2026년 데이터 유출 및 사이버 공격 타임라인(일본 및 전 세계) — 영향도별로 평가한 203건의 사고와 그 의미

NIFTY

Up to 542,513 potentially affected records; number of people not disclosed

Its first notice reports unauthorized access to an internal line-application management system on October 19; the source was blocked. Applications since 2019 for @nifty Hikari, @nifty MAX Hikari and @nifty au Hikari Plus, excluding the company website, may be affected. Member IDs and personal/contact details may have leaked; actual leakage remains under investigation. Bank and card data are not held in the system. Passwords are not mentioned.

• Names & contacts

H2O Retailing and Hankyu Hanshin Department Stores (H2O ID)

About 1.26 million H2O ID records, not necessarily people

The companies’ October 19 notice says unauthorized access via their reservation site leaked part of the personal information in about 1.26 million H2O ID records, including names, addresses, phone numbers and birth dates. Possible leakage of E-STORES and Remo Order data remains under investigation. Full card numbers and security codes are not held; no password leak was confirmed. Three sites were stopped. The detailed cause remains under investigation.

• Names & contacts
• Operations halted

Joshin

According to its October 17 notice, Joshin recognized unauthorized access on October 16. Some services were unavailable after protective restrictions. Whether information leaked was under investigation; it made an initial report to the privacy regulator because a personal data leak could not be ruled out.

• Operations halted

ConnectWise (Cloud Backup, formerly SkyKick)

Said it identified the issue on October 14 through its security monitoring, and later confirmed unauthorized access to application identities associated with Cloud Backup (formerly SkyKick), its Microsoft 365 backup service for managed service providers. It suspended Cloud Backup, so scheduled backups are not running, and temporarily took SaaS Security and Cloud Management offline as a precaution; on October 17 it disabled seven application identities, including Cloud Backup and Cloud Management, and revoked the certificates they used. It has no evidence that stored backup archives were accessed, but it cannot tell from its side whether customers' Microsoft 365 tenants were affected, and asks partners to keep the applications disabled until it provides restoration instructions and review roles, credentials and mailbox forwarding rules in every tenant. A security firm investigating the incident reported unauthorized sign-ins with the credential in 162 tenants as of October 16, and later said sign-ins had succeeded in more than 300 tenants. The cause is under investigation.

• Operations halted

Studio (website builder)

According to its first notice, unauthorized access exploiting a vulnerability may have exposed all registered users’ account data, saved form responses and external API keys. Studio has not confirmed that a third party took the data but is treating it as taken. It says the vulnerability was fixed and the access route closed.

• Passwords
• Names & contacts
• Code & credentials

Anne Arundel County, Maryland

Said it detected irregular activity on part of its network on August 28 and that an unauthorized actor accessed a limited number of systems and copied certain files. It is still reviewing their contents and has notified federal law enforcement. It will not confirm or comment on claims made by a criminal group.

US Federal Judiciary (Bankruptcy Noticing Center)

Said the IT systems of the contractor that runs the Bankruptcy Noticing Center were hit by a cybersecurity incident, making all of its systems and websites unavailable and halting the production and delivery of bankruptcy notices. It has not said whether data was affected or when service will return.

• Operations halted

Medley (@link system for medical institutions)

Up to 787 medical institutions may be affected (all that use @link and related services; patient numbers and data items under investigation)

Disclosed unauthorized access by a third party to @link and related business support systems for medical institutions. After a tip from an outside specialist organisation on October 11, it investigated, confirmed the unauthorized access and suspended the services late on October 14. Personal data of patients and others registered in @link may have leaked; whether data leaked and the scope (data items, affected institutions) are under investigation. Up to all 787 institutions using the services may be affected. It reported to the Personal Information Protection Commission and consulted the police. An October 19 update says the investigation is taking longer than expected and that it plans to provide another update around October 20.

• Operations halted

Ampath Laboratories

Told the media it detected unauthorized access to part of its IT environment on 2 October. Potentially affected data appears limited to some demographic and administrative details, and it says there is no evidence so far that medical records, diagnoses, test results or banking data were compromised. It notified the Information Regulator, and says the attackers' "80 million" figure appears to count database records and greatly overstates the number of people.

• Names & contacts

Fivot (IDARE)

129,659 people (including former members)

Fivot said it confirmed that phone numbers, email addresses, birth dates, balances, transaction histories and card names/expiry dates of all affected IDARE users leaked; for some, names, addresses, ID document numbers, partial card numbers (last 4; first 6 and last 4 of top-up credit cards) and the last 3 digits of bank accounts were also involved. Passwords, ID images, My Number, full card numbers, security codes and PINs are not involved. No fraudulent transactions have been confirmed.

