phishing
97 articles with this tag
M3 "MR-kun" breach (25,775 m3.com members and others, 2,260 pharma staff): what leaked, and what doctors and pharmaceutical staff should do
On October 15 and October 23, 2026 (second notice), M3, Inc. announced that a third party had gained unauthorized access to the system of MR-kun, a service it runs for pharmaceutical companies, and that personal information had leaked. According to the company, it confirmed the unauthorized access on October 14 and cut off the route it had identified the same day. The second notice confirms leaks for 25,775 m3.com members and others (name, workplace, email address for some, some information about their use of M3 services, and information that client pharmaceutical companies had registered in the service (assignment relationships and similar); email addresses for 6 of them) and for 2,260 pharmaceutical company staff (name, workplace, email address for some and other items; email addresses for 264 of them). It also includes some doctors who are not m3.com members, whose details pharmaceutical companies had entrusted to M3. Login passwords and m3 points were not included, and M3 does not hold credit card numbers. The cause has not been published. The company says it has found no public posting or misuse. Since October 22 it has been contacting affected members individually at their registered email addresses. Our conclusion: doctors and others who use m3.com should not open links in messages claiming to be from M3 or a pharmaceutical representative, and should not give out passwords or bank details.
Pizza Hut Japan online ordering breach: email addresses, phone numbers and login session tokens leaked, and what customers should do
On October 23, 2026, Pizza Hut Japan Ltd., which runs Pizza Hut in Japan, announced that a third party had gained unauthorized access to a system linked to Pizza Hut's online ordering service for Japan and that part of its customers' information had leaked. According to the company, on October 19 it confirmed that a third party had gained unauthorized access to a payment API linked to the online ordering service (a mechanism that exchanges payment-related information between systems) and obtained some information from a database containing customer information. The information confirmed to have leaked is customer IDs, email addresses, phone numbers, records relating to deleted customer information, session login tokens and transaction records. Credit card details were not included. The number of people affected has not been published. The company says the cause and the full scope are still under investigation. The company blocked the attacking IP addresses, addressed the vulnerability and filed a preliminary report with Japan's Personal Information Protection Commission. No secondary harm has been confirmed, but it warns of suspicious emails, texts and calls impersonating the company or Pizza Hut. This site's conclusion: anyone who has used Pizza Hut Japan's online ordering should not open links in messages claiming to be from Pizza Hut, and should check their order history in the official app or on the official website opened themselves.
Rakuten Travel Unauthorized Access (Up to About 2.6 Million Records): Names, Contact Details and Partial Card Data from Overseas Hotel Bookings, and What Users Should Do
On October 26, 2026, Rakuten Group, Inc. announced that it had confirmed unauthorized access by an outside third party to some pages of Rakuten Travel's overseas hotel booking site, managed and operated by its subsidiary Rakuten Travel Xchange, and to the multilingual booking site that Rakuten Group operates. On the overseas hotel booking pages (incident 1), an anomaly was detected on September 10 and the system fix was completed on September 16. The information that was subject to the unauthorized access covers names, email addresses, phone numbers and internal ID numbers for up to about 2.6 million records of logged-in customers, and, for up to about 40,000 records of customers who booked, names, contact details, country of residence, booking details and companions' names; payment information (card issuer identification number and last four digits, cardholder name, expiry date and card brand) for up to about 36,000 of those. Full card numbers, security codes, passwords, ID documents and addresses are not included (per the note on the booker item). On the multilingual booking site (incident 2), detected on October 20 and fixed on October 21, email addresses and internal IDs for up to about 860,000 records of logged-in customers, and account names and email addresses for up to about 40,000 records of accommodation staff entered in the admin screen, were affected. The cause, the period covered and any compensation have not been announced. This site's conclusion: a message asking you to re-enter your card number or pay is not genuine just because it gets your booking or your card's last four digits right. Do not use links in emails or texts; check your booking in the Rakuten Travel app or a bookmarked official site.
Fujicco campaign entry data possibly leaked (about 15,500 entries): names, addresses, family details, and what entrants should do
On October 22, 2026, Fujicco Co., Ltd., a Japanese food maker known for its Caspian Sea Yogurt and kelp products, announced that a server of the company it contracts to handle campaign entries had been accessed without authorization by an outside party, and that entrants' personal data may have leaked. The access was found on October 21 and the server was promptly shut down. The data covers personal information entered in the non-member entry forms of two campaigns run since May 2026: the Caspian Sea Yogurt series 'Motto! Toro-mocchi Campaign Part 2' and the 'Fujicco Thanksgiving Festival Campaign'. There are about 15,500 entries in total, including repeated entries by the same person. The items are name, age, gender, occupation, marital status, family composition, phone number, email address, address and survey answers. Driver's licences, credit cards and bank account numbers are not included. Entries made as a Fujicoin member, by postcard or on X are not affected. No publication or misuse has been confirmed, but the company is treating the data as obtained by a third party. This site's conclusion: people who entered through the affected forms should not pay shipping or handling fees, resubmit receipts or re-enter personal details when asked, and should check with the campaign office on the number in the official notice.
Green Monster's FX Navi app possible data leak (about 6.19 million records): email addresses and survey answers among the items, and what users should do
On October 23, 2026, Green Monster Inc. (Tokyo Stock Exchange Growth, 157A), announced that user information from its FX demo-trading app FX Navi (FXなび) may have been obtained by an outside party (first report). On October 17 it found unauthorized access to the app by an outside party and began investigating. In that investigation it found that, from around 20:26 on April 27 to around 14:26 on April 30, an outside party using a different IP address may have continuously obtained user information from the app. It says no leak from the October 17 access itself has been confirmed. About 6.19 million records may have been obtained, including data that is not personal information. The items are email address (66,003), nickname, gender, age group, occupation category, X (formerly Twitter) ID (6,434), self-introduction text, icon image URL, answers to the first-launch survey (4,809,631), device ID, login credentials, account transfer code (5,120), push notification identifier, advertising ID, source IP address and usage data such as trading results. Name, address, phone number, date of birth, credit card, bank account and My Number (Japan's national ID number) are not items users can register. The company says the cause was a function of the app's API; it fixed the API function and the login credentials and invalidated all login credentials issued before the fix. No secondary harm has been confirmed. This site's conclusion: FX Navi users should not open links or attachments in emails or X messages claiming to be from the company or related firms, and should treat every investment solicitation as fake.
Lindt Japan online shop and app member data breach (3,147,469 records): names, addresses, phone numbers, birth dates and hashed passwords leaked, and what members should do
On October 23, 2026, Lindt & Sprüngli Japan, the Japanese arm of the Swiss chocolate maker, announced that the system of the outside company that provides its online shop platform and manages its member data had been accessed without authorization, and that 3,147,469 member records from its online shop and the Lindt official app had leaked. According to the contractor's report, a vulnerability in software used on the contractor's server was exploited between 23:02 on October 17 and 0:16 on October 18 (Japan time). The leaked items are member ID, name, email address, postal address, phone number, date of birth, gender, newsletter settings, registered store, login password (stored hashed), and other member data such as name reading, registration date and last login. Payment data such as credit cards was not included. As of 11:00 on October 23, no misuse had been confirmed. The online shop has been suspended since 16:00 on October 21, and members will be asked to change their passwords when it reopens. Affected members are being emailed from October 26. This site's conclusion: members should not follow instructions in emails, texts, calls or letters claiming to be from Lindt, and should change the password now on any other service where they used the same one.
Piccoma newsletter email addresses leaked (1,002,404 records): only email addresses exposed, and what users should do
On October 24, 2026, Kakao piccoma Corp., which runs the Japanese manga app Piccoma, announced that blastmail, the email delivery system of RAKUS Lite Cloud Corporation that it used to send its newsletter, had been accessed without authorization by a third party, and that 1,002,404 customer email addresses that were recipients of one newsletter send had leaked. Piccoma learned of it from the delivery service's report on October 24. Only email addresses registered to receive the newsletter leaked; the company says it confirmed that customer management numbers and last-purchase dates were not included. Passwords were never given to blastmail and cannot have leaked, and Piccoma does not hold names or credit card details. The Piccoma app, website and the company's own systems were not accessed, and accounts, passwords and purchase data were not affected. No leak has been confirmed for the Piccoma Novels newsletter so far. The company stopped its newsletter, changed settings so that email sent from blastmail is not treated as genuine Piccoma email, and reported to Japan's Personal Information Protection Commission. It says it will contact affected customers individually. This site's conclusion: people who received the Piccoma newsletter should not open links in emails or texts claiming to be from Piccoma or publishers, should check in the app, and should never enter passwords or card numbers from an email.
Value Card prepaid platform breach (1.42 million records, 1.13 million MOS Card records): card numbers, PINs and balances leaked, and what cardholders should do
On October 23, 2026, PayCloud Holdings, a company listed on the Tokyo Stock Exchange Growth market, announced that the servers of Value Card, an in-house electronic money (store prepaid card) issuing service that its subsidiary Value Design Inc. provides to card issuers, were accessed without authorization by a third party, and that 1,424,748 records of ID numbers, PINs and balance information leaked (569,224 issued IDs and 855,524 unissued IDs, meaning IDs not yet bought by a user). The access was confirmed on October 19, and the cause was a third party exploiting a web server vulnerability in part of the subsidiary's system environment. No personal information was involved; the risk of misuse of issued IDs has been dealt with, and there has been no actual damage from misuse. The same day, MOS Food Services, Inc., which runs the MOS Burger chain and its MOS Card prepaid card, announced that unauthorized access to the system of Value Design, which it contracts to operate and maintain the MOS Card servers, leaked 1,133,070 MOS Card records (16-digit card number, 6-digit PIN and balance; about 570,000 cards in circulation and about 560,000 not yet in circulation), and that it forcibly reset the PINs linked to the leaked card numbers. Names, addresses, phone numbers and credit card details were not included. Which other issuers' cards were affected has not been disclosed. This site's conclusion: MOS Card holders should check their usage history for charges they do not recognise, contact the dedicated help line if online balance checks and similar functions stop working, and never give their PIN or card number to anyone who asks.
FANCL and Attenir online store breach (368,184 and 417,312 members): names, addresses, phone numbers and birth dates exposed, and what members should do
On October 16, 2026, FANCL Corporation and Attenir Corporation, two Japanese cosmetics and health-products companies, announced that their online stores had been accessed without authorization by an outside party between October 3 and 10, and that part of their member data had leaked. The access was found in an internal investigation on October 15, and the companies identified and stopped the feature that caused it. The leaked data covers 393,785 records for 368,184 FANCL members and 441,162 records for 417,312 Attenir members. The items are email address, name, address, phone number, date of birth, gender, customer number, a sub email address and its password (a hashed secondary password set by some members; the main password is not included), security question items (answers not included), and other registration data such as points and membership tier. Payment data such as credit cards is not included. No misuse or secondary harm has been confirmed. FANCL's FAQ says affected customers were contacted at their registered email address during October 17. This site's conclusion: members of either company should assume their name, address, phone number and birth date are known, should not follow instructions in emails, texts, calls or letters claiming to be from the companies, and should check through the official site or the shared help line.
Trustbank's Furusato Choice breach (4,454,097 member records): names, addresses and hashed passwords leaked — what donors should do
On October 20, 2026, Trustbank, Inc., which runs Furusato Choice, a major site for Japan's furusato nozei hometown tax donation scheme, announced that an outside party had gained unauthorized access to member data and that donors' personal data had leaked. After noticing unusual access patterns on October 19, the company found that the unauthorized access had taken place on October 17, and it shut down the related services at 15:50 on October 19. The leak it confirmed covers 4,454,097 member records: name, email address, postal address, phone number, hashed password and estimated donation tax deduction amount. In a second report on October 23, the company said that for five of these donors additional items had leaked, including points history, donation history, date of birth and delivery address. For two of them, an outside party accessed the My Page screen that shows saved card details (last four digits, cardholder name, expiry date). The company says card details are fetched from the payment processor each time that screen is shown and are not stored in its systems, and that they cannot be used on their own to make a card payment. Members have been emailed individually since October 21 about whether their data leaked and which items. No restart date has been set. This site's conclusion: members should change the password on any other service where they use the same email and password combination, and should not open links in messages claiming to be from Furusato Choice or a municipality.
and ST HD breach (about 2.5 million customer records): what may have leaked and what members should do
On October 23, 2026, and ST HD Co., Ltd. announced that unauthorized access by a third party to its business servers may have leaked part of its customer, business-partner and employee data. According to the company, from around 7:30 a.m. on October 22 (Japan time) login attempts, intrusion and data extraction were carried out against several of its servers in turn; the company detected the unauthorized activity around 10:00 a.m., isolated the servers and cut off the access route by 5:00 p.m. The data that may have leaked covers about 2.5 million customer records (name, date of birth, gender, address, phone number, email address and member ID) and about 10,000 business-partner records (company name, ordering and return addresses, contact person's name, phone number and email address); the scope for employees is still being confirmed. Payment data such as credit card details, and passwords set by customers themselves, are not included, the company says. Its and ST web store was not affected by the unauthorized access, but member points currently cannot be used in stores or on the web store. The company says it is starting to contact affected customers and partners in turn and will set up an inquiry desk. This site's take: since passwords are said not to be included, the priority today is not changing your password but doubting messages that use the company's or its brands' names together with your real address or birth date. Check through the official app or a website you open yourself.
