Anaconda's Kilo Code and wallet-infrastructure provider Privy. This site's take: what leaked matches what the compromised analytics tool could read at the time. Trezor customers should never type or share their wallet backup (recovery seed) and should assume their home address is known, so they should not follow instructions in letters or calls either. Operators of analytics tools should patch, and also limit the data the tool can read to the columns analysis actually needs.
Murauchi.com data breach (7.7 million records): names, addresses and phone numbers leaked — past customers should watch for scam calls and mail
On September 15, 2026, Murauchi.com Co., Ltd. announced that unauthorized access, which began with the exploitation of a vulnerability in part of its web system, led to 7,716,811 records of customer personal data being taken out (the first notice was on July 24). The data includes names, addresses and phone numbers, plus email addresses, dates of birth and gender for some people. Card and other payment data and login IDs and passwords are kept in separate systems and were not affected. The company has not said how many years of data were involved or whether former members are included. This site's take: the main risk is that real names, home addresses and phone numbers leaked together. Assume you may be affected even if you bought from the shop only once, years ago, and never hand over personal data or money in response to calls, mail or texts claiming to be from the company, an online mall or a card issuer.
MyDr Patient Data Breach in Poland (Up to 18.8 Million): PESEL, Health Data and Contacts Exposed — What Affected People Should Do
In August 2026, MyDr sp. z o.o., whose electronic medical records software is used by more than 12,000 healthcare facilities in Poland, disclosed that an external criminal act let a third party copy the contents of a database stored in its cloud. The data is mainly historical, from before April 12, 2024, and Poland's Ministry of Digital Affairs said up to 18.8 million people and over 12,000 facilities may be affected. According to the company, the items include name, address, contact details, PESEL (national identification number), health data, social insurance information and employer details, though not every item applies to every patient. The cause and the route of entry have not been disclosed. The government lets people check whether their PESEL is involved at bezpiecznedane.gov.pl and urges everyone to reserve their PESEL (zastrzeżenie PESEL). This site's take: when one software vendor holds patient data for thousands of facilities, a single breach reaches all of them, and this time what was copied was a backup more than two years old. Affected people should check, reserve their PESEL and prepare for threats that mention their health; operators should confirm that old backups are protected as well as production.
Seicomart app breach (about 575,000 members): names, addresses and birth dates viewed — what members should do
On September 29, 2026, Seicomart Co., Ltd., which runs the Seicomart convenience-store chain in Japan, announced that a third party had gained unauthorized access to the server holding member data by way of the server behind its Seicomart smartphone app. Its fourth notice on October 5 said the affected accounts are 574,647 of the Club members who have registered with the app, and that people who left the Club Card program by September 24 are not included. The items viewed are surname and given name, gender, date of birth, address, phone number, email address, and the dates the person joined and left the Club Card program. Password data and purchase history were not leaked, and the company does not hold credit card data. From October 5 the company is telling every app member, through the app's notices, whether they are affected. It has ended the app and web functions for new sign-ups, viewing and changing member details, and changing registered cards; requests now go through stores or a form. The cause has not been disclosed. This site's take: what was exposed is a set of personal details that cannot be changed, and the most likely next step is convincing emails, texts and calls that pose as the company. Check the app's notices to see whether you are affected, do not follow links or instructions in such messages, and stop using your date of birth as a PIN or as an answer to identity checks.
E-store ShopServe data breach (final report: about 23.36 million people): what buyers, shop owners and affiliates should do
In its final report of October 16, 2026, E-store Co., Ltd. said a third party exploited a vulnerability in an application on the servers of ShopServe, its service for building online shops, and sent database contents out between May 21 and August 1, 2026. About 23,356,000 people are affected (buyers and members, shop operators and affiliates combined; an approximate figure after removing duplicates), of whom about 2,096,900 had part of their card data included. 7,858 shops are affected (including current and former ShopServe shops). The leak includes buyers' names, addresses, phone numbers, email addresses and workplaces; member IDs and encrypted passwords; cardholder names, the first 6 and last 4 card digits and expiry dates; and the credentials of shops and affiliates. Full card numbers and security codes were not held and were not affected. The final report corrects the second report: shops' mail system and FTP IDs and passwords, and bank account details of the accounts E-store transfers money to (payout accounts), were confirmed not to have leaked. No secondary damage had been reported. This site's take: most buyers shopped on each store's own site without ever hearing the name ShopServe. Even if you cannot tell which shop it was, treat messages that quote your real order details or the last four digits of your card with suspicion, check your card statements, and change reused passwords. Shop owners and affiliates should change their admin or affiliate passwords and turn on two-step verification.