• Government ID numbers
• Card data
• Bank data
• Names & contacts

JR Kyushu Food Service

About 26,900 of about 61,500 members

The provider of the customer app used at 24 of its restaurants (including Umaya and Tanya) was breached and that some member data leaked; the items listed as possibly leaked are user IDs, phone numbers, names, gender, email addresses, addresses and birth dates (items other than ID and phone were optional). Passwords, card numbers, other payment data and purchase history are not involved. (Site note: separate from the JR Kyushu web-member case.)

• Names & contacts

Housing Ombudsman Service

Says it is investigating unauthorised access to data held in its case management system, which is provided by a third-party supplier. The system is offline: online new complaints, case viewing, web chat, webform and other online services are unavailable (email and phone still work). What information was affected is still under investigation; it will contact affected individuals directly where required. It has reported to the relevant authorities, including the Information Commission, and engaged technical security experts.

• Operations halted

Meta

Personal data of about 1,500 people (mostly US employees)

Told the media that attackers used an employee's stolen credentials to access some GitHub repositories, taking source code and other business data plus personal data on about 1,500 people that had been mistakenly stored there (data types not disclosed; much of it was synthetic or anonymized test data, it says). Secrets in the repositories were rotated; it says no product vulnerability or internal-system breach was involved.

• Code & credentials

Icon Oncology Group

Disclosed unauthorized access to some patient information held on a supplier's system (Australia only so far). Its notice, as updated on October 15, says the incident involved an externally hosted and managed platform that converts incoming faxes to email, which is not its main system for sending or receiving patient information. It was contained immediately and core clinical and patient management systems were not affected; all systems are online and secure, the company says. It believes the records are individual documents tied to business correspondence rather than complete patient files, and will contact affected patients and their doctors directly. Treatment is not affected.

• Health data

Takashimaya (email newsletters)

The cloud platform used by its newsletter delivery contractor was breached, causing a system failure. The platform held Takashimaya online members' email addresses, names, birth dates, postcodes and addresses down to the city among other data. No leak had been confirmed as of October 9, the company said; newsletters are suspended for now.

• Names & contacts

Peach Aviation (booking emails)

About 1.89 million records on the email delivery system (no leak confirmed)

The cloud service it uses to send booking-related emails was hit by ransomware on October 7, delaying or blocking itinerary emails. The affected servers held about 1.89 million records of email addresses, names (in Latin letters), phone numbers, booking numbers and itineraries, but no leak has been confirmed so far. No card or passport data was stored there, and flights were not affected.

• Names & contacts

Resorttrust

About 26,000 group-member records and about 36,000 reservation records for The Kahala Hotel & Resort Yokohama

Unauthorized access to a website it manages leaked personal data of some group members and of people with reservations at The Kahala Hotel & Resort Yokohama. The system behaved abnormally from about 20:30 to 23:30 on October 5, and the leak was confirmed on October 7. It has not listed the leaked items, but said usage history, medical data, card and bank data, email addresses and ID documents are not held in that system.

Ricardo

About 890,000 user accounts

Its parent company said there was unauthorized access to personal data linked to orders on the Swiss online marketplace. Suspicious activity on its servers was detected on October 7; names, postal addresses and phone numbers (and company names for business users) of about 890,000 accounts were exposed. Email addresses and passwords were not affected.

• Names & contacts

coconala (coconala Skill Market)

449 résumés and 1,845 career-history documents

Unauthorized access to coconala Skill Market on October 8 led to résumés and career-history documents submitted by some members being taken. Card data and passwords were not involved, the company said.

• Names & contacts

Tensorlake (npm package)

A compromised maintainer account published tensorlake 0.5.144 to npm through the project's own release workflow (live about 1 h 40 min). It steals developer credentials at install time and republishes itself into other packages the victim can write to. It installs a persistent service that deletes the home directory if the stolen GitHub token is revoked, so the project says to remove that service before rotating tokens. PyPI, crates.io and the CLI were not affected.

• Code & credentials

Uzabase (NewsPicks)

Up to 323,000 email addresses and 362,000 partial card records, among others (Oct 9 second report)

A management tool NewsPicks uses for its operations was breached, and users' emails, names, birth dates, delivery addresses, employers, cardholder names and last three or four card digits may have leaked. Full card numbers and security codes are not stored and were not involved, and no password leak has been confirmed.