Unauthorized Access to the blastmail Email Delivery Service (All Customers' Account Data, and Mailing Lists and Similar Data for 345 Contracts): What Newsletter Recipients and Client Organizations Should Do
The email delivery service blastmail, provided by RAKUS Lite Cloud Co., Ltd., a subsidiary of RAKUS Co., Ltd., was accessed by an outside third party and data was taken out. The company shut the service down in an emergency at 0:30 a.m. on October 21, 2026, and the parent company RAKUS published a first and second report the same day. According to the notices, the third party intruded into two API servers, ran commands, and connected to the sales management system and the service database to take data out. From the sales management system, the company name, contact name, phone number, email address, billing email address and contract and payment history of every customer were taken. The company does not hold credit card numbers. For some customers, the leak of delivery data such as recipient lists was also confirmed. In its update at 17:00 on October 26, the company said one more case had been found, bringing this to 345 contracts, and that it had contacted all of them individually. The intrusion route is under investigation, and no restart date has been set. In notices from client organizations, The Niigata Nippo said the data of all members of its Niigata Nippo Passport service, up to about 253,000 people, including name (in katakana), email address, gender and age band, had leaked. JR Shikoku said about 30,000 records may have leaked, the City of Yokohama disclosed three related mailing services, and the Ministry of the Environment disclosed six newsletters as possibly affected. giftee said it confirmed its contract was not among the 288 counted as of October 23. This site's conclusion: people who receive newsletters from these organizations should not open links even if the sender name is genuine, and should check through the official site. Organizations that use blastmail should confirm whether they were contacted, decide on reporting to the Personal Information Protection Commission (joint reports with the company are accepted until October 29) and on notifying individuals, and warn their own staff about billing or re-login emails claiming to be from blastmail or RAKUS, since contact details of all customers were taken.
Unauthorized Access to Medley's Clinic System @link (at-link): Patients' Names, Birth Dates, Login IDs and Passwords Leaked — What Patients and Clinics Should Do
On October 15, 2026, Medley, Inc. announced unauthorized access by a third party to its medical-institution management system @link (at-link), the patient-facing at-link app and related services, and said it had suspended them from late at night on October 14. According to the company, it began investigating on October 11 after an outside specialist organization alerted it to possible unauthorized access, and confirmed the access. On October 23 it said it had confirmed that, from late September to mid-October 2026, the third party accessed the company's database through a program it had planted without authorization and obtained information, and that personal data had leaked. For patients who used the at-link app or web booking, the leaked items are name, name reading (furigana), birth month and day, email address (only if registered), app and web-booking login ID and password, the name of the clinic used, registration date, last visit date, and credit card payment history (payment date and amount only; only for those who paid online through the app). For patients who did not use the app or web booking, the leaked items are name, furigana, birth month and day, the name of the clinic used, registration date, last visit date, and the app and web-booking login ID and initial password. The company says it does not hold card numbers. The number of clinics and people affected is under investigation; the company will notify affected people in turn, working with the clinics. It has not disclosed the specific method, saying doing so could invite similar attacks. It has closed the route and invalidated all related credentials, and has reported to the Personal Information Protection Commission and the Ministry of Health, Labour and Welfare. App and web-booking passwords will not be carried over; users will set new ones when the service restarts. This site's view: people who used the at-link app or web booking should change the password on any service where they reused it, and should not open links in messages that mention their clinic or visits. Clinics should direct patient inquiries to the company's dedicated contact.
Nikkei Unauthorized Access (About 1.83 Million Records): Names, Email Addresses and More Leaked in About 150,000 — What Users Should Do
On October 16, 2026, Nikkei Inc., the Japanese newspaper publisher, announced that a cloud service it uses for system development had been accessed without authorization and that, as of the 16th, about 1.83 million records of personal information had leaked. About 150,000 contained at least one of name, email address, postal address, phone number or date of birth, and about 120,000 of those included an email address. The remaining roughly 1.68 million consisted only of identifiers that cannot identify a person on their own. Credit card information was not included. According to the company, credentials for accessing the cloud service were stolen by some means, and the unauthorized access took place from the early hours to the morning of October 7. The company disabled the credentials used and reported the incident to Japan's Personal Information Protection Commission on October 11. As of the 16th, no secondary harm such as misuse of the data, and no system outage or data tampering, had been confirmed. The company says it will notify individually those whose data is confirmed to have leaked. Group company Nikkei National Geographic said on October 22 that information on some users of its services was included. Which services' users are affected, counts per data item, and how the credentials were stolen have not been disclosed. This site's take: do not use links or phone numbers in emails or calls claiming to be Nikkei; check on the official site.
Treasure Factory (Trefac) breach (746,277 email records): what home-buyback and Trefac Moving customers should do
On October 23, 2026, Treasure Factory Co., Ltd., a Japanese second-hand goods retailer, announced that an outside party had gained unauthorized access to the case-management system it uses to take and handle requests for its home buyback service (shutchō kaitori) and its Trefac Moving service, and had taken part of the customer and other data held there. According to the company's timely disclosure, the confirmed data is 746,277 customer records (email addresses; 11 of them also include name and address), 750 records of names and email addresses of business partners, employees and others, and 1,000 records of names and device identifiers for devices used by business partners, employees and others. Credit card numbers and other payment information were not included, and customer data held at stores and in the company's app is managed in separate systems and was not affected. The company confirmed the access through an access-log review on October 20 and cut off outside access and the request forms the same day. It believes a vulnerability related to database access was exploited, and says the incident is not related to a recently disclosed PHP vulnerability. No secondary harm has been confirmed. The system and request forms are scheduled to restart around October 28. This site's conclusion: if you have ever requested home buyback or Trefac Moving, assume your email address is known, do not open links in emails claiming to be from Trefac, and check on the official site instead.
Capcom CAPCOM ID Breach (11,774,247 Records): Email Addresses and Login Data Leaked — What Account Holders Should Do
On October 22, 2026, Capcom Co., Ltd. announced that its online membership service CAPCOM ID (the shared account used for Capcom web services and some online games) was accessed without authorization by a third party, and that part of its customer information leaked. The leaked data are email addresses and system-specific identifier information (account creation date and time, last login date and time, number of logins, and the client IP address used at the last login), in 11,774,247 records worldwide. For 43 of them, date of birth, gender, country/region and nickname also leaked. On 196 of the accounts, the login password had been changed without authorization; the company has already reset those passwords. According to its second notice of October 23, for 19 of those 196 accounts (in Japan), an unauthorized third party accessed the account pages of e-Capcom, the company's online store in Japan, and the following leaked: name, name in Japanese phonetic characters, phone number, postal code, address, gender, date of birth, purchase history, e-Capcom inquiry history and saved address book information. For the remaining 177 of the 196 accounts, the company found no information compromised as a result of the password changes. The company says it has not confirmed any leak of passwords set by customers themselves, and credit card information was not among the affected data. According to the company, it found traces suggesting unauthorized access on October 19, immediately began blocking the access and investigating the cause and scope, and confirmed the unauthorized access the same day; on October 20 it confirmed the leak and the password changes; and on October 21 it reported the incident to the police and Japan's Personal Information Protection Commission. It says it has identified and addressed the attack method, but has not disclosed details of the cause. In the second notice it said the investigation into the scope of impact has been completed and that it will keep monitoring CAPCOM ID and related services. Services using CAPCOM ID and all games remain available. It said it would contact affected customers individually and set up dedicated support channels for each region. This site's take: CAPCOM ID holders should not open links in emails or texts claiming to be Capcom, should not give personal details over the phone, should change any password they reuse elsewhere, and should turn on two-factor authentication.
Comic Cmoa Member Data Breach (Up to About 4.2 Million Records in Log Files): Email Addresses and Dates of Birth Leaked — What Users Should Do
NTT Solmare Corporation, which runs the Japanese e-book store Comic Cmoa (コミックシーモア), published four notices about unauthorized access to the service, from a first notice on October 15, 2026 to a fourth report on October 21. According to the company, on October 15 it judged that unauthorized access from outside to its servers had very likely taken place and suspended the service at 11:35. In its second report on October 16 it said it had confirmed that member data in the system that manages member information had leaked to a third party (the count was still being examined). In its third report on October 18 it said it had identified the intrusion route and attack method and was dealing with them, and that some system log files had also been viewed and taken. In its fourth report on October 21 it described the data confirmed as leaked as 319 records of registration data in the member database (email address, hashed password, nickname, date of birth, gender) and up to about 4.2 million records in system log files (email address, nickname, date of birth, gender; no passwords; possibly including duplicates for the same person). It says credit card data is not held in the affected systems and did not leak, and that no leak of purchase histories and no leak, loss or damage of MY Bookshelf (users' libraries) has been confirmed. It says identifying and blocking the intrusion route and attack method is complete, but has not disclosed what they were. Affected people will be contacted by email. The service remains suspended and is to resume in stages, starting with web reading of purchased titles; all users will be asked to reset their passwords on resumption. This site's take: anyone who uses the same email address and password as on Comic Cmoa for another service should change that password today, should not open links in emails claiming to be the company, and should check through NTT Solmare's news release page opened themselves.
Iwai Cosmo Securities vendor breach (4,975 customers): what leaked, the unintended trades, and what customers should do
On October 16, 2026, Iwai Cosmo Securities Co., Ltd., a Japanese brokerage, announced through a timely disclosure by its parent company Iwai Cosmo Holdings that the system of a vendor it uses to operate and maintain its online trading system had been accessed by a third party, and that names, email addresses and other details (氏名、メールアドレス他) of 4,611 online trading customers had leaked. The company detected the access on October 14. In its second notice on October 20, it said a re-examination of access and communication logs found 364 more people, bringing the total to 4,975; it said this was not caused by any later access. The leaked data does not include trading PINs, and the company says it cannot be used to log in to accounts or trade. The second notice also disclosed that on October 14 the trade management system was attacked as well, and orders the customers did not intend were placed in 7 accounts (5 of them were executed). The trades have been reversed and customers bear no cost. The company says the leaked personal data was not used for these trades. It says the point that allowed the access has been identified and fixed, and that the vendor added measures such as access restrictions on management functions. The specific method has not been disclosed. This site's take: do not use links or phone numbers in messages claiming to be from Iwai Cosmo; check your order and execution history from a login page you opened yourself, and contact the official line (0120-405-546) with any concerns.
Unauthorized Access to Onamae.com Desktop Cloud (GMO Internet) (26,739 Servers Possibly Affected): Customer Data Taken Out, Compensation, and What FX and Securities Traders Should Do Today
On October 21, 2026, GMO Internet, Inc. announced unauthorized third-party access to Onamae.com Desktop Cloud, a VPS (virtual private server) service for FX auto-trading, and said a malicious program had been placed in some customers' server environments. 26,739 servers may be affected; the company says this is the number of servers that could be affected, not the number where unauthorized access or data acquisition has been confirmed. From 04:00 on October 21 it stopped the servers of all plans one after another. In its fourth notice of October 24, the company said a security problem existed in the service's system, and that it had confirmed unauthorized access to the service environment and that customer information had been taken out. It also said some customers had reported trades on their trading accounts that they did not make. Which information was taken and for how many customers, the intrusion route, and the number of affected accounts and amounts have not been disclosed. The company will pay a flat 5,000 yen to every current user of the service, and will compensate realized losses from trades it finds were caused by this unauthorized access (minus any refund from the exchange or broker). It will not restart the current system platform as it is, and will offer a switch to an alternative service on a separate cloud platform, free for six months after switching. According to the company, someone it believes to be the attacker has demanded money and threatened to publish information and take other actions if it refuses; the company says it will not pay and has given evidence to the police. Its fifth notice of October 24 again asks customers to fully scan and back up their own devices, change passwords from a device not used for FX trading, end all signed-in sessions even if they have already changed their password, and set up two-factor authentication. According to news reports, the attacker side has threatened to take over customers' PCs unless paid by noon on October 27. Customers are reported to have received emails from a sender believed to be the attacker, with part of their browsing history attached as proof that the data is held. The company's group CEO wrote in a blog post that the attacker has threatened to publish information on customers' PCs and to attack them with ransomware, but the company has not said that any customer's PC was actually compromised. Its sixth notice of October 26 asks customers to fully scan the devices they used to connect and to keep browser sync off until their check is done, among other steps. This site's take: from a device you do not use for FX trading, change your broker passwords, end all sessions, and check your trading history and balance. Use only the company's official site and the notices sent to your registered email for compensation, and never give anyone a password that can trade.