TEMAIRAZU Unauthorized Access (2026): Guest and Hotel Guidance
On September 28, 2026, Temairazu, Inc. announced unauthorized access to its TEMAIRAZU Series, a system hotels and ryokan use to manage bookings from many sources in one place. From late at night on September 21, guests of properties using the system began receiving suspicious messages via messaging apps such as WhatsApp, by email and by SMS. The messages appeared to know booking details and, under pretexts such as advance check-in or keeping a reservation valid, pushed recipients to external websites to enter card details or pay. In its second report of October 7 (English version October 8), the company listed the information that may have been viewed or obtained by a third party: guest names, telephone numbers, email addresses, accommodation property names, check-in dates, check-out dates and accommodation charges. It does not retain credit card information or login credentials for booking sites. In a timely disclosure to investors on October 9, it put the number of people whose booking information is involved at up to about 4.45 million and said it had commissioned an external security firm to investigate. According to notices from hotels using the system, the cause was a security problem in part of an installed product the company provided in the past, fixed on September 26. This site's take: people who booked through travel sites may be affected too. If a message claiming to be your hotel asks you to re-enter card details or pay, refuse even if the details are correct, and check through the booking site's official app or the phone number on the hotel's official website.
Yamato and Sagawa Data Breaches (2026): Affected Users and Response
Yamato Transport found unauthorized access to its Kuroneko deferred-payment service on September 28, 2026, and Sagawa Express found unauthorized access to its parcel tracking service on September 30. On October 1-2, both said personal data may have leaked. These are separate incidents, and neither company mentions a connection. In its fourth notice on October 16, Yamato said data had been taken: about 5.26 million records of deferred-payment users (name, address, phone number, email address, item details and more, from October 1, 2018 to September 28, 2026), about 50,000 records of delivery-address information of some users, and about 4,100 records of participating shops. Billing amounts, outstanding balances and employee names were not found to have been taken. In its fifth notice on October 23, Sagawa said names, addresses and phone numbers of senders and recipients of parcels it handled from June 21 to September 30, 2026 (about 100 days), among other data, may have leaked, and gave the maximum count as about 53.23 million records (duplicates included; not the number of people). Parcels sent with handwritten waybills are not included. Neither breach includes credit card data or passwords. Yamato restarted the deferred-payment service on October 9 and extended payment deadlines by 17 days; Sagawa restarted its parcel tracking service on October 23, while eight other web services, including online booking, remain stopped. This site's take: with Sagawa, you can be affected just by having received a parcel, even if you never used the company yourself. Assume fake missed-delivery notices and payment demands may now carry your real name and address, the fact that you received a parcel, or what you bought. Do not open links in such messages; check in the official app or in the order history of the shop you bought from.
Yellow Hat data breach (up to about 1.8 million people): names, phone numbers and emails may have leaked — what members should do
On August 28, 2026, Yellow Hat Ltd., a Japanese car-parts and car-service retailer, announced that its online work reservation system, used to book jobs at its stores, had been attacked by a malicious program, and that the names, phone numbers, email addresses and member numbers of up to 1,801,499 people may have leaked. The company detected the attack on the morning of August 18, cut the system off from outside connections and shut it down. Credit card data, passwords and vehicle information are not held in this system, so the company says they were not leaked. Separately, in April 2026, the group company 2rinkan Yellow Hat had a different breach that exposed data on about 3.18 million people, including app passwords. This site's take: what may have leaked is exactly the data needed to contact you directly. Do not reply to calls, texts or emails about bookings, inspections or apologies; check through the official website or the store instead.
Aesto Health Data Breach (9.5 Million): Why a Company You Never Heard of Sent the Notice, and What to Do
US healthcare data migration and archiving vendor Aesto, LLC (Aesto Health) says that from on or about December 2 to December 18, 2025, protected health information belonging to patients of its healthcare provider clients, stored in part of its cloud environment, may have been accessed and/or acquired by an unauthorized actor. The HHS Office for Civil Rights breach portal lists 9,540,683 people affected. The information includes names, dates of birth, medical information, driver's license numbers, financial account numbers, health insurance information, and government ID numbers such as ITINs; Social Security numbers were potentially involved for a limited number of people. You don't recognize the sender because your provider handed old records to an archiving vendor. First confirm whether your provider is on the list. Then protect SSNs and ITINs with a credit freeze and an IRS IP PIN, and medical information by reading your benefit statements. Providers need an inventory of every vendor holding patient data and an end date for archived records.
AssuranceAmerica Data Breach (About 7 Million): What to Do When Your Driver's License Number Leaks
On July 10, 2026, US auto insurer AssuranceAmerica notified people that, following malicious activity targeting one of its employees on March 16, an unauthorized third party accessed part of its IT environment and copied certain data files. The Indiana Attorney General's breach list puts the total affected at 6,998,886. Depending on the person, the data included name, contact information, auto policy or account information, driver or vehicle information, claims information and driver's license number, and for a limited number of people a Tax ID or Social Security number. In the US a driver's license number is used as an identity field on credit, insurance and public-benefit applications. A credit freeze alone leaves gaps, so also tell your state motor vehicle agency that your number was exposed.