• Names & contacts

Commune (Commune)

About 307,000 people (estimate; about 126,000 of them with email addresses, including about 42,000 of the company's own employee and test/demo accounts)

Its Commune and Commune for Work community services for businesses were accessed without authorization, and member data in some communities leaked from about 18:00 on October 5 to about 21:00 on October 6 and from 13:17 to 14:36 on October 7: data including email addresses for about 126,000 people (about 42,000 of them the company's own employee and test/demo accounts), and display names, profiles and private group memberships for about 181,000. The passwords of 144 members were changed to temporary ones without their action (no leak of the passwords themselves was confirmed). No new leak has been found since October 9, but the services were halted from October 10 to prevent misuse of the leaked email addresses; after measures including mandatory two-factor authentication for administrators, communities began reopening in stages from October 16 for clients that ask, in the web browser only with some features restricted (the app, new registration by email and password resets remain unavailable). Several client companies have also disclosed impact, including Sansan, Suzuki (about 3,000 people), LY Corporation (1,750), Koikeya (up to 1,800 records), Yamaha (about 1,600) and Calbee. JMAM said the names, addresses, ages and phone numbers members had written in their profiles on its Toki Labo community (2,950 people) also leaked.

• Names & contacts

ORIX Life Insurance

About 26,500 records (including repeat inquiries)

Unauthorized access to the vendor service it uses to manage inquiries from its website may have leaked names, birth dates, addresses, phone numbers, emails and policy numbers, plus inquiry content that includes medical information customers reported. No My Number or credit card numbers are included. It is the same vendor as in the Daiwa Securities, Citizen Watch and Sompo Japan cases.

• Health data
• Names & contacts

H.I.S. (Thai subsidiary)

Up to 627 people

Unauthorized access to a file server at its Thai subsidiary may have exposed passport details (names, birth dates, passport numbers, expiry dates and more) and allergy information of customers who travelled to Thailand. It was detected in December 2025; checking every file took time, the company said. Phone numbers, addresses, emails and card data are not included.

• Government ID numbers
• Health data

Sompo Japan (SMILING ROAD)

About 60,000 inquiry records (including repeat inquiries)

Unauthorized access to the servers of the vendor it uses for SMILING ROAD (a connected dashcam service for businesses) inquiries may have leaked names, phone numbers, addresses, emails, employer details, driver IDs and driving-alert data. No bank, card or My Number card data is included. It is the same vendor and window (night of Oct 2 to morning of Oct 3) as the Daiwa Securities and Citizen Watch cases.

• Names & contacts

Rakuten Drive

Stored files of 15,382 accounts; profile data of 687 accounts (313 of them also encrypted passwords)

A third party obtained the credentials of an administrative account for part of the system and accessed it internally. Files stored by 15,382 accounts (photos, documents and more) were viewed or taken; profile data such as account and display names of 687 accounts was taken, and for 313 of them encrypted passwords and their salts as well.

• Passwords
• Names & contacts

Asahi Kasei Therapeutics (Pharma DIGITAL)

Up to about 558,700 people (healthcare professionals: about 514,000 + about 44,000; about 700 employees)

A cyberattack on Pharma DIGITAL, its information site for healthcare professionals, means personal data in the member database may have been viewed or taken. About 514,000 professionals' names, facilities, facility addresses, job types and specialties are involved, another 44,000 or so with email addresses as well, plus about 700 employees' names, emails and photos. No misuse has been confirmed.

• Names & contacts

Citizen Watch

About 100,000 people

Unauthorized access to the servers of the vendor that runs its websites' contact forms may have leaked names, addresses, phone numbers and emails from Citizen, Bulova and Frederique Constant inquiries, plus any bank or card details customers typed into a form. It is the same vendor and the same window (night of Oct 2 to morning of Oct 3) as the Daiwa Securities case.

• Names & contacts

nimoca (usage history service)

521 records

An attack on the usage-history service for the nimoca transit IC card leaked card numbers, birth dates and email addresses through emails the service sends automatically. No names, addresses, phone numbers or usage history were found leaked. It came to light when a user reported an unexpected email, and the service was suspended.

• Names & contacts

ASOS

Said an unauthorised notification was sent to customers and that it is investigating unauthorised activity on third-party platforms it uses to communicate with customers. Basic personal information including names and contact details (its October 8 email to customers also mentioned some non-personal account-related information, as reported) may have been accessed; it does not believe card information or account passwords were affected.