Unauthorized Access to Ymirlink's Cuenote FC Email Delivery Service (Now About 51.63 Million Cumulative Records): Express Reservation and smartEX Member Data Included. What Newsletter Recipients and Client Companies Should Do
On October 26, 2026, Ymirlink, Inc. (TSE Growth, 4372) published a second report on the unauthorized access to its email delivery service Cuenote FC, saying data leaked from 49 systems, a cumulative total of 51,628,280 records. In its first report on October 19 it had estimated five systems and about 9 million cumulative records; after reviewing the logs of all systems, it found records of unauthorized access and data export on 42 more systems on October 25. The leak count is still under investigation for 16 systems, and the cumulative total may rise. It attributes the incident to a library vulnerability and says it confirmed that the credentials of its support and quality-control staff were obtained, malicious programs were installed, and session information captured at login was used to log in without authorization. In its customer management system Cuenote BASE, 190 records of customer contract information (company name, name, phone, email address) were viewable. It says it has found no evidence that the leaked personal data was made public or misused. Among client companies, JR Central, JR West and JR Kyushu announced on October 26 that, although they had first been told their Express Reservation and smartEX services were not affected, the email addresses, member IDs, names (in katakana) and membership types of members sent emails through the service had leaked. AsMarq said the same day it had been told that part of the data registered in the environment it uses had likely been obtained without authorization. This site's conclusion: Express Reservation and smartEX members should not open links even in emails or SMS that show their katakana name or member ID, and should check through the official app or a bookmarked official site. Newsletter recipients should not open links in emails claiming to come from the sender. Client companies should confirm with Ymirlink whether their environment is affected and decide whether they must report to the Personal Information Protection Commission and notify individuals.
Recruit Carsensor.net and C-MATCH Breach (Up to 3,709,551 Records): Names and Addresses of People Who Contacted Dealers May Be Exposed — What Users and Dealers Should Do
On October 21, 2026, Recruit Co., Ltd. announced that information on users and business partners of Carsensor.net, its used-car listings site (including the app), and C-MATCH, its business support service for used-car dealers, may have leaked outside as a result of unauthorized access. According to the company, it detected suspicious access from outside to Carsensor.net-related systems on October 17 and suspended all related services from around 17:00 that day. On October 20 it identified the items and the number (maximum) of personal data records that may have leaked. The count is up to 3,709,551 records: 3,210,421 for people who contacted dealers through the site (mostly name and address; addresses are in principle only down to the city or municipality), 5,289 for people who posted reviews, 483,168 for dealers registered with C-MATCH (staff names and phone numbers, secondhand dealer licence numbers, login IDs and so on; for sole proprietors, also direct-debit bank account information), and 10,673 for company employees and staff of contractors and sales agents. None include payment data such as credit cards, or login passwords. The cause is unauthorized access by a third party, with details under investigation. The company has filed a preliminary report with Japan's Personal Information Protection Commission and will contact affected people individually in turn. As of October 21 no secondary harm had been confirmed. Services have been resuming in stages from around 13:00 on October 22, starting with those whose safety has been confirmed. This site's take: anyone who contacted a dealer through Carsensor should assume letters, emails and calls may come from someone who knows their name and address, should not open links or attachments in unexpected contacts, and should check through Recruit's notice page.
H2O ID Data Breach (About 1.26 Million Records) via the Hankyu and Hanshin Department Store Reservation Site: Addresses, Phone Numbers and Birth Dates Leaked — What Members Should Do
On October 19, 2026, H2O Retailing Corporation and Hankyu Hanshin Department Stores, Inc. jointly announced that the Hankyu and Hanshin department store reservation site, HANKYU HANSHIN E-STORES and Remo Order, all run by Hankyu Hanshin Department Stores, had been accessed without authorization by a third party, and that part of customers' personal data had leaked. On October 16 the companies confirmed unauthorized access to the customer management system via the reservation site and stopped that site's whole system; on October 17 they confirmed unauthorized access at E-STORES and Remo Order as well and stopped both. On October 19 it was established that part of the personal data of about 1.26 million H2O IDs managed in the customer management system had leaked. The notice says part of the personal data of almost all H2O ID members leaked. The items are H2O ID, name (kanji and katakana), gender, email address, postal code, address, mobile phone number, phone number, age, date of birth, and the services used with the H2O ID. For E-STORES and Remo Order, whether data leaked is under investigation; the companies list the data those services hold as order history, part of credit card information (card type, last four digits, cardholder name, expiry date), part of point card information, and address book information. Full card numbers and security codes are not held. No leak of login passwords has been confirmed, and no misuse or secondary damage has been confirmed. The cause is under investigation. E-STORES reopened at 14:00 on October 19. This site's take: expect convincing messages that know your name, address, phone number, birth date and which services you use; do not open their links, and check on the official site you open yourself or through the contacts in the notice.
NIFTY Line Application System Breach (Up to 542,513 Records): Member IDs, Names, Addresses and Phone Numbers May Be Exposed — What Fibre Customers Should Do
On October 19, 2026, NIFTY Corporation, a Japanese internet service provider, announced (first report) that it had confirmed unauthorized access from outside to its line application and acceptance management system. According to the company, it confirmed the unauthorized access at around 10:20 on October 19 and immediately blocked access from the source. The system is an internal management tool the company uses to register information; it is separate from the website (application forms and so on) that customers use to apply directly. Up to 542,513 records may be affected. They cover customers who applied for a line since 2019 (excluding the company's website), for the services @nifty Hikari, @nifty MAX Hikari and @nifty au Hikari Plus. The items are member ID, name, gender, date of birth, address, phone number and email address; this is the full list of items that may have leaked, and what actually leaked is under investigation. The system holds no bank account or credit card data, which is not included. The notice does not mention passwords. The cause has not been disclosed; the company is investigating with outside specialists and is in the process of reporting to Japan's Personal Information Protection Commission. This site's take: anyone who applied for one of these services since 2019 should assume contacts may come from someone who knows their name, address, phone number and birth date, and should not follow links or instructions in emails, texts or calls claiming to be NIFTY. Check through an official contact you look up yourself.
Unauthorized Access to the Studio Website Builder: All Users' Data and Form Submissions May Have Leaked — What Form Senders and Site Owners Should Do
On October 16, 2026, Studio Inc. announced that a third party had gained unauthorized access to the cloud environment it uses, and that data on every customer registered with its website builder Studio may have been leaked. The third party exploited a vulnerability in some Studio features to access the environment and made its data retrievable from outside. The confirmed period of unauthorized access is September 30 to October 1, 2026 (Japan time); the company found it in an internal investigation on October 13 and finished fixing the vulnerability and closing the route on October 13–14. Data that may have leaked includes account data (user names, email addresses, hashed passwords and more), design editor and CMS content, the contents of forms submitted on Studio-built sites, live preview URLs, API keys and tokens for external services registered in API integrations, passwords of password-protected pages, and webhook notification URLs. Some data stored encrypted may also have been read, because the key needed to decrypt it was read in the same access. The company has not confirmed that a third party actually took the data, but is treating it as taken. The number of people affected and whether any misuse has occurred are under investigation. Companies and organizations that built sites with Studio have also said that personal data sent through their forms may have leaked: Luup gave 21,368 records, Link-U Group 7,663, TRUSTART about 1,440 and Saitama Prefecture's Saitama Green Forest Museum 162. Japan's Digital Agency said on October 22, after Studio Inc. reported the incident to it on October 16, that inquiries entered in its website's contact forms between May 2021 and March 2023 (five categories, up to 8,833 records in the largest; up to 13,323 in all, as added up by this site) and 35 Studio account records may have leaked. On reporting to Japan's Personal Information Protection Commission (PPC), Studio Inc. first asked form users on October 17 to put individual reports on hold, then said on October 20 that, after talks with the PPC, customers can choose to report individually or jointly with Studio (either way, customers still decide on notifying the affected individuals). On October 19 it added to its guidance page that even responses that are sales pitches, spam or raise safety concerns in principle require notifying the individual if they contain information that identifies a person. This site's conclusion: if you sent a form on a Studio-built site, check that site owner's notice and do not open links in messages that mention what you sent. Site owners should change their password and rotate integration keys in the order Studio Inc. gives.
Burger King Japan App Breach (About 11.18 Million Records): Names, Birth Dates and Phone Numbers Leaked — What Members Should Do
On October 15, 2026, BK Japan Co., Ltd., which runs Burger King in Japan, announced that the official Burger King app it operates had been accessed without authorization by a third party, and that it had confirmed the leak of app members' information. The access took place from October 2 to October 7, 2026, and the leak was established on October 13. About 11.18 million app member records are affected. The items are member ID, email address, registration type, prefecture, gender, date of birth, name (in kanji and katakana), phone number, whether the member has a mobile order history, and whether the email address has been verified. The company says it does not hold credit card numbers, so they did not leak, and that no leak of login password information has been confirmed so far. The detailed cause is under investigation with an outside specialist organization, and no secondary damage such as fraudulent use had been confirmed at the time of the notice. There was no follow-up as of October 17. This site's take: expect convincing messages that know your name, birth date and phone number; do not open their links, and check in the official app you open yourself. If you use your birth date as a PIN or password, change it.
SourceNext Member Data Leak (22,519,960 Records): Emails, Passwords and Addresses May Be Exposed — What Members Should Do
On October 15, 2026, SOURCENEXT CORPORATION announced that a third party had gained unauthorized access to member data it manages and that personal data of its registered members had leaked outside the company. According to the company, from around 10:00 on October 9 a third party misused a member data retrieval API to obtain member information; the company confirmed the unauthorized access at around 9:00 on October 13 and completed containment by 13:36 the same day. The data that may have leaked covers 22,519,960 records. The items are email address, password, name, name in katakana, address, gender, phone number, fax number, date of birth, company name, job title, department and system identifiers (subscribed services, registration date, login date and so on); the items differ by how each member registered. Credit card data is not stored in the affected system and is not included, the company says. In an update on October 16, the company said every member's password has already been disabled and the old passwords no longer work, and asked members to set a new one. An October 19 report attributes encrypted storage and confirmed decrypted exposure to the company’s spokesperson. The company's FAQ says it asked an independent outside security specialist to start a third-party investigation on October 16, that its Super Security and Virus Security products can still be used as before, and that data saved in 1Password is not held by the company and is not part of the leak. This site's take: anyone who has registered with SourceNext should first change the password on any other service that uses the same email and password, then set a new SourceNext password through the official website opened themselves, and not use links or numbers in emails, text messages, calls or letters claiming to be SourceNext.
Unauthorized Access to Some ConoHa WING (GMO Internet) Web Servers (426 Accounts): Data in Customers' Web Server Areas Affected, and What Site Owners Should Do Today
On September 20, 2026, GMO Internet, Inc. announced that on some hosting servers (web servers) of its ConoHa WING rental hosting service, a third party had gained unauthorized access to the web server areas of some customers and installed a malicious program. 426 accounts are affected, and the data concerned is 'data stored in customers' web server areas'. The access and installation began on September 3; the company detected it on September 16, and on September 18 identified the cause and scope and removed the programs. It says it has identified the cause but has not disclosed it. Member, contract and payment data are managed in a separate environment and were not leaked, it says. The notice does not say whether data in the web server areas was taken. Affected customers were contacted individually at their registered email address, and customers who were not contacted are not affected. There was no follow-up notice as of October 15. This site's take: first check whether you received an individual email and, if so, follow its instructions. Then treat the credentials kept in your web server area (the database password in wp-config.php, API keys in .env and so on) as read and change them, and look for files, administrators and scheduled jobs added since September 3.
IDARE data breach (129,659 people): balances, transaction history and some ID document numbers leaked — what users should do
On October 13, 2026, Fivot Inc. announced that its cashless app IDARE had suffered unauthorized third-party access that leaked personal data. A vulnerability in outside software the company used for customer support and other work was exploited, and data in the company's database was obtained on multiple occasions between August 10 and September 27. The people affected are the 129,659 who had registered by September 27, including those who had closed their accounts. For everyone, the leaked data includes phone number, email address, date of birth, user ID, display name, account settings and status, balance, transaction history, and the name and expiry date on the IDARE card. For some people it also includes the name, address, gender, purpose of use and ID document number submitted for identity verification, the last 4 digits of the IDARE card number, the first 6 and last 4 digits of a credit card registered for top-ups, the last 3 digits of a bank account registered for top-ups, the activation code for the physical card, and annual income and employer details entered for LADDER, a lending service that closed in October 2021. Login passwords, images of ID documents and faces, My Number, full card numbers, security codes, PINs and full account numbers were not involved. The company says no fraudulent transactions have been confirmed and that multi-factor authentication is required to log in. In its second report on October 21, it said no fraudulent transactions had been confirmed as of that date and set out prevention measures with deadlines (October 30 and November 30). A third-party investigation by an outside specialist organisation is expected to be compiled by late November to early December, and the company says it will publish the report when it is complete. This site's conclusion: the leaked data alone cannot be used to log in or pay, but a message that correctly states your balance or recent purchases is not proof it is genuine. Do not act on messages claiming to be IDARE, a card company or a bank through the channel they arrived on, and never give anyone your password, PIN, security code or authentication code.