Basic-Fit Member Data Breach (Bank Details and Visit Records): 'Payment Failed' Scams and What Members Should Do
On April 13, 2026 Basic-Fit disclosed unauthorized access to the system that records members' visits to its clubs. The company says the access was stopped within minutes, but some data on active members in several countries was downloaded: membership information, name and address, email, phone number, date of birth and bank account details; no passwords were accessed. Basic-Fit told Reuters about 1 million members were affected, in six countries including the Netherlands and Spain. This site's take: gym fees involve recurring payments under the contract, and for members using SEPA direct debit (the euro-area standard for bank debits), a 'your payment failed' message mimics a real Basic-Fit process. Always check your membership status in the app, never through a link; watch for direct debits from creditors you don't recognise; and don't panic-reverse the legitimate gym fee.
Booking.com Reservation Data Breach: How to Spot Scam Messages Posing as Your Hotel
In April 2026 Booking.com notified guests that unauthorized third parties may have been able to access certain booking information, updated the PINs of the affected reservations, and said it had contained the issue. According to the notice and the company's spokesperson as reported, the information included booking details, names, email addresses, phone numbers and messages shared with properties; financial information was not accessed. The number affected and the cause were not disclosed. This site's take: a correct hotel name, date and price no longer prove anything. The test is whether a request matches the payment policy in the booking you open yourself in the official app. Refuse any request to re-enter card details, pay through a link, or make a transfer not in the policy.
CAMPFIRE Unauthorized Access: 225,846 Unique User Records at Risk — Actions for Users and Developers
According to CAMPFIRE, a GitHub credential issued by an employee was misused by a third party; information visible on GitHub was then used to obtain credentials for a cloud environment the company uses for internal business operations, and part of its management area was accessed. Names, addresses, phone numbers, email addresses and bank account details in 225,846 unique affected-user records (project owners, supporters, partners) may have leaked; credit card data was not involved. The service platform runs in a separate environment and no misuse or tampering was found there. Users should watch for messages about refunds or payout account confirmation and check bank statements. Developers and operators get two lessons. Customer data also lives in internal business environments even when production is well protected. And work tokens can end up on machines the company doesn't manage, so organization settings must limit how long a token stays valid and what it can access.
Carnival Data Breach: What Travellers Should Do When a Passport Number Leaks
Carnival Corporation, the parent of Carnival Cruise Line, says that on April 14, 2026 its IT security team identified unauthorized activity involving an employee's account: an unauthorized actor used social engineering to deceive an employee and gained access to a limited portion of its IT system. On April 22 the company determined that personal information had been copied. Its filing with the Maine Attorney General lists 5,995,277 people affected. The data varies by person and includes name, address, email address, phone number, date of birth and government-issued ID numbers such as driver's license and passport numbers. What leaked is a passport number, not the passport. The official lost-or-stolen process in the US (and in Japan) cancels the document itself and is meant for passports that are actually lost or stolen. The real risk is messages from people who seem to know your trip and your ID. US residents should freeze their credit. Everyone should ignore links in emails posing as the cruise line, and know when a passport really does need to be reported.
Cegedim Santé MLM Data Breach (2026): Patient Risks and Response
Cegedim Santé, the Cegedim Group subsidiary that publishes software for healthcare professionals in France, said on February 26, 2026 that at the end of 2025 it identified abnormal application request behaviour on the accounts of doctors using its MLM (MonLogicielMedical.com) software. Of the 3,800 doctors using MLM, 1,500 were affected, and personal data of patients in the MLM database was illegally accessed or extracted. The data comes from the patient's administrative file (name, gender, date of birth, phone number, address, email) and administrative comments written in free text at the doctor's discretion. For a very limited number of patients, those comments may have contained the doctor's personal notes about sensitive information. The company says structured medical records remained intact. France's Ministry of Health was reported to put the number of patients who may be concerned at about 15 million, with about 1% involving sensitive notes. When one cloud vendor stores the patient data of thousands of practices, a breach affects every practice using the software, not just one clinic. The most sensitive data sat in a field with the harmless-sounding label 'administrative comment'. Patients should prepare for impersonation and pressure messages. Clinics should check what goes into free-text fields and who would notice unusual activity on each doctor's account.
CHAEVI EV-Charging App Data Breach (298,000 Records): What Leaked and What Users Should Do
According to CHAEVI's notices of July 26 and July 30, 2026, an illegal external hacking attack on July 23 leaked a total of 298,333 personal data records: 164,858 email-only, 131,411 email plus password (encrypted), 1,235 email plus name and contact number (encrypted), gender, date of birth and more, and 829 with all of that plus the password (encrypted). CHAEVI says it does not collect or hold resident registration numbers, passport numbers, or card and account numbers, so none were leaked, and that while investigating it also found a separate leak from around January 2025, which is still under investigation. Charging history and location do not appear in the notices' list of leaked items. What scammers can most easily use is the email address, leaked unencrypted in every record, plus the fact that its owner uses an EV-charging app. Ignore emails and texts about charging fees, unpaid balances or compensation by default, and change your password starting with every other service where you reused it.