SpeeCAN RAIDEN Breach (2026): Disaster-Alert Email Users and Scam Risks
On October 13, 2026, Arcadia Inc. announced that SpeeCAN RAIDEN, its mass-notification service for email and other messages, was accessed without authorization by a third party, and that contact names, email addresses, phone and fax numbers, staff and contract information, and the text of delivered messages stored as history may have leaked. The maximum counts are about 3,136,000 email addresses, about 105,000 phone numbers and about 15,000 fax numbers (all estimates, still under investigation). Arcadia saw suspicious activity at 16:30 on October 11, applied an interim block around 3:00 on October 12, and at 11:00 on October 13 shut down the services that had been the intrusion route (raiden3, and s2 for Raiden School). On October 14 it added NET119 and 119RAIDEN to the possible leak, and in its 11th update on October 16 gave figures per service: for NET119, personal data such as names, dates of birth and addresses linked to 9,020 email addresses (it confirmed that no sensitive personal data leaked); for 119RAIDEN, about 97,000 email addresses and other data. The suspended services were restored around 15:00 on October 15. Payment data is not handled. Municipalities have issued their own notices; Shizuoka City says it has established that email addresses of 34,336 registered residents and other data leaked, and has seen fake emails posing as a card company sent from the same domain as the real alerts, @raiden.ktaiwork.jp. In its 17th update on October 21, Arcadia said a malicious program sent 1,423,428 phishing emails from its system between 1:17 and 7:16 on October 13, that at least 869,575 of them went to addresses the company does not hold, and that an outside organisation will carry out a dark-web survey. It has also emailed clients and resellers about filing the reports to the Personal Information Protection Commission and the Ministry of Internal Affairs and Communications on their behalf. In its 20th update on October 22, it told clients they must use two-step authentication at login, to prevent a recurrence, and in its 22nd update on October 23 it asked Raiden School clients to do the same. In the report published with its 21st update on October 23, it says a configuration file was obtained through a vulnerability in the media server that publishes attachments, leaking a secret key used for logins between services, among other causes; that all services are within the scope of the possible leak; and that the count is still under investigation (9,020 of them for NET119). It has asked a third-party security organisation for a detailed investigation. Our conclusion: the sender cannot tell real from fake, so do not block the disaster-alert sender, and do not open links in emails asking you to confirm card or personal details.
Unauthorized Access to Commune (166,505 Member Records, Counted per Community): Member Data from Corporate Communities Leaked — What Members and Operators Should Do
On October 9, 2026, Commune Inc. announced that its community services for businesses, Commune and Commune for Work, were accessed without authorization by an outside third party, and that member data in some communities leaked. The leaks occurred from about 18:00 on October 5 to about 21:00 on October 6, and from 13:17 to 14:36 on October 7 (Japan time). Its first notice gave about 307,000 members (an estimate of unique people) as the maximum possibly affected. In a follow-up on October 21, after a detailed investigation, it confirmed that 166,505 members were affected (the total of member IDs counted per community, so people in several communities are counted once for each; this includes communities run by the company and test/demo communities, and excludes accounts created by the attacker), and that 125,601 of them had data including email addresses leaked. For the others, the leaked data includes display names, profiles and private group memberships. For 144 members, passwords were changed to temporary ones without their action. No leak of the passwords themselves or of direct messages was confirmed, and the company does not hold payment data. It attributes the incident to invitation links for private communities obtained illegitimately and to impersonation of administrators. Client companies that run communities on the service have also published notices; JMAM said the names, addresses, ages and phone numbers in member profiles on its Toki Labo community also leaked. To prevent misuse of the leaked email addresses, Commune Inc. stopped all communities for emergency maintenance from 00:50 on October 10 and took measures such as making two-factor authentication mandatory for administrator accounts. On October 16 it announced that communities would reopen in stages, starting with clients that ask, in the web browser version only and with some features restricted (the app, new registration with an email address and “forgot password” resets remain unavailable). It says no new unauthorized access or leak was found during the maintenance or testing. The October 21 follow-up also says the company filed a preliminary report with the Ministry of Internal Affairs and Communications (Kanto Bureau of Telecommunications) on October 9, has begun consulting the police, found no programs, accounts or settings left behind by the attacker after analysing all logs, and is preparing a forensic investigation by a third-party organisation. This site's take: check the notice of the company that runs your community to see whether you are affected, and do not open links in emails that claim to come from the community.
Japan's online ID checks move to IC-chip reading (April 2027): what changes, and how users and businesses should prepare
An amendment to the Ordinance for Enforcement of Japan's Act on Prevention of Transfer of Criminal Proceeds (promulgated 24 June 2025, in force 1 April 2027) ends, in principle, non-face-to-face ID checks that rely on images or copies of ID documents for bank accounts and other covered transactions. Reading the IC chip in a driver's license or My Number Card, and the card's electronic certificates (JPKI), become the main methods. In-person checks also change to presenting the document and having its IC chip read. Mobile phone contracts made online already switched on 1 April 2026; in-store contracts follow from April 2027. On 9 October 2026 the Financial Services Agency, citing the current situation of repeated unauthorized access and leaks of customer data that included driver's license images, asked financial institutions to move to IC-chip reading without waiting for the effective date. This site's conclusion: a leaked image can be reused by anyone, but IC-chip reading needs the physical card and its PIN. Users should check their two license PINs and My Number Card PINs now; businesses should stop collecting and keeping document images.
Baitoru breach (up to about 3.89 million email addresses): only emails leaked — how members can spot fake interview messages and job scams
On October 9, 2026, dip Corporation announced that on October 6 it had confirmed unauthorized third-party access to Baitoru and Baitoru NEXT, the job sites it runs in Japan, and that some member email addresses had leaked. The number of addresses that may have leaked is up to 3,885,771. The company says only email addresses leaked and that names, phone numbers, passwords and credit card details were not included. It attributes the cause to unauthorized access from overseas that exploited a flaw in the specification of part of its system. It blocked all access from overseas and modified the program. It has not confirmed any posting of the data online or any misuse. Affected members were told on the services on October 6 and are being contacted individually by email and other means. There was no follow-up notice as of October 10. This site's take: even if only email addresses leaked, they are known to belong to job-site members. Do not open links in messages about interview schedules or application confirmations; check in the official app you open yourself. Do not move to other messaging apps or answer offers of 'high pay, paid the same day'.
Bookoff Member Data Leak (6,383,279 People): Names, Addresses, Emails and Password Hashes May Be Exposed — What Members Should Do
On October 9, 2026, BOOKOFF GROUP HOLDINGS LIMITED announced that a third party had gained unauthorized access to the member management system for Bookoff in Japan, provided by its subsidiary BOOKOFF CORPORATION LIMITED, and that member data had been leaked outside the company. According to its second report on October 13, member data was taken from outside between October 4 and 6. The count is 6,427,735 records by member number, or 6,383,279 people when member records registered with the same email address are counted as one person (212,371 of them former members). Those affected are app members, online store members and web members; people who only use a member card and never registered through the app or web are not included. The data that may have leaked is name, date of birth, gender, occupation, nickname, email address, phone number, postal code and address, password hash, point card number and member number (occupation and nickname were added by a correction on October 16), though not every item leaked for every member. Payment data such as credit card details, bank account details, text read from ID documents at in-store buybacks and ID document images from mail-in buybacks are not included. The company emailed affected members in stages from October 15 (sending to every address it could confirm as deliverable finished on October 22) and asks them to change their passwords for the official online store and app. On October 23 it announced a web lookup on the Bookoff member site that lets members sign in and check whether they are affected, and said it had opened a dedicated toll-free line on October 22. It is withholding details of the cause, saying they could invite further attacks. This site's take: anyone who registered through the app or online store should change the password through the official app or a website they open themselves, change it on any other service that shares it, and not open links in emails or texts claiming to be Bookoff.
Malware on a Daiichikosho Contractor's PC (About 8.72 Million Records): Big Echo and Other Members' Names, Birth Dates and Phone Numbers May Have Leaked — What to Do
On October 8, 2026, Daiichikosho Co., Ltd. announced that a company to which it outsources the handling of personal information had reported that one PC used by one of its employees was infected with malware, and that Daiichikosho's customer information may have leaked. Personal data related to the outsourced work had been temporarily stored on that PC. The records concern about 8,631,000 customers who registered as members or made reservations at the company's stores (Big Echo, Mega Big, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining, after removing duplicates) and about 93,000 employees, about 8,724,000 in total. The items are name (registered name), gender, date of birth, email address and phone number. Passwords were not included, and the company says points cannot be used with this information alone. No actual external leak, misuse or impact on the company's own systems had been confirmed. A toll-free inquiry line opened on October 9. In an addition dated October 26, the company said it is contacting customers who may be affected individually, in turn, by SMS and other means, and published the sender numbers (NTT Docomo, au and Rakuten Mobile: 05036052572, which may appear as +815036052572; SoftBank: 247473). It says this contact does not mean a new leak has been found, and that no actual external leak or misuse resulting from the incident has been confirmed. It also says the sender number alone does not guarantee that an SMS is genuine. This site's take: do not open links in messages claiming to be Big Echo or DAM about coupons, membership renewal or points, or in texts claiming to be from Daiichikosho; check in the official app or a site you open yourself, and stop using your birth date as a PIN or password.
JR East, VIEW Card and JR Kyushu Possible Email Leak (2026): What to Do
On October 9, 2026, East Japan Railway Company (JR East), VIEW Card Co., Ltd. and Kyushu Railway Company (JR Kyushu) each announced that the external service they use to send email to members had been affected by unauthorized access at a cloud service provider, and that they could not rule out that members' email addresses and other data had been viewed or obtained. The numbers are, at most, about 1.67 million eki-net members and about 390,000 Otona no Kyujitsu Club members (JR East); about 4.03 million email addresses of VIEW's NET users (VIEW Card); and, at most, about 1.3 million JR Kyushu Web members (JR Kyushu). For eki-net, VIEW's NET and JR Kyushu Web members only email addresses are involved; for Otona no Kyujitsu Club members, the member number, credit card expiry date and date of birth are involved as well. Names, addresses, phone numbers and card numbers are excluded. The cloud service provider has said that the outage which began early on October 7 was caused by a ransomware attack by a third party. In its fifth report on October 14, the provider said it had found no trace of data in virtual servers in the affected area being viewed or taken out, and concluded that no data leaked externally. On October 15, after receiving those findings, JR Kyushu announced that no leak of JR Kyushu Web members' email addresses had been confirmed. JR East's eki-net site also says that on October 15 the email delivery service company reported that it had concluded no personal data of eki-net members leaked (checked October 19). For Otona no Kyujitsu Club members and VIEW Card, this site could find no follow-up as of October 19 (checked on each company's site). This site's take: JR Kyushu said no leak was confirmed, and eki-net says it was told no personal data of eki-net members leaked. Even so, fake emails using this incident as a pretext may still arrive. Do not log in from links in emails; check through the official app or a bookmark you saved yourself.
Unauthorized Access to Lawson ID (2,155,345 Records): Email Addresses and Names Leaked — What Members and App Reservation Users Should Do
On October 8, 2026, Lawson, Inc. announced that unauthorized third-party access to its account service Lawson ID, and to Lawson App Reservation (a service for reserving and paying for seasonal event products in the app), had leaked personal data. An investigation on October 7 found that Lawson ID was accessed without authorization from September 12 to 14 and App Reservation on September 17. The company confirmed leaks of 2,155,345 Lawson ID records (email address and name, plus gender, phone number, address and newsletter preference where these had been entered, for example when applying for a giveaway with Lawson ID) and 26 App Reservation records (name, phone number and part of the credit card number). The company says a system related to the Lawson app was misused, and that a security mechanism meant to show information to the user themselves in the app was accessed without authorization by a third party. Passwords are not among the listed items. As of October 8 no misuse or secondary harm had been confirmed, and on October 13 it added lawson_id@id.lawson.jp as a sender address for the individual notification emails. This site's take: Lawson ID holders should not open links in emails or texts claiming to be Lawson or offering points or coupons, and should check through the official app they open themselves.
NewsPicks Data Breach (Card Holder Names and Last Digits, up to 362,000 Records): What Leaked Through an Internal Admin Tool and What Users Should Do
On October 8, 2026, Uzabase, Inc. announced that an admin tool used in the operation of its news service NewsPicks had been accessed without authorization by a third party, and that some users' personal data may have leaked. Its second notice on October 9 said the intrusion exploited a vulnerability in that admin tool, and gave maximum estimated counts per item: part of the card data used for web payments (card holder name and the last 3 or 4 digits of the card number, etc.) 362,000; email addresses 323,000; job-level category 273,000; affiliation 65,000; names 59,000; and others. The company says full card numbers and security codes were never stored on its systems and did not leak, and that no password leak has been confirmed. No secondary damage has been confirmed. This site's take: a message that quotes your card's last digits or your employer is not proof that it is genuine. Do not open links, check through the official app or a site you open yourself, and keep an eye on your card statements.
skyticket (Adventure Inc.) Data Breach (About 14.64 Million Records): Passwords, Refund Bank Details and Some Users' Card Data Exposed — What Users Should Do Today
On October 9, 2026, Adventure Inc. announced three separate incidents of unauthorized access, each by a different route, affecting its travel comparison and booking site skyticket. In the first, an administrative function was misused and used as a starting point to reach other servers and data stored in the cloud; about 14.64 million records leaked, including names (also as written in passports), dates of birth, email addresses, phone numbers, addresses and the remitter name used for bank transfers, and about 4.13 million of them included hashed member passwords. In the second, a vulnerability in a business management system was exploited, and 17,780 records (including duplicates, with more still being counted) containing refund bank account details leaked or may have leaked. In the third, a bus booking completion page could be displayed without logging in, and about 12,000 bookings were or may have been viewed. The company first said card numbers were not among the leaked data, but corrected this in a second notice on October 16: the card number, cardholder name and expiry date (for some, the number only; no security codes) of up to 6,140 people who registered or used a credit card to pay the "skyticket Premium" membership fee between February 2017 and June 2018 leaked in the first incident, along with member IDs, names and passwords for a welfare benefits service offered as a Premium perk. Passport images were not exposed, and as of the October 9 notice the only confirmed secondary harm was one unauthorized login to a member account (the second notice does not say whether the leaked card data has been misused). This site's take: members should change their password from the official site or app today, change it anywhere it was reused, check card statements from October onward if they registered or used a card for the Premium fee in that period, ignore messages about refunds, compensation or booking changes, and never give anyone a bank PIN or one-time code.