Companies House WebFiling Flaw (2026): Exposed Data and Checks
On March 13, 2026, UK Companies House became aware of an issue that meant a logged-in registered user of its WebFiling service could potentially view and change another company's details after a specific set of actions. It closed WebFiling at 1:30pm that day and reopened it at 9am on March 16. According to Companies House, the cause was a defect introduced during a major system update on October 11, 2025, and it was not a cyber-attack. Data that may have been visible includes the day of the date of birth and residential addresses of directors and people with significant control (PSCs), and company registered email addresses; unauthorised filings such as new accounts or changes of director were also technically possible. Passwords, identity verification data and existing filed documents were not affected. An April 8 update said a very small number of instances of unauthorised access or attempted changes had been identified. This was an authorization failure, not an intrusion. The login check worked; the check on whether this user may handle this company did not. Directors should review their filing history and turn on Follow alerts; developers should test, on every release, that requesting someone else's data is refused.
DentaQuest Data Breach: An MFA Code Handed Over to a Scammer, and What Members Should Do
DentaQuest, a US dental and vision benefits administrator, says unauthorized individuals accessed data on its network between May 17 and May 20, 2026. Its filing with the Washington State Attorney General says a social engineering attack tricked a single employee into providing credentials and a multifactor authentication code. The data includes names, addresses, dates of birth, Social Security numbers, member and health plan numbers, Medicaid and Medicare numbers, and dental or vision health information. Data elements vary by individual. The company told the Washington AG on August 3, 2026 that it was aware of more than 27.4 million people nationwide. An SSN cannot be changed, so members should freeze their credit at all three bureaus, get an IRS IP PIN and watch benefit statements. For organizations, the lesson is that any MFA a person can read out or type in can also be handed over; phishing-resistant MFA (passkeys, FIDO2 security keys) and a help desk that verifies callers are what prevent this.
Endesa Data Breach (ID and Bank Account Numbers): Handling Scam Calls That Know Your Contract
Endesa Energía told customers (around January 12, 2026) that a malicious actor gained unauthorized access to its commercial platform and may have exfiltrated basic identification data, contact details, national ID (DNI) numbers, energy contract data and, in some cases, IBANs; passwords were not affected. Endesa reported the incident to the Spanish Data Protection Agency (AEPD) and has not published how many customers were affected. This is exactly the kind of data that makes the long-running energy phone scam ('tariff change', 'supply cut-off') believable: a caller who already knows your DNI and your contract doesn't sound like a scammer. Knowing your details proves nothing, so hang up and call the official number yourself. And because an IBAN can be used for direct debits, check your statements: a debit you never authorized can be refunded for up to 13 months.
ANTS (France Titres) Data Breach (2026): Affected Accounts and Response
France Titres, the French national agency for secure documents (ANTS), detected on April 15, 2026 a security incident that may have exposed data from individual and professional accounts on its ants.gouv.fr portal. On April 21 the Interior Ministry said about 11.7 million accounts may be affected. In its answer published May 13, the government said data had been extracted from 11.67 million individual and professional accounts. The data includes login ID, title, surname and first names, email address, date of birth and a unique account ID, and for some accounts a postal address, place of birth and phone number. According to the government, attachments submitted with applications and biometric data are not included. The government asked users to change their password at their next login and to be very careful with suspicious texts, calls and emails that appear to come from ANTS. ANTS put its application pages into maintenance from April 24 and says two-step authentication has been in place since April 29. What leaked is not the ID documents themselves but the fact that a person has dealt with ID, licence or registration paperwork, which is exactly what a convincing ANTS or 'permis de conduire' scam needs. There is no need to replace your documents; the habit that works is never using a link in a message and opening ants.gouv.fr yourself.
Four Government Data Breaches of 2026 (US DoD, Illinois, Latvia, French Tax Authority): What Citizens Can Do
In 2026, government agencies in the US, Latvia and France lost control of citizens' personal data. Lining up the agencies' own accounts, there were three ways in: a wrong sharing setting (Illinois DHS's internal maps), a vulnerable system (the DoD's DMDC file-sharing system, a CSDD web application), and impersonated credentials of staff and an authorized third party (France's DGFiP). When the data holder is the state, 'stop using the service' isn't an option. A citizen's defense shifts to four things that work after a leak: verify notices through official channels, protect the logins to your tax and benefit accounts, call back on a number you look up yourself, and use your right of access to learn what was held and what leaked.
Canvas (Instructure) Data Breach: Course Enrolments and Messages Leaked — What Students, Teachers and Schools Should Do
According to Instructure, the company behind the Canvas learning management system (LMS), unauthorized activity was detected on April 29, 2026, and usernames, email addresses, course names, enrollment information and messages were exfiltrated. The company says the fields involved are not designed to store passwords, dates of birth, health information, Social Security numbers, financial information, grades or disciplinary records. On May 7 the same actor used another vulnerability to alter pages shown after login. The field list looks mundane, but an email address plus which classes someone takes is exactly what a convincing school-themed scam needs, and messages are free text, so anything people typed there may be included. Verify contact only through your school's official channels; school IT should register security contacts, review logs, require MFA for admins and keep course data backed up outside the LMS.
Manchester Airports Group (MAG) Data Breach (2026): What to Check
In a statement dated August 27, 2026, Manchester Airports Group (MAG) said it was subject to a cyber security incident by an unauthorised third party in August 2026, and that customer data relating to car park, lounge and Fast Track bookings and in-airport Wi-Fi sign-ups at Manchester, London Stansted and East Midlands airports was obtained. The data includes email addresses, phone numbers, vehicle registrations and postcodes. MAG says neither it nor the system accessed holds customers' bank or payment details. MAG says that for people notified that they were affected, their data was made publicly available. According to press reports, a MAG spokesperson put the number affected at roughly 8.7 million. Operational airport systems were not involved. Contact details combined with a vehicle registration or postcode can make a fraudulent message seem more convincing. Whatever a 'refund', 'booking problem' or 'parking fine' message says, don't follow its link; open the airport's official Manage Booking page yourself. MAG says changes and cancellations there are free.
Mathspace Data Breach (About 1.08 Million Students, Parents and Staff): What Parents and Schools Should Do
In a blog post dated September 5, 2026 (updated September 8), maths learning platform Mathspace said attackers exploited a security vulnerability in its self-hosted internal reporting system and downloaded information on students, parents or guardians, school staff and Mathspace staff. 1,079,819 people in Australia and New Zealand were affected. The data includes user ID, username, first and last name, email address, country, time zone, user type, email-verification status, last-active date, last-login date and date joined. The company says passwords (including hashes), authentication tokens, SSO credentials, academic records and results were not exposed. According to Mathspace, the software's developer published a critical advisory and patch on August 6, its own vulnerability-notification process did not escalate it, unauthorised access dated back to August 10, and data was downloaded on August 27. This site's take: this is a roster that includes children's accounts, and it can be used to make fake messages claiming to be from Mathspace or your school look genuine. Families should agree with their children never to sign in from a link or share a code. Operators should treat internal reporting tools, which tend to be patched last, like production systems: patch them just as quickly, and check for signs of compromise after patching.
Medica Shuppan Ransomware Attack (About 641,000 People): What Medical Readers, Authors and Publishers Should Do
According to Medica Shuppan Co., Ltd., it detected a system failure on March 13, 2026 that turned out to be unauthorized access involving ransomware. Its May 13 investigation report says the starting point was a third party entering the internal network with legitimate account credentials. No definitive evidence was found that personal data was taken out, but the possibility cannot be fully ruled out, so data of about 641,000 people (may include duplicates) is treated as 'at risk of leakage'. The data includes readers' names, contact details and email addresses, authors' bank account numbers and employees' HR records. The company does not hold credit card data. Emails impersonating the company have also been seen. This site's take: a specialist publisher's customer list is a list of medical professionals with their workplaces, so check any message about study materials, seminars, academic societies or manuscript fees on the official site you open yourself, not via a link. Authors should watch for messages that mention their account number to seem genuine and then ask for a PIN or online banking details.
Medtronic Data Breach (About 3.83 Million): What Patients Using Its Devices Should Check
On April 24, 2026, medical device maker Medtronic disclosed that an unauthorized party had accessed data in certain of its corporate IT systems. Per its notice letter, the access ran from April 13 to April 19, 2026. The Indiana Attorney General's breach list shows 3,834,294 people affected nationwide, with notices sent on June 29. The information involved: name, contact information, date of birth, Social Security number and health-related information. The company says it has not identified any impact to product security or patient safety, including the ability of any Medtronic device to operate safely and deliver intended therapy. This site's take: device makers hold patient data so that product updates and safety notices can reach you. Don't stop using the device or drop your registration; protect the SSN with a credit freeze and an IRS IP PIN, and verify any call that mentions your device by calling back a number you already have.
Cariteco (Meitetsu Kyosho) Ransomware Attack: Possible Driver's Licence Data Leak and What Members Should Do
On July 2, 2026, Meitetsu Kyosho Co., Ltd. disclosed unauthorized access to its servers and a system outage detected on June 23, saying an investigation found traces of unauthorized access by ransomware. On August 4 it said it could not rule out a leak of the information members wrote on their application forms for its car-sharing service Cariteco — name, address, date of birth, phone number, email address, driver's license information and, for some members, credit card data — covering both current and former members. No count has been disclosed, and the company says no leak or misuse has been confirmed. This site's take: license data cannot be changed, so, as in the Times Car case, register a fraud alert with Japan's three credit bureaus and check your credit file. Two points are specific to this case: with ransomware, a possible leak can come to light only after the service has been restored; and some of the company's individual notices were undeliverable. Former members who have moved should contact the company rather than wait for a letter.