Card-Stealing Program on the PhotoGoods (Daiko Printing) Payment Page: What People Who Paid Between August 6 and September 11 Should Do
On September 16, 2026, Daiko Printing Co., Ltd. announced unauthorized third-party access to PhotoGoods (photo-goods.com), the service it runs, and said a program able to illegally capture credit card data entered on the payment page had been installed. The program was in place from August 6 until it was removed on September 11. People who entered a card on the payment page in that period (including those who did not complete a purchase) may have had their card number, expiry date and security code exposed, along with name, address, phone number, email address and information derived from their member password (stored in a converted form). The company says it confirmed unauthorized access through system vulnerabilities and abuse of a file-upload function. The number of affected people and the actual scope are under investigation, and there was no follow-up notice as of October 7. This site's take: anyone who entered a card in that period should ask the card issuer to change the number, change the password on any other service that shares the PhotoGoods password, and ignore links in 'apology' or 'refund' messages.
Asahi Kasei Therapeutics healthcare-professional site breach (about 514,000 people): what may have leaked and what doctors, pharmacists and nurses should do
On October 6, 2026, Asahi Kasei Therapeutics Co. Ltd., the pharmaceutical arm of Japan's Asahi Kasei group, announced that Pharma DIGITAL, its information site for healthcare professionals, had been hit by a cyberattack and that personal data in its member database may have been viewed or taken. The data covers about 514,000 healthcare professionals (name, facility name, facility address, job type, specialty and more), about 44,000 of them with email addresses and more in addition to those items, and about 700 company employees (name, email address, photo). The company learned of the access from the site's contractor on October 2 and shut the site down. It says it did not store credit card data or sensitive personal data such as medical history, and as of October 6 no misuse had been found. This site's take: expect fake emails posing as drug companies, academic societies or seminar invitations. Never log in from email links, and change any password you reused from this site.
Daiwa Securities vendor breach (about 110,000 customers, 220,000 records): what may have leaked and what customers should do
On October 5, 2026, Daiwa Securities Co. Ltd., one of Japan's largest brokerages, announced that the server of a vendor whose service it uses to manage customers' online inquiries had been accessed without authorization. Names, email addresses, account numbers and other information about 110,000 customers, held in inquiry records, may have leaked; including inquiries that identify no one, about 220,000 records are involved. The access took place between about 8:33 p.m. on October 2 and 8:01 a.m. on October 3, and no unauthorized access to Daiwa's own systems was found. The company says this data cannot be used to access accounts or trade, including through online trading, and as of October 5 no fraudulent trades and no publication or spread of the data had been found. On October 6 the vendor side published its own notice: inquiry data stored in the environments of up to five client companies on the same server, up to 713,126 records counted per inquiry, may have been taken. Citing the same vendor, Citizen Watch (about 100,000 people), Sompo Japan (about 60,000 records counted per inquiry) and ORIX Life Insurance (about 26,500 records) have also announced that their customer data may have leaked. This site's take: expect fake messages that know your account number and your past inquiries. Never log in from links in emails or texts; sign in from a bookmark or the official app and check your message box and operation history there.
Denmark CPR register misuse (about 8.8 million people): what was taken, and what residents and organisations that grant lookup access should do
On October 5, 2026, Denmark's Ministry of Research, Education and Digitalisation announced that unauthorized persons had misused a private Danish company's legitimate access to look up data in the civil registration system (CPR), and obtained names, addresses, CPR numbers and more for about 8.8 million registered people, including living, emigrated and deceased persons. The CPR holds about 11 million people. The CPR administration noticed on the evening of October 2 that there had been irregular activity during September, and stopped the company's access. Names and addresses of people registered with name and address protection were not included. According to Danish media, on October 9 the CPR administration reminded the 1,039 companies with lookup access of its security rules, and the minister acknowledged that security had not been good enough. Media also report that the password 123456 was used on lookup accounts; this has not been officially confirmed. This site's take: a caller who knows your name, address and CPR number may still be a fraudster. Residents should never share MitID details or one-time codes, and businesses should stop treating these three items as proof of identity.
Japan e-Tax Gift Tax Data Exposure (2026): Who Is Affected
On October 2, 2026, Japan's National Tax Agency (NTA) announced that gift tax returns and related documents of 79 people could be viewed by other users in MyPage on e-Tax, the national online tax filing and payment system. According to reports, this lasted from 8:30 on September 24 to midnight, and from 4:00 to 15:58 on September 25. Nineteen users may actually have viewed someone else's return, and personal information of 203 people in total — filers plus the donors and tax accountants named in the returns — may have been seen. The cause was a defect introduced by a September 24 update that expanded MyPage's gift tax information feature; it has been fixed. NTA regional bureau and tax office staff contacted affected people individually, and the 19 viewers were asked to keep the information confidential and delete it. No sign of saving or secondary harm has been found. The NTA says this is unrelated to problems with its new core system (KSK2). This site's take: affected people are being contacted by the tax office. For any call or text that uses this incident as a reason, follow the NTA's advice: hang up and call back on a tax office number you look up yourself. Developers should test, on every change, that requesting user B's data while logged in as user A is refused.
infoQ survey site breach (894,082 records): what leaked and what members should do
On October 5, 2026, GMO Research & AI, Inc. announced that its survey site infoQ had been accessed by a third party without authorization and that members' personal data had been taken out. In its second report on October 14, it confirmed the number of records taken out as 894,082 (the first report said up to 948,498). The items are name, name reading (furigana), gender, date of birth, email address, home address, phone number, encrypted password, member ID, and other registration data such as nickname and point balance. The company does not hold credit card data or My Number (Japan's national ID number). In addition, 611 point exchanges worth 2,869,500 yen were converted into Amazon gift codes without the members' consent, and the company says it will compensate them in full (credited to accounts when the service resumes). The company invalidated all members' passwords on October 7. The company says the intruder exploited a vulnerability in software used on its site. This site's take: with birth dates and addresses included, convincing fake messages are easy to make. Change the password on any service that shares your infoQ password, turn on two-step verification for your email account, and do not open links in messages claiming to be infoQ.
MrMax app and online store breach (up to about 1.74 million people): names, emails and phone numbers leaked — what members should do
On October 6, 2026, MrMax Co., Ltd., a Japanese discount-store chain, announced that the servers of the MrMax app and online store it runs had been accessed without authorization by a third party, and that part of its members' personal data had leaked. Up to 1,735,154 people registered as members as of October 3, 2026 are affected. The items are member ID, name, email address and phone number (varying with what each member registered). The company says it confirmed that addresses, dates of birth, credit card data, passwords and purchase history did not leak. It noticed suspicious access on the evening of October 3, suspended the service immediately and blocked outside access the same day. The company says a third party misused a function of the software that makes up the service to get into the server. No harm from misuse of the data had been confirmed at the time of the notice. This site's take: expect convincing emails, texts and calls that use your name. Do not open their links, check in the official app or site you open yourself, and never give out passwords or card numbers.
Osaka Metropolitan University ransomware attack (personal data leak confirmed from a contractor's cloud storage): what students, alumni, parents and staff should do
Osaka Metropolitan University in Japan says a large-scale failure hit its virtualization platform in the early hours of October 2, 2026, taking down the campus network, OMU Mail, its websites, and its academic, finance, payroll and library systems. At a press conference on October 5 it said it had concluded the cause was a ransomware attack. Classes were cancelled from October 2 to 8, and in its fourth notice on October 8 the university announced that in-person classes would resume at all campuses on October 9. In its fifth notice on October 21, the university said the contractor that maintains and operates its core systems had reported that a company it subcontracts to was hit by a cyberattack in late September 2026, and that the university's systems were accessed without authorization using the subcontractor's legitimate account. The contractor also reported that university-related personal data and system information stored in cloud storage the contractor used had been confirmed as leaked; the contents and numbers are still being checked with the contractor. The data the university flagged at its press conference as possibly leaked (about 130,000 records related to the academic affairs system, among others) sits in the university's own virtualization platform and is separate; whether it leaked is still under investigation. On October 23 the university opened a help desk for alumni and parents. News reports say about 500 servers stopped and much of the backup data was also encrypted. This site's take: check any message claiming to be from the university on the OMU Entrance page, not through links in emails or texts, and report suspicious contact to the university's help desk. Organizations should list the accounts their contractors and subcontractors use, and keep at least one backup that the production admin accounts cannot delete.
Rakuten Drive breach (stored data of 15,382 accounts): what was accessed and what users should do
On October 6, 2026, the cloud storage service Rakuten Drive announced that a third party had illegitimately obtained the credentials of a management account for part of the systems the service uses, accessed the systems, and obtained and viewed information. Affected were the stored data (including photos and documents) of 15,382 accounts between January 29 and September 17, 2026; the account name, display name and profile image URL of 687 accounts on August 27; and, on the same day, the account name, display name, encrypted password, the string added during password encryption and profile image URL of 313 accounts. The service says no secondary damage has been confirmed and that it will notify affected users individually by email or other means. In an August 13 update about suspicious push notifications seen on July 30, the service had said that unauthorized third-party access to stored data had not been confirmed at that time. This site's take: unlike a password, stored files cannot be taken back. Check for a notice, treat any ID documents or contracts you stored as seen, change your password, and do not respond to messages, payment demands or threats claiming to be Rakuten Drive.
Yakiniku King app breach (about 10.79 million records): names, phone numbers and emails leaked — what members should do
On October 5, 2026, Monogatari Corporation, which runs the Yakiniku King grill-restaurant chain in Japan, announced that a third party had gained unauthorized access to the member-management system of the official Yakiniku King app. Of 10,808,784 app registrations, 10,788,963 records were leaked: member number, name (the name registered in the app), email address and phone number. The company confirmed the unauthorized access on October 2, cut off communications and put defensive measures in place, and confirmed the leak on October 3. Login passwords, dates of birth, gender, postal codes and store-visit history including points were not leaked, and the company does not hold payment data such as credit cards. No publication or misuse of the leaked data has been found. On October 20 the company announced further measures: it said the intermittent unauthorized access by an outside third party began at 9:00 a.m. on October 2, and that in the first half of 2027 it plans to move the 11 official apps run by its group, including Yakiniku King, to a new system that does not hold names or phone numbers. It will keep collecting email addresses. It has reported the matter to the police and is proceeding with its report to the Personal Information Protection Commission. Details of the cause have not been published. This site's take: almost every app member is affected, and the most likely next step is emails, texts and calls posing as Yakiniku King with coupon, point or refund offers. Do not open their links; check in the official app you open yourself, and never enter card details.
Abahouse data breach: order details may have leaked — how to handle fake refund emails
On October 2, 2026, Abahouse International Co., Ltd. announced that unauthorized access to its internal systems, believed to be by a third party overseas, may have leaked member IDs, names, addresses, phone numbers, email addresses, dates of birth, gender and order details (order date and time, product names, amounts and delivery addresses). Because it cannot fully identify the scope of data taken, the company emailed customers it judged may be affected based on purchase history and other records on October 2. It deletes member data one month after a member leaves, but keeps past order records for a period for legal and accounting reasons, and says it cannot rule out that those orders were accessed; former members received the same email. No count has been announced. Card numbers and security codes are handled by a payment processor, and no leak of them has been confirmed. The breach came to light when several customers reported suspicious refund emails that matched their real orders. In a follow-up on October 9, the company said the intrusion route had been cut off with no further spread confirmed, that it had filed a damage report with the police, and that no reports of financial loss had been received. The scope of data taken and the details of the cause are still being investigated with outside specialists. This site's take: a message that gets your order right is not proof it is genuine. Do not follow links or move to LINE from 'refund' or 'out-of-stock' emails; check your order history in My Page instead.
AdaptHealth data breach (about 4.1 million people): health insurance and health data exposed — patients should check benefit statements and calls
AdaptHealth, a US provider of home medical equipment, says a June 5, 2026 cyberattack exposed patients' names, contact information, demographic information, health insurance information and health information. Its report to the US Department of Health and Human Services (HHS) covers 4,115,802 people. According to the company, Social Security numbers (SSNs), financial account and card information were not involved, and it is not aware of any misuse. Its July 2 report to the Securities and Exchange Commission (SEC) says the cause was a social engineering attack (tricking people into giving information or access) that compromised a user session associated with a third-party contractor; a stored password file associated with insurance billing was taken and external electronic health record portals were accessed. Our view: with no SSNs, the priority is reading Explanation of Benefits statements for care or equipment you did not receive, and not giving insurance numbers to callers about supply reorders. For organizations, the lesson is how far one contractor account can reach.