Odido Data Breach (About 6.39 Million): What to Do When Your ID Number Leaks
On February 12, 2026, Dutch telecom operator Odido disclosed that customer data had been taken from a customer contact system it uses. Its spokesperson put the scale at about 6.2 million accounts; Odido's later FAQ says about 6.39 million people were affected (current and former customers of Odido and its brand Ben). Depending on the person, the data included name, address, mobile number, customer number, email, IBAN, date of birth, and ID document number and expiry; passwords, call records and ID scans were not included. This site's take: an ID number on its own cannot be used to sign contracts or complete procedures; it mainly identifies who you are. The Dutch Central Identity Fraud Reporting Centre (CMI) says this data alone cannot be used to take out a loan, open a bank account, sign a phone contract or apply for a new ID document, and neither replacing passports nor changing account numbers is recommended. The real danger is contact from someone who quotes your leaked numbers to seem genuine. And the broader lesson: ID numbers that businesses collect to verify identity can leak from those same businesses.
Quest Apartment Hotels Data Breach (About 1.99 Million): What Guests Should Do After Card and Passport Numbers Leaked
Australian serviced-apartment chain Quest Apartment Hotels identified unauthorised access to a database system on August 17, 2026, arising from a vulnerability through a third-party service provider, and disclosed it on August 19. Its September 16 update says information on approximately 1,991,613 customers (records from before June 2025) was affected, including 46,727 credit card numbers with CVV and 297,739 without CVV (both including expired cards), 104,268 passport and/or driver licence numbers, 225,300 vehicle registration numbers, 271 NDIS numbers and 46 Medicare card numbers. This site's take: if you were told a card with its CVV was affected, ask your card issuer about a replacement. The card industry standard PCI DSS does not allow card verification codes to be kept after authorization. Quest has not said why CVVs were in these records, and we make no judgment about compliance, but guests should know that a hotel's records can end up holding them.
APORITO Online Store (RIZAP) Possible Card Data Leak: What Customers and Online Shops Should Do
According to RIZAP Co., Ltd., a third party planted a malicious script on its APORITO Online Store, and the names, addresses, phone numbers and email addresses — plus card numbers, expiry dates and security codes — of people who placed an order or entered information between May 1 and August 5, 2026 may have been sent outside. The company found a suspicious outbound-transmission program on August 5 and closed the store that day; as of August 18 the store remained closed and the investigation continued. It says no misuse or actual leak has been confirmed. This site's take: with the security code in scope, watching statements is not enough; ask your card issuer to replace the number. The lesson for e-commerce operators is that not storing card data ('non-retention') does not stop a malicious program from being planted in the input page. On top of the five vulnerability measures required by Japan's Credit Card Security Guidelines, have a way to detect changes to your payment page.
Data breaches and cyberattacks of 2026: a timeline (Japan and worldwide) — 203 incidents rated by impact, and what they show
This site built a timeline of 203 major data breaches and cyberattacks disclosed from January to October 2026 (99 in Japan, 103 elsewhere, 1 without a country classification), sourced to victim organizations' notices, regulator filings and attributed reporting. Impact is rated in three levels by scale and data type, with the criteria printed on the page. Our take: outside Japan, leaks of identity data — driver's licences, passports, Social Security and other government ID numbers — stand out in 29 of 103 incidents; in Japan, ransomware and vulnerabilities in internet-facing devices and systems (VPN appliances, websites, analytics tools and the like) stand out. Identity data is not as easy to replace as a password, so users should hand it to fewer services and file credit-bureau alerts when it leaks; operators should start with patching internet-facing devices and deciding how long to keep the ID documents they collect.
Shun Hing Group Data Breach in Hong Kong (About 920,000): Handling Scams Posing as Repair or Warranty Calls
Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) received a data breach notification from Shun Hing Group on 23 March 2026 and has opened an investigation. On 2 July 2026, citing the latest information provided by the organisation, the PCPD said the personal data of more than 921,000 people may have been leaked, including about 920,000 customers' names/titles, addresses, phone numbers and email addresses, and about 1,000 staff and service/product/supplier personnel whose data also included identity document numbers, bank account numbers and salaries. About 1,050,000 people's data may have been maliciously encrypted. In its 9 July 2026 notice, Shun Hing Group said there was no evidence of misuse at that time and that its PanaClub system was suspended. This site's take: the potentially involved information includes after-sales contact details, such as an address or phone number given for appliance delivery, installation or warranty registration. A caller who knows your address and what you bought does not prove they are genuine. Don't follow a message's password-reset link; open the official website yourself to check the latest PanaClub guidance.