EPARK Relax & Esthe "PeakManager" data breach (about 22.18M records): health notes leaked too — what salon customers should do
EPARK Relax & Esthe Co., Ltd. announced that the database of PeakManager, the booking and customer-management system it provides to salons, was accessed without authorization and customer data was transferred outside. Its first notice (July 31, 2026) gave about 33 million records; after removing duplicates, its second notice (September 24) gave about 22.18 million records, which it says cannot be converted into a number of people. The leaked items are name and its phonetic reading, date of birth, gender, address, phone number, email address and a notes field where salons recorded handover notes for treatments, partly including health conditions and other sensitive personal information. The first notice also said encrypted passwords may have leaked and asked customers to change them. This site's take: PeakManager is each salon's own customer ledger, so people who never used EPARK can still be affected if they gave a salon their name or contact details. Do not respond to messages claiming to be from a salon or the company, and change your My Page password and anywhere you reused it.
Breaches at 7 Korean financial institutions (Shinhan Bank reports about 25,000 customers): income, loan limits and resident registration numbers leaked — what customers should do
Between October 1 and 4, 2026, seven South Korean financial institutions announced or reported data leaks caused by unauthorized outside access. Customer data: Shinhan Bank about 25,000 people (name, phone number, annual income, loan limit and more; resident registration numbers in 66 cases), KB Kookmin Bank 119 people (incl. encrypted resident registration numbers), Hana Bank 89 people (seven items incl. resident registration number), Yegaram Savings Bank about 40,000 people (estimate). According to reports, Welcome Savings Bank leaked up to about 2,200 records (estimate) on contact persons at corporate clients, Hyundai Capital leaked data on 146 mortgage loan agents (incl. resident registration numbers), and BNK Busan Bank leaked data on 11 staff of an outside development contractor. On October 4, President Lee Jae-myung ordered a thorough investigation, and regulators asked about 500 financial institutions for emergency checks. The same day, the chairman of the Financial Services Commission reportedly said AI-assisted attacks could not be ruled out; this is not a confirmed cause. Police reportedly opened a formal investigation on October 5, and the Financial Services Commission issued a consumer alert (caution level) on October 6. No common cause has been officially confirmed. This site's take: a caller who knows your real income or loan limit is not proof the call comes from your bank. Hang up and call back on the main number you look up yourself.
Lashinbang data breach: ID document numbers and payout bank details may have leaked (no ID images) — what sellers should do
On October 1, 2026, Lashinbang Co., Ltd. announced that unauthorized access to a service it operates, between September 14 and 16, 2026, may have leaked names, addresses, phone numbers, email addresses, dates of birth and occupations, along with the type and number of identity documents, the bank name, branch, account number and account holder entered when applying for a buyback (when customers sell items to the shop), images of buyback consent forms, and buyback and order details. The company says no credit card information or passwords leaked and that it does not collect My Number (Japan's individual number). In an addendum on October 9, it added that images of identity documents, including driver's licences, did not leak. The notice also gained a section saying the people affected are those who received an individual email from the company. As of October 10, 2026, the count and the cause have not been announced. This site's take: an account number and holder name alone cannot be used to withdraw money, but do not respond to contacts that use your account details, ID number or real buyback details to look genuine. Never give anyone a PIN, login or authentication code, and if your ID document number leaked, consider a self-declaration with Japan's credit bureaus.
LMU Munich Data Breach (2026): Student Data, Risks and Response
On September 19, 2026, Ludwig-Maximilians-Universität München (LMU) said an unauthorized actor had accessed an IT system holding standing data on student enrolments and that it must assume the data was taken. Its September 28 update put the scope at about 600,000 records in the admission system, covering current and former students over roughly 50 years. The data includes names, dates of birth, addresses, phone numbers and email addresses; records from 2005 onward include bank details (IBAN and account holder), and some include health insurance numbers, BAföG (German state student aid) numbers and reasons for leave of absence. Passwords, grades and exam information were not affected. The Bavarian State Criminal Police Office is investigating. The cause has not been disclosed. This site's take: the serious part is that bank details of people who graduated years ago were still in the system. Anyone who gave LMU a German or EU account should check their statements and reverse any direct debit they do not recognize, and should not open links in emails claiming to be from LMU.
Metabase vulnerability breaches (Trezor 80,689 customers and others): what leaked, and what affected people and analytics-tool operators should do
In August 2026 it emerged that an unauthenticated SQL injection in the BI (business intelligence) and analytics tool Metabase (CVE-2026-72898, CVSS 10.0) had been exploited before a fix was released. Metabase says fewer than 3% of its cloud customers and some internet-reachable self-hosted instances were compromised. Organizations that disclosed impact include Trezor, which sells cryptocurrency hardware wallets (80,689 customers' names, addresses, phone numbers and email addresses, via its logistics partner's analytics environment), laptop maker Framework, automation tool n8n, Anaconda's Kilo Code and wallet-infrastructure provider Privy. This site's take: what leaked matches what the compromised analytics tool could read at the time. Trezor customers should never type or share their wallet backup (recovery seed) and should assume their home address is known, so they should not follow instructions in letters or calls either. Operators of analytics tools should patch, and also limit the data the tool can read to the columns analysis actually needs.
Murauchi.com data breach (7.7 million records): names, addresses and phone numbers leaked — past customers should watch for scam calls and mail
On September 15, 2026, Murauchi.com Co., Ltd. announced that unauthorized access, which began with the exploitation of a vulnerability in part of its web system, led to 7,716,811 records of customer personal data being taken out (the first notice was on July 24). The data includes names, addresses and phone numbers, plus email addresses, dates of birth and gender for some people. Card and other payment data and login IDs and passwords are kept in separate systems and were not affected. The company has not said how many years of data were involved or whether former members are included. This site's take: the main risk is that real names, home addresses and phone numbers leaked together. Assume you may be affected even if you bought from the shop only once, years ago, and never hand over personal data or money in response to calls, mail or texts claiming to be from the company, an online mall or a card issuer.
MyDr Patient Data Breach in Poland (Up to 18.8 Million): PESEL, Health Data and Contacts Exposed — What Affected People Should Do
In August 2026, MyDr sp. z o.o., whose electronic medical records software is used by more than 12,000 healthcare facilities in Poland, disclosed that an external criminal act let a third party copy the contents of a database stored in its cloud. The data is mainly historical, from before April 12, 2024, and Poland's Ministry of Digital Affairs said up to 18.8 million people and over 12,000 facilities may be affected. According to the company, the items include name, address, contact details, PESEL (national identification number), health data, social insurance information and employer details, though not every item applies to every patient. The cause and the route of entry have not been disclosed. The government lets people check whether their PESEL is involved at bezpiecznedane.gov.pl and urges everyone to reserve their PESEL (zastrzeżenie PESEL). This site's take: when one software vendor holds patient data for thousands of facilities, a single breach reaches all of them, and this time what was copied was a backup more than two years old. Affected people should check, reserve their PESEL and prepare for threats that mention their health; operators should confirm that old backups are protected as well as production.
Seicomart app breach (about 575,000 members): names, addresses and birth dates viewed — what members should do
On September 29, 2026, Seicomart Co., Ltd., which runs the Seicomart convenience-store chain in Japan, announced that a third party had gained unauthorized access to the server holding member data by way of the server behind its Seicomart smartphone app. Its fourth notice on October 5 said the affected accounts are 574,647 of the Club members who have registered with the app, and that people who left the Club Card program by September 24 are not included. The items viewed are surname and given name, gender, date of birth, address, phone number, email address, and the dates the person joined and left the Club Card program. Password data and purchase history were not leaked, and the company does not hold credit card data. From October 5 the company is telling every app member, through the app's notices, whether they are affected. It has ended the app and web functions for new sign-ups, viewing and changing member details, and changing registered cards; requests now go through stores or a form. The cause has not been disclosed. This site's take: what was exposed is a set of personal details that cannot be changed, and the most likely next step is convincing emails, texts and calls that pose as the company. Check the app's notices to see whether you are affected, do not follow links or instructions in such messages, and stop using your date of birth as a PIN or as an answer to identity checks.
E-store ShopServe data breach (up to 8.85 million records): partial card numbers and shop passwords leaked — what buyers and shop owners should do
On August 1 and 2, 2026, E-store Co., Ltd. announced that a third party had run a malicious program on the servers of ShopServe, its service for building online shops, and sent buyer data out between May 21 and August 1, 2026. Up to 8,853,839 records (duplicates possible) leaked: buyers' names, addresses, phone numbers, email addresses and workplaces; encrypted member IDs and passwords; cardholder names, part of the card number (first 6 and last 4 digits) and expiry dates; and, for merchants, login IDs and passwords for the admin panel, mail system and FTP, plus payout bank account details. Security codes were not stored and were not affected, and no secondary damage had been reported as of August 2. This site's take: most buyers shopped on each store's own site without ever hearing the name ShopServe. Even if you cannot tell which shop it was, treat messages that quote your real order details or the last four digits of your card with suspicion, check your card statements, and change reused passwords. Merchants should change their admin, mail and FTP passwords and check their shop pages for changes they did not make.
TEMAIRAZU Unauthorized Access (2026): Guest and Hotel Guidance
On September 28, 2026, Temairazu, Inc. announced unauthorized access to its TEMAIRAZU Series, a system hotels and ryokan use to manage bookings from many sources in one place. From late at night on September 21, guests of properties using the system began receiving suspicious messages via messaging apps such as WhatsApp, by email and by SMS. The messages appeared to know booking details and, under pretexts such as advance check-in or keeping a reservation valid, pushed recipients to external websites to enter card details or pay. In its second report of October 7 (English version October 8), the company listed the information that may have been viewed or obtained by a third party: guest names, telephone numbers, email addresses, accommodation property names, check-in dates, check-out dates and accommodation charges. It does not retain credit card information or login credentials for booking sites. In a timely disclosure to investors on October 9, it put the number of people whose booking information is involved at up to about 4.45 million and said it had commissioned an external security firm to investigate. According to notices from hotels using the system, the cause was a security problem in part of an installed product the company provided in the past, fixed on September 26. This site's take: people who booked through travel sites may be affected too. If a message claiming to be your hotel asks you to re-enter card details or pay, refuse even if the details are correct, and check through the booking site's official app or the phone number on the hotel's official website.
Yamato and Sagawa Data Breaches (2026): Affected Users and Response
Yamato Transport found unauthorized access to its Kuroneko deferred-payment service on September 28, 2026, and Sagawa Express found unauthorized access to its parcel tracking service on September 30. On October 1-2, both said personal data may have leaked. These are separate incidents, and neither company mentions a connection. In its fourth notice on October 16, Yamato said data had been taken: about 5.26 million records of deferred-payment users (name, address, phone number, email address, item details and more, from October 1, 2018 to September 28, 2026), about 50,000 records of delivery-address information of some users, and about 4,100 records of participating shops. Billing amounts, outstanding balances and employee names were not found to have been taken. In its fifth notice on October 23, Sagawa said names, addresses and phone numbers of senders and recipients of parcels it handled from June 21 to September 30, 2026 (about 100 days), among other data, may have leaked, and gave the maximum count as about 53.23 million records (duplicates included; not the number of people). Parcels sent with handwritten waybills are not included. Neither breach includes credit card data or passwords. Yamato restarted the deferred-payment service on October 9 and extended payment deadlines by 17 days; Sagawa restarted its parcel tracking service on October 23, while eight other web services, including online booking, remain stopped. This site's take: with Sagawa, you can be affected just by having received a parcel, even if you never used the company yourself. Assume fake missed-delivery notices and payment demands may now carry your real name and address, the fact that you received a parcel, or what you bought. Do not open links in such messages; check in the official app or in the order history of the shop you bought from.
Yellow Hat data breach (up to about 1.8 million people): names, phone numbers and emails may have leaked — what members should do
On August 28, 2026, Yellow Hat Ltd., a Japanese car-parts and car-service retailer, announced that its online work reservation system, used to book jobs at its stores, had been attacked by a malicious program, and that the names, phone numbers, email addresses and member numbers of up to 1,801,499 people may have leaked. The company detected the attack on the morning of August 18, cut the system off from outside connections and shut it down. Credit card data, passwords and vehicle information are not held in this system, so the company says they were not leaked. Separately, in April 2026, the group company 2rinkan Yellow Hat had a different breach that exposed data on about 3.18 million people, including app passwords. This site's take: what may have leaked is exactly the data needed to contact you directly. Do not reply to calls, texts or emails about bookings, inspections or apologies; check through the official website or the store instead.
AssuranceAmerica Data Breach (About 7 Million): What to Do When Your Driver's License Number Leaks
On July 10, 2026, US auto insurer AssuranceAmerica notified people that, following malicious activity targeting one of its employees on March 16, an unauthorized third party accessed part of its IT environment and copied certain data files. The Indiana Attorney General's breach list puts the total affected at 6,998,886. Depending on the person, the data included name, contact information, auto policy or account information, driver or vehicle information, claims information and driver's license number, and for a limited number of people a Tax ID or Social Security number. In the US a driver's license number is used as an identity field on credit, insurance and public-benefit applications. A credit freeze alone leaves gaps, so also tell your state motor vehicle agency that your number was exposed.
Basic-Fit Member Data Breach (Bank Details and Visit Records): 'Payment Failed' Scams and What Members Should Do
On April 13, 2026 Basic-Fit disclosed unauthorized access to the system that records members' visits to its clubs. The company says the access was stopped within minutes, but some data on active members in several countries was downloaded: membership information, name and address, email, phone number, date of birth and bank account details; no passwords were accessed. Basic-Fit told Reuters about 1 million members were affected, in six countries including the Netherlands and Spain. This site's take: gym fees involve recurring payments under the contract, and for members using SEPA direct debit (the euro-area standard for bank debits), a 'your payment failed' message mimics a real Basic-Fit process. Always check your membership status in the app, never through a link; watch for direct debits from creditors you don't recognise; and don't panic-reverse the legitimate gym fee.
Booking.com Reservation Data Breach: How to Spot Scam Messages Posing as Your Hotel
In April 2026 Booking.com notified guests that unauthorized third parties may have been able to access certain booking information, updated the PINs of the affected reservations, and said it had contained the issue. According to the notice and the company's spokesperson as reported, the information included booking details, names, email addresses, phone numbers and messages shared with properties; financial information was not accessed. The number affected and the cause were not disclosed. This site's take: a correct hotel name, date and price no longer prove anything. The test is whether a request matches the payment policy in the booking you open yourself in the official app. Refuse any request to re-enter card details, pay through a link, or make a transfer not in the policy.
CAMPFIRE Unauthorized Access: 225,846 Unique User Records at Risk — Actions for Users and Developers
According to CAMPFIRE, a GitHub credential issued by an employee was misused by a third party; information visible on GitHub was then used to obtain credentials for a cloud environment the company uses for internal business operations, and part of its management area was accessed. Names, addresses, phone numbers, email addresses and bank account details in 225,846 unique affected-user records (project owners, supporters, partners) may have leaked; credit card data was not involved. The service platform runs in a separate environment and no misuse or tampering was found there. Users should watch for messages about refunds or payout account confirmation and check bank statements. Developers and operators get two lessons. Customer data also lives in internal business environments even when production is well protected. And work tokens can end up on machines the company doesn't manage, so organization settings must limit how long a token stays valid and what it can access.
Carnival Data Breach: What Travellers Should Do When a Passport Number Leaks
Carnival Corporation, the parent of Carnival Cruise Line, says that on April 14, 2026 its IT security team identified unauthorized activity involving an employee's account: an unauthorized actor used social engineering to deceive an employee and gained access to a limited portion of its IT system. On April 22 the company determined that personal information had been copied. Its filing with the Maine Attorney General lists 5,995,277 people affected. The data varies by person and includes name, address, email address, phone number, date of birth and government-issued ID numbers such as driver's license and passport numbers. What leaked is a passport number, not the passport. The official lost-or-stolen process in the US (and in Japan) cancels the document itself and is meant for passports that are actually lost or stolen. The real risk is messages from people who seem to know your trip and your ID. US residents should freeze their credit. Everyone should ignore links in emails posing as the cruise line, and know when a passport really does need to be reported.
Cegedim Santé MLM Data Breach (2026): Patient Risks and Response
Cegedim Santé, the Cegedim Group subsidiary that publishes software for healthcare professionals in France, said on February 26, 2026 that at the end of 2025 it identified abnormal application request behaviour on the accounts of doctors using its MLM (MonLogicielMedical.com) software. Of the 3,800 doctors using MLM, 1,500 were affected, and personal data of patients in the MLM database was illegally accessed or extracted. The data comes from the patient's administrative file (name, gender, date of birth, phone number, address, email) and administrative comments written in free text at the doctor's discretion. For a very limited number of patients, those comments may have contained the doctor's personal notes about sensitive information. The company says structured medical records remained intact. France's Ministry of Health was reported to put the number of patients who may be concerned at about 15 million, with about 1% involving sensitive notes. When one cloud vendor stores the patient data of thousands of practices, a breach affects every practice using the software, not just one clinic. The most sensitive data sat in a field with the harmless-sounding label 'administrative comment'. Patients should prepare for impersonation and pressure messages. Clinics should check what goes into free-text fields and who would notice unusual activity on each doctor's account.
CHAEVI EV-Charging App Data Breach (298,000 Records): What Leaked and What Users Should Do
According to CHAEVI's notices of July 26 and July 30, 2026, an illegal external hacking attack on July 23 leaked a total of 298,333 personal data records: 164,858 email-only, 131,411 email plus password (encrypted), 1,235 email plus name and contact number (encrypted), gender, date of birth and more, and 829 with all of that plus the password (encrypted). CHAEVI says it does not collect or hold resident registration numbers, passport numbers, or card and account numbers, so none were leaked, and that while investigating it also found a separate leak from around January 2025, which is still under investigation. Charging history and location do not appear in the notices' list of leaked items. What scammers can most easily use is the email address, leaked unencrypted in every record, plus the fact that its owner uses an EV-charging app. Ignore emails and texts about charging fees, unpaid balances or compensation by default, and change your password starting with every other service where you reused it.
DentaQuest Data Breach: An MFA Code Handed Over to a Scammer, and What Members Should Do
DentaQuest, a US dental and vision benefits administrator, says unauthorized individuals accessed data on its network between May 17 and May 20, 2026. Its filing with the Washington State Attorney General says a social engineering attack tricked a single employee into providing credentials and a multifactor authentication code. The data includes names, addresses, dates of birth, Social Security numbers, member and health plan numbers, Medicaid and Medicare numbers, and dental or vision health information. Data elements vary by individual. The company told the Washington AG on August 3, 2026 that it was aware of more than 27.4 million people nationwide. An SSN cannot be changed, so members should freeze their credit at all three bureaus, get an IRS IP PIN and watch benefit statements. For organizations, the lesson is that any MFA a person can read out or type in can also be handed over; phishing-resistant MFA (passkeys, FIDO2 security keys) and a help desk that verifies callers are what prevent this.
Endesa Data Breach (ID and Bank Account Numbers): Handling Scam Calls That Know Your Contract
Endesa Energía told customers (around January 12, 2026) that a malicious actor gained unauthorized access to its commercial platform and may have exfiltrated basic identification data, contact details, national ID (DNI) numbers, energy contract data and, in some cases, IBANs; passwords were not affected. Endesa reported the incident to the Spanish Data Protection Agency (AEPD) and has not published how many customers were affected. This is exactly the kind of data that makes the long-running energy phone scam ('tariff change', 'supply cut-off') believable: a caller who already knows your DNI and your contract doesn't sound like a scammer. Knowing your details proves nothing, so hang up and call the official number yourself. And because an IBAN can be used for direct debits, check your statements: a debit you never authorized can be refunded for up to 13 months.
ANTS (France Titres) Data Breach (2026): Affected Accounts and Response
France Titres, the French national agency for secure documents (ANTS), detected on April 15, 2026 a security incident that may have exposed data from individual and professional accounts on its ants.gouv.fr portal. On April 21 the Interior Ministry said about 11.7 million accounts may be affected. In its answer published May 13, the government said data had been extracted from 11.67 million individual and professional accounts. The data includes login ID, title, surname and first names, email address, date of birth and a unique account ID, and for some accounts a postal address, place of birth and phone number. According to the government, attachments submitted with applications and biometric data are not included. The government asked users to change their password at their next login and to be very careful with suspicious texts, calls and emails that appear to come from ANTS. ANTS put its application pages into maintenance from April 24 and says two-step authentication has been in place since April 29. What leaked is not the ID documents themselves but the fact that a person has dealt with ID, licence or registration paperwork, which is exactly what a convincing ANTS or 'permis de conduire' scam needs. There is no need to replace your documents; the habit that works is never using a link in a message and opening ants.gouv.fr yourself.
Four Government Data Breaches of 2026 (US DoD, Illinois, Latvia, French Tax Authority): What Citizens Can Do
In 2026, government agencies in the US, Latvia and France lost control of citizens' personal data. Lining up the agencies' own accounts, there were three ways in: a wrong sharing setting (Illinois DHS's internal maps), a vulnerable system (the DoD's DMDC file-sharing system, a CSDD web application), and impersonated credentials of staff and an authorized third party (France's DGFiP). When the data holder is the state, 'stop using the service' isn't an option. A citizen's defense shifts to four things that work after a leak: verify notices through official channels, protect the logins to your tax and benefit accounts, call back on a number you look up yourself, and use your right of access to learn what was held and what leaked.
Canvas (Instructure) Data Breach: Course Enrolments and Messages Leaked — What Students, Teachers and Schools Should Do
According to Instructure, the company behind the Canvas learning management system (LMS), unauthorized activity was detected on April 29, 2026, and usernames, email addresses, course names, enrollment information and messages were exfiltrated. The company says the fields involved are not designed to store passwords, dates of birth, health information, Social Security numbers, financial information, grades or disciplinary records. On May 7 the same actor used another vulnerability to alter pages shown after login. The field list looks mundane, but an email address plus which classes someone takes is exactly what a convincing school-themed scam needs, and messages are free text, so anything people typed there may be included. Verify contact only through your school's official channels; school IT should register security contacts, review logs, require MFA for admins and keep course data backed up outside the LMS.
Manchester Airports Group (MAG) Data Breach (2026): What to Check
In a statement dated August 27, 2026, Manchester Airports Group (MAG) said it was subject to a cyber security incident by an unauthorised third party in August 2026, and that customer data relating to car park, lounge and Fast Track bookings and in-airport Wi-Fi sign-ups at Manchester, London Stansted and East Midlands airports was obtained. The data includes email addresses, phone numbers, vehicle registrations and postcodes. MAG says neither it nor the system accessed holds customers' bank or payment details. MAG says that for people notified that they were affected, their data was made publicly available. According to press reports, a MAG spokesperson put the number affected at roughly 8.7 million. Operational airport systems were not involved. Contact details combined with a vehicle registration or postcode can make a fraudulent message seem more convincing. Whatever a 'refund', 'booking problem' or 'parking fine' message says, don't follow its link; open the airport's official Manage Booking page yourself. MAG says changes and cancellations there are free.
Mathspace Data Breach (About 1.08 Million Students, Parents and Staff): What Parents and Schools Should Do
In a blog post dated September 5, 2026 (updated September 8), maths learning platform Mathspace said attackers exploited a security vulnerability in its self-hosted internal reporting system and downloaded information on students, parents or guardians, school staff and Mathspace staff. 1,079,819 people in Australia and New Zealand were affected. The data includes user ID, username, first and last name, email address, country, time zone, user type, email-verification status, last-active date, last-login date and date joined. The company says passwords (including hashes), authentication tokens, SSO credentials, academic records and results were not exposed. According to Mathspace, the software's developer published a critical advisory and patch on August 6, its own vulnerability-notification process did not escalate it, unauthorised access dated back to August 10, and data was downloaded on August 27. This site's take: this is a roster that includes children's accounts, and it can be used to make fake messages claiming to be from Mathspace or your school look genuine. Families should agree with their children never to sign in from a link or share a code. Operators should treat internal reporting tools, which tend to be patched last, like production systems: patch them just as quickly, and check for signs of compromise after patching.
Medica Shuppan Ransomware Attack (About 641,000 People): What Medical Readers, Authors and Publishers Should Do
According to Medica Shuppan Co., Ltd., it detected a system failure on March 13, 2026 that turned out to be unauthorized access involving ransomware. Its May 13 investigation report says the starting point was a third party entering the internal network with legitimate account credentials. No definitive evidence was found that personal data was taken out, but the possibility cannot be fully ruled out, so data of about 641,000 people (may include duplicates) is treated as 'at risk of leakage'. The data includes readers' names, contact details and email addresses, authors' bank account numbers and employees' HR records. The company does not hold credit card data. Emails impersonating the company have also been seen. This site's take: a specialist publisher's customer list is a list of medical professionals with their workplaces, so check any message about study materials, seminars, academic societies or manuscript fees on the official site you open yourself, not via a link. Authors should watch for messages that mention their account number to seem genuine and then ask for a PIN or online banking details.
Medtronic Data Breach (About 3.83 Million): What Patients Using Its Devices Should Check
On April 24, 2026, medical device maker Medtronic disclosed that an unauthorized party had accessed data in certain of its corporate IT systems. Per its notice letter, the access ran from April 13 to April 19, 2026. The Indiana Attorney General's breach list shows 3,834,294 people affected nationwide, with notices sent on June 29. The information involved: name, contact information, date of birth, Social Security number and health-related information. The company says it has not identified any impact to product security or patient safety, including the ability of any Medtronic device to operate safely and deliver intended therapy. This site's take: device makers hold patient data so that product updates and safety notices can reach you. Don't stop using the device or drop your registration; protect the SSN with a credit freeze and an IRS IP PIN, and verify any call that mentions your device by calling back a number you already have.