Standard Bank Data Breach (South Africa): Handling Scam Calls That Know Your ID and Account Numbers
On 23 March 2026, The Standard Bank of South Africa said it had identified unauthorised access to select data. By its 14 April update, the bank said the affected information includes names, ID numbers or company registration numbers, contact details (phone numbers, physical and/or email addresses) and account numbers, later adding B-BBEE categorisation and VAT registration numbers, and that the data 'now appears to have been published'. The bank says its transactional banking and core operating systems were not accessed and client funds are not affected. It has not published how many clients were affected. This site's take: the danger is not someone logging in with this data. It is someone calling you as 'Standard Bank' while reading out your real ID and account number. A caller knowing those numbers doesn't prove it is the bank, and the bank says it will never ask for your passwords, PINs or OTPs. Hang up, call the number on your card, register with SAFPS, and check your credit report.
Texas Parks and Wildlife Data Breach (2026): Affected Users and Response
The Texas Parks and Wildlife Department (TPWD) says that on May 13, 2026 Texas Cyber Command detected a cybersecurity incident involving the TPWD license system vendor that handles the sale of hunting and fishing licenses. According to TPWD, an unauthorized actor may have obtained driver license information, passport numbers (if provided), email addresses, phone numbers and residential addresses for more than 3 million customers; TPWD says Social Security numbers, dates of birth and financial information were not obtained. The Texas Attorney General's breach list shows 3,087,721 Texans affected. This site's take: the licence comes from a state agency, but the ID numbers buyers gave were stored in the systems of TPWD's vendor, a company buyers didn't choose themselves. And because licences are renewed every year, a message from TPWD looks normal, which makes it easy for scammers to imitate. Freeze your credit (a free block that makes it harder to open new accounts in your name), learn the Texas DPS route for a misused licence number, and only renew or pay through a TPWD address you type yourself.
Trenitalia Data Breach: Protecting Yourself from Fake Delay-Refund Scams
Italian rail operator Trenitalia sent customers a notice under Article 34 of the GDPR saying a cybersecurity incident caused by unidentified external parties led to unauthorised access to some personal data linked to travel tickets (titoli di viaggio). Follow-up notices for jointly controlled tickets describe it as the same event Trenitalia communicated on June 26, 2026. The data may include name, date and place of birth, email and phone number, itinerary details such as route, date, time and ticket number, loyalty card code, employer, and identity document details; the notice for UnicoCampania regional tickets also lists the Italian tax code (codice fiscale) and gender. Trenitalia says account login data, passwords and payment information were not involved. It notified the Italian data protection authority (Garante) and CSIRT Italia and filed a criminal complaint with the Rome prosecutor. This site's take: what leaked is an itinerary — when, where and on which train — and that is exactly what makes a fake 'your train was delayed, claim your refund' message convincing. Real delay compensation is either requested by you through Trenitalia's own channels or, for regional digital tickets, paid automatically to the card you bought with. No genuine refund asks you to type your card number into a link from a text message.
TVING Data Breach (South Korea): Fake Compensation Messages and What Users Should Do
According to the investigation results published on September 3, 2026 by South Korea's Ministry of Science and ICT and its joint public-private investigation team, the TVING breach exposed data on 39.54 million accounts (active, dormant, withdrawn and test accounts, including duplicates). The 20 leaked item types (70 fields) include ID, name, date of birth, connecting information (CI), duplicate-registration information (DI), refund account numbers (encrypted) and passwords (one-way encrypted); passwords were confirmed to be impossible to decrypt. This site's take: because TVING is genuinely running a compensation program, fake 'compensation' and 'refund' texts are the most convincing scam right now. Check compensation only inside the official app you open yourself, change passwords wherever you reused them, and turn on identity-theft alerts if you live in Korea. For developers, the lesson is structural: one developer's access key opened all the source code, and that source code contained production-environment keys.
Six US Healthcare Data Breaches of 2026: How to Check a Notice from a Company You Don't Know
In 2026 a string of US healthcare data breaches happened at companies most patients have never heard of. Lining up six cases from the HHS breach portal: four are business associates that do work for providers and plans, one is a lab that receives samples and data from providers, and the sixth is a hospital system that says the unauthorized actor may have gotten in through a security breach at a third-party vendor. This site's take: a notice from a company you don't know is not, by itself, evidence of a scam. Before you use any number or link in it, open the HHS breach portal and your state attorney general's breach listing yourself and compare. For organizations, start with three things: a list of everyone you've handed patient data to, confirmation of return or destruction when a contract ends, and MFA that can't be phished.