Odido Data Breach (About 6.39 Million): What to Do When Your ID Number Leaks
On February 12, 2026, Dutch telecom operator Odido disclosed that customer data had been taken from a customer contact system it uses. Its spokesperson put the scale at about 6.2 million accounts; Odido's later FAQ says about 6.39 million people were affected (current and former customers of Odido and its brand Ben). Depending on the person, the data included name, address, mobile number, customer number, email, IBAN, date of birth, and ID document number and expiry; passwords, call records and ID scans were not included. This site's take: an ID number on its own cannot be used to sign contracts or complete procedures; it mainly identifies who you are. The Dutch Central Identity Fraud Reporting Centre (CMI) says this data alone cannot be used to take out a loan, open a bank account, sign a phone contract or apply for a new ID document, and neither replacing passports nor changing account numbers is recommended. The real danger is contact from someone who quotes your leaked numbers to seem genuine. And the broader lesson: ID numbers that businesses collect to verify identity can leak from those same businesses.
Quest Apartment Hotels Data Breach (About 1.99 Million): What Guests Should Do After Card and Passport Numbers Leaked
Australian serviced-apartment chain Quest Apartment Hotels identified unauthorised access to a database system on August 17, 2026, arising from a vulnerability through a third-party service provider, and disclosed it on August 19. Its September 16 update says information on approximately 1,991,613 customers (records from before June 2025) was affected, including 46,727 credit card numbers with CVV and 297,739 without CVV (both including expired cards), 104,268 passport and/or driver licence numbers, 225,300 vehicle registration numbers, 271 NDIS numbers and 46 Medicare card numbers. This site's take: if you were told a card with its CVV was affected, ask your card issuer about a replacement. The card industry standard PCI DSS does not allow card verification codes to be kept after authorization. Quest has not said why CVVs were in these records, and we make no judgment about compliance, but guests should know that a hotel's records can end up holding them.
APORITO Online Store (RIZAP) Possible Card Data Leak: What Customers and Online Shops Should Do
According to RIZAP Co., Ltd., a third party planted a malicious script on its APORITO Online Store, and the names, addresses, phone numbers and email addresses — plus card numbers, expiry dates and security codes — of people who placed an order or entered information between May 1 and August 5, 2026 may have been sent outside. The company found a suspicious outbound-transmission program on August 5 and closed the store that day; as of August 18 the store remained closed and the investigation continued. It says no misuse or actual leak has been confirmed. This site's take: with the security code in scope, watching statements is not enough; ask your card issuer to replace the number. The lesson for e-commerce operators is that not storing card data ('non-retention') does not stop a malicious program from being planted in the input page. On top of the five vulnerability measures required by Japan's Credit Card Security Guidelines, have a way to detect changes to your payment page.
Shun Hing Group Data Breach in Hong Kong (About 920,000): Handling Scams Posing as Repair or Warranty Calls
Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) received a data breach notification from Shun Hing Group on 23 March 2026 and has opened an investigation. On 2 July 2026, citing the latest information provided by the organisation, the PCPD said the personal data of more than 921,000 people may have been leaked, including about 920,000 customers' names/titles, addresses, phone numbers and email addresses, and about 1,000 staff and service/product/supplier personnel whose data also included identity document numbers, bank account numbers and salaries. About 1,050,000 people's data may have been maliciously encrypted. In its 9 July 2026 notice, Shun Hing Group said there was no evidence of misuse at that time and that its PanaClub system was suspended. This site's take: the potentially involved information includes after-sales contact details, such as an address or phone number given for appliance delivery, installation or warranty registration. A caller who knows your address and what you bought does not prove they are genuine. Don't follow a message's password-reset link; open the official website yourself to check the latest PanaClub guidance.
Standard Bank Data Breach (South Africa): Handling Scam Calls That Know Your ID and Account Numbers
On 23 March 2026, The Standard Bank of South Africa said it had identified unauthorised access to select data. By its 14 April update, the bank said the affected information includes names, ID numbers or company registration numbers, contact details (phone numbers, physical and/or email addresses) and account numbers, later adding B-BBEE categorisation and VAT registration numbers, and that the data 'now appears to have been published'. The bank says its transactional banking and core operating systems were not accessed and client funds are not affected. It has not published how many clients were affected. This site's take: the danger is not someone logging in with this data. It is someone calling you as 'Standard Bank' while reading out your real ID and account number. A caller knowing those numbers doesn't prove it is the bank, and the bank says it will never ask for your passwords, PINs or OTPs. Hang up, call the number on your card, register with SAFPS, and check your credit report.
Texas Parks and Wildlife Data Breach (2026): Affected Users and Response
The Texas Parks and Wildlife Department (TPWD) says that on May 13, 2026 Texas Cyber Command detected a cybersecurity incident involving the TPWD license system vendor that handles the sale of hunting and fishing licenses. According to TPWD, an unauthorized actor may have obtained driver license information, passport numbers (if provided), email addresses, phone numbers and residential addresses for more than 3 million customers; TPWD says Social Security numbers, dates of birth and financial information were not obtained. The Texas Attorney General's breach list shows 3,087,721 Texans affected. This site's take: the licence comes from a state agency, but the ID numbers buyers gave were stored in the systems of TPWD's vendor, a company buyers didn't choose themselves. And because licences are renewed every year, a message from TPWD looks normal, which makes it easy for scammers to imitate. Freeze your credit (a free block that makes it harder to open new accounts in your name), learn the Texas DPS route for a misused licence number, and only renew or pay through a TPWD address you type yourself.
Trenitalia Data Breach: Protecting Yourself from Fake Delay-Refund Scams
Italian rail operator Trenitalia sent customers a notice under Article 34 of the GDPR saying a cybersecurity incident caused by unidentified external parties led to unauthorised access to some personal data linked to travel tickets (titoli di viaggio). Follow-up notices for jointly controlled tickets describe it as the same event Trenitalia communicated on June 26, 2026. The data may include name, date and place of birth, email and phone number, itinerary details such as route, date, time and ticket number, loyalty card code, employer, and identity document details; the notice for UnicoCampania regional tickets also lists the Italian tax code (codice fiscale) and gender. Trenitalia says account login data, passwords and payment information were not involved. It notified the Italian data protection authority (Garante) and CSIRT Italia and filed a criminal complaint with the Rome prosecutor. This site's take: what leaked is an itinerary — when, where and on which train — and that is exactly what makes a fake 'your train was delayed, claim your refund' message convincing. Real delay compensation is either requested by you through Trenitalia's own channels or, for regional digital tickets, paid automatically to the card you bought with. No genuine refund asks you to type your card number into a link from a text message.
TVING Data Breach (South Korea): Fake Compensation Messages and What Users Should Do
According to the investigation results published on September 3, 2026 by South Korea's Ministry of Science and ICT and its joint public-private investigation team, the TVING breach exposed data on 39.54 million accounts (active, dormant, withdrawn and test accounts, including duplicates). The 20 leaked item types (70 fields) include ID, name, date of birth, connecting information (CI), duplicate-registration information (DI), refund account numbers (encrypted) and passwords (one-way encrypted); passwords were confirmed to be impossible to decrypt. This site's take: because TVING is genuinely running a compensation program, fake 'compensation' and 'refund' texts are the most convincing scam right now. Check compensation only inside the official app you open yourself, change passwords wherever you reused them, and turn on identity-theft alerts if you live in Korea. For developers, the lesson is structural: one developer's access key opened all the source code, and that source code contained production-environment keys.
Six US Healthcare Data Breaches of 2026: How to Check a Notice from a Company You Don't Know
In 2026 a string of US healthcare data breaches happened at companies most patients have never heard of. Lining up six cases from the HHS breach portal: four are business associates that do work for providers and plans, one is a lab that receives samples and data from providers, and the sixth is a hospital system that says the unauthorized actor may have gotten in through a security breach at a third-party vendor. This site's take: a notice from a company you don't know is not, by itself, evidence of a scam. Before you use any number or link in it, open the HHS breach portal and your state attorney general's breach listing yourself and compare. For organizations, start with three things: a list of everyone you've handed patient data to, confirmation of return or destruction when a contract ends, and MFA that can't be phished.
Times Car data breach (6,628,007 records with names and addresses, traces of about 1.46M ID-document images being sent out): checking My Page and what members and former members should do
In its fifth notice on October 23, 2026, Times Mobility Co., Ltd. said the outside forensic investigation had ended and published final counts. In the Times Car web system, traces of attacker access and external transmission were found for 6,628,007 records of name, address, date of birth, phone number, email address and driver's license information. Of the identity-document images, which were stored encrypted, 1,464,800 showed traces of being sent out (the company had earlier said about 1.6 million might have leaked) and 891,602 were accessed with no trace of being sent out. Hashed passwords were sent out in 4 cases. In the related Times Club web system, where unauthorized access was also found, 19,510 Times Club card numbers, 135,436 linked-service IDs and 28 credit card last-four-digit records, among others, showed traces of being sent out (the company does not hold full card numbers or security codes). The cause was the exploitation of a vulnerability in the web system. The company will give a payment worth 3,000 yen to people whose images were sent out (details and method still being decided), and since 17:00 on October 23 has shown each person's leaked items on My Page. This site's take: first check your own items on My Page. If your document images were sent out, register fraud alerts with the credit bureaus and check your credit file; everyone should ignore contacts posing as the company. Former members can inquire through a dedicated form.
Spam from your own email address: usually a forged sender, and how to tell if you were hacked
Most spam that arrives 'from' your own address is a forged sender field; your account was never touched. Japan's IPA and JC3 have both warned about extortion emails made to look like this, and IPA says its help desk has not seen a single case of footage actually being released. This site's view: the sender can write anything in the From field. Before you panic, spend five minutes on three places — Sent, sign-in history, forwarding rules. And if the email quotes a password you still use, change it today.
Subdomain takeover (dangling DNS): how a leftover DNS record lets attackers use your domain
Delete a cloud resource without deleting the DNS record and you have a dangling entry: anyone can claim that subdomain by provisioning a resource with the same FQDN. Your servers stay untouched while a legitimate subdomain serves an attacker's content. The damage is not cosmetic — apps commonly expose session cookies to wildcard subdomains, so the hijacked one can read them. And the documentation explicitly rejects the belief that a certificate protects you. The fix is to build the deletion order into your procedures and tooling instead of relying on memory.
KADOKAWA / Niconico Ransomware (2024) — Why It Spread Company-Wide, and Network Segmentation & BCP
The way in was described as phishing that stole an employee's credentials; from there the internal network was breached and ransomware ran, taking down many of the group's services (including Niconico) for months and leaking ~250,000 people's data. Reporting and analysis attribute the company-wide spread to systems of very different criticality sharing the same network, reportedly with too little segmentation. Defend by segmenting the network by criticality, using phishing-resistant authentication, and preparing business continuity (BCP) and recovery.
AI-era security measures that work and ones that don't: why small sites get targeted too
Four AI-era misconceptions corrected: (1) too small to be targeted → automated attacks don't need a human to pick a target; (2) needs a special new control → the basics still work best; (3) a product makes you safe → prevention design before detection; (4) AI code is fast so it's safe → it can ship with vulnerabilities, so review before publishing. What works is the boring basics in the right order.
Email spoofing your own domain: how to tell it from a breach, and how SPF, DKIM and DMARC stop it
A suspicious email that appears to come from your own domain is usually not a breach — it's a forged From, because SMTP lets anyone write the From line. Reading the headers (Authentication-Results, Received, Reply-To) tells a breach from a forgery. The main reason it reaches your inbox is a missing DMARC policy. Fix it with SPF → DKIM → DMARC (p=none → reject).
What is phishing? The types of attack, and defenses more reliable than spotting it
Phishing impersonates a trusted party to lure you to a fake login page and steal credentials or data (or run malware). It targets human judgment rather than a software flaw, and is the number-one entry route for ransomware and breaches. Modern adversary-in-the-middle (AiTM) phishing relays even one-time codes to the real site in real time, so SMS/app MFA can be defeated. The reliable defense isn't 'spotting it' but mechanisms: domain-bound phishing-resistant MFA (passkeys/security keys), going to the official site directly instead of clicking links, and email authentication (SPF/DKIM/DMARC).
What is ransomware? How it works, how it gets in, and how to avoid paying
Ransomware is malware that encrypts your files and demands payment to get them back. Modern attacks add double extortion — they steal data first and threaten to leak it, so decryption alone doesn't stop the breach. Main entry routes: phishing, weak/no-MFA VPN/RDP, and unpatched internet-facing flaws. The single most important defense is offline/immutable backups plus restore tests — being able to recover without paying. Also prevent intrusion (MFA, patching) and limit the damage (least privilege, segmentation).
Choosing MFA the right way: what 'phishing-resistant' means, and why SMS is weak
MFA uses different factor categories. Manually entered codes can be relayed through phishing; SMS also depends on control of the phone number. Prefer phishing-resistant methods such as passkeys or FIDO2 security keys for important accounts, check user-verification requirements, and protect recovery methods too.
The dangers of public Wi-Fi: fake access points and certificate warnings matter more than sniffing
Public-Wi-Fi 'sniffing' is mostly mitigated by HTTPS and is lower priority now. The real risks are (1) connecting to an evil-twin fake AP yourself, (2) ignoring certificate warnings, and (3) exposing your device on the shared network. The most effective measures are simple: use your phone's tethering, trust HTTPS and cert warnings, and don't auto-join unknown SSIDs. A VPN is the next layer.