Times Car data breach (6,628,007 records with names and addresses, traces of about 1.46M ID-document images being sent out): checking My Page and what members and former members should do
In its fifth notice on October 23, 2026, Times Mobility Co., Ltd. said the outside forensic investigation had ended and published final counts. In the Times Car web system, traces of attacker access and external transmission were found for 6,628,007 records of name, address, date of birth, phone number, email address and driver's license information. Of the identity-document images, which were stored encrypted, 1,464,800 showed traces of being sent out (the company had earlier said about 1.6 million might have leaked) and 891,602 were accessed with no trace of being sent out. Hashed passwords were sent out in 4 cases. In the related Times Club web system, where unauthorized access was also found, 19,510 Times Club card numbers, 135,436 linked-service IDs and 28 credit card last-four-digit records, among others, showed traces of being sent out (the company does not hold full card numbers or security codes). The cause was the exploitation of a vulnerability in the web system. The company will give a payment worth 3,000 yen to people whose images were sent out (details and method still being decided), and since 17:00 on October 23 has shown each person's leaked items on My Page. This site's take: first check your own items on My Page. If your document images were sent out, register fraud alerts with the credit bureaus and check your credit file; everyone should ignore contacts posing as the company. Former members can inquire through a dedicated form.
The Gyazo Breach (About 23.62 Million Records): User Data and Image Metadata Leaked — What Users Should Do Today
A vulnerability in Gyazo's image upload server was exploited, leaking about 23.62 million user records and metadata on about 490 million images, mostly uploaded before January 2019. This site's view: change your password and stop reusing it — that is the minimum. What is easy to miss is that the leak covers information about the images rather than the images themselves: text read from screenshots (OCR), photo location data and upload IP addresses. If a screenshot showed a secret, revoke that secret.
Japan's Four Major 2026 Data Breaches (KDDI, Aflac, Digital Agency, Sakura): Different Ways In, the Same Fix — Better Detection
KDDI (ISP mail platform, about 12.23 million people), Aflac Japan (about 4.4 million), Japan's Digital Agency (about 246,000 records) and Sakura Internet (up to about 1.36 million accounts). The ways in had nothing in common, yet KDDI, Aflac and Sakura all listed stronger detection in their remediation plans, and the Digital Agency case was caught through an anomaly in volume. This site's view: stop assuming intrusions can be fully prevented, and invest in watching volume and time, the only signals left when an attack looks like legitimate use.
How 2026 Breaches in Japan Got In: More Through Valid Credentials Than Vulnerabilities (A Cross-Case Analysis)
Classified by entry path, the major Japanese incidents disclosed in August 2026 skew toward credential-led intrusion rather than exploited vulnerabilities. The shared trait: the victim's own servers were untouched and the way in was a legitimate account on an outside service. This site's conclusion: flawless vulnerability management stops none of this, so the focus has to shift toward credential lifetime and scope, and an inventory of the vendors and SaaS that can reach your data.
MOVEit mass breach (2023) — how a SQL injection zero-day reached 2,700+ orgs, and how to defend
The entry was a SQL injection zero-day (CVE-2023-34362) in the internet-facing MOVEit Transfer. A web shell (LEMURLOOT) was planted and data was bulk-stolen from the backing database, hitting 2,700+ orgs and ~93.3M people. Most victims were pulled in indirectly because a vendor used MOVEit. In your environment: KEV fast-patching, minimize exposure, web↔DB least privilege and segmentation, vendor inventory and data minimization.
An organization's security minimum: six priorities worked back from Japan's 2026 breaches
An organization's 'minimum' should be set by where real incidents broke through, not by a product list. Line up Japan's 2026 incidents and the entry points differ — a VPN appliance, third-party software, a query feature, undisclosed — yet the causes that widened the damage come down to six: (1) close internet-facing devices on a deadline, (2) narrow maintenance, contractor and leaver accounts, (3) watch volume and time, (4) keep logs long enough to look back, (5) don't keep data you no longer need, (6) re-prioritise by KEV. This site's view: the minimum is deciding who notices, on which number, and when.
Capital One breach (2019) — how SSRF leaked 100M+ records, and how to defend
A single SSRF reached the metadata endpoint → over-privileged IAM temporary credentials → bulk S3 copy, leaking ~106M records. Every step could have stopped it. In your environment: IMDSv2, IAM least privilege, and an allowlist for outbound fetches.
Codecov breach (2021) — when a CI tool was tampered with and secrets leaked
A trusted CI tool (the curl|bash Bash Uploader) was altered upstream. Because your own code was untouched, it went unnoticed for ~2 months while CI secrets leaked; a checksum check caught it. In your CI: verify fetched artifacts, least-privilege secrets, rotation, egress monitoring.
Equifax breach (2017) — how an unpatched Apache Struts flaw leaked 147M people
The cause was a known, already-patched CVE (CVSS 9.8) left unapplied on a public system. An expired monitoring certificate hid the exfiltration for 76 days. In your environment: asset inventory, a patch SLA, machine monitoring, and healthy detection.