• Names & contacts

Daiwa Securities

About 110,000 customers (about 220,000 records including inquiries that identify no one)

Unauthorized access to a vendor's server used to manage online customer inquiries may have leaked names, email addresses and account numbers from inquiry records. The company said the data alone cannot be used to access accounts or trade, and found no unauthorized access to its own systems.

• Names & contacts

Daiki Suisan (official app)

174,933 people (including former members)

Unauthorized access to the sushi chain's official app system may have leaked names, phone numbers, emails, addresses and birth dates of people registered since November 2024. Passwords are kept on a separate server and were not involved.

• Names & contacts

GMO Research & AI (infoQ)

894,082 records (confirmed in the Oct 14 second report; the Oct 5 first report said up to 948,498)

Intruders got into the survey site infoQ and took members' names, birth dates, emails, addresses, phone numbers and encrypted passwords. Points of some members (611 cases, ¥2,869,500) were exchanged for gift codes without their consent; the company will reimburse the full amount (credited to accounts when the service resumes). It invalidated all members' passwords on October 7. It holds no card data or My Number.

• Passwords
• Names & contacts

Osaka Metropolitan University

Personal data of at least about 130,000 people may have leaked (under investigation)

Announced at a press conference that a ransomware attack in the early hours of October 2 halted about 500 servers. Much of the backup data was also encrypted and there is no recovery timeline. Names, addresses and emails of students, graduates and others may have leaked; all classes were cancelled through October 8.

• Names & contacts
• Operations halted

i-plug (OfferBox)

Up to 314,009 students (those searchable during the period)

A system configuration flaw put students' names and email addresses into the data sent to an employer-facing page of the job-matching service OfferBox (May 12 to August 28, 2026). They did not appear on screen but were visible with tools such as browser developer tools, and only client companies could see them. It was not an attack, and no leak beyond client companies has been found.

• Names & contacts

Nikkei Inc.

1,646 people (Google Workspace); about 9,000 spoofed emails (Microsoft 365, a separate case)

Unauthorized outside access to employees' Google Workspace accounts may have leaked names and email addresses of 1,646 people, such as employees and business partners; Google notified the company in early August. Separately, a third party logged in to an employee's Microsoft 365 account on September 30 and sent about 9,000 emails leading to a malicious site. Reader and news-source data were not involved in the Google Workspace case, the company said.

• Names & contacts

Dai-ichi Life Insurance

about 120,000 (about 50,000 employees, about 70,000 retirees)

Unauthorized access to its employee HR system may have leaked names, addresses, phone numbers and departments of staff, including retirees; no access to customer data was found.

• Names & contacts

Abahouse International

Disclosed that member data and order details (products, amounts, delivery addresses) may have leaked (for former members, it said past order records may have been accessed); fake refund emails quoting real orders led to the discovery. An Oct 9 follow-up said the route was cut off, no reports of financial loss had been confirmed and a police report was filed; count not disclosed.

• Names & contacts

Frontline Education

Began notifying school-district employees that a vulnerability in third-party software exposed their Social Security numbers, addresses and emails.

• Government ID numbers
• Names & contacts

National Tax Agency (e-Tax)

Returns of 79 filers (203 people's data)

A defect in an e-Tax MyPage update let other logged-in users view gift tax returns (gift amounts, dates of birth); 19 users may have viewed them.

• Names & contacts

Japan Atomic Energy Agency

175 people (367 files with personal data)

Files were downloaded without authorization from a research-support site on a contracted cloud platform; they included ID-card images (six with My Number) and radiation-work health check results.

• ID documents
• Government ID numbers
• Health data

Lashinbang

An anime-goods resale chain said unauthorized access (Sep 14–16) may have exposed ID document types and numbers used for buybacks, payout bank accounts and consent-form images; count not disclosed, and no card data, passwords or ID document images (incl. driver's licences) leaked (Oct 9 addendum).

• Government ID numbers
• Bank data
• Names & contacts

Seven Korean financial firms (Shinhan, KB Kookmin, Hana, Yegaram Savings and others)

Per company, not summed: Shinhan Bank about 25,000 customers, KB Kookmin 119, Hana 89, Yegaram Savings Bank about 40,000 (estimated), and others; plus corporate-client contacts, loan agents and contractor staff (reported)

Seven banks, savings banks and a capital firm disclosed leaks from outside access in quick succession. Shinhan's included income and loan limits; some firms' included resident registration numbers. The president ordered a thorough probe; no common cause confirmed.

• Government ID numbers
• Names & contacts

Sagawa Express

about 100 days of parcels (count under investigation)

Unauthorized access to its parcel tracking service may have exposed names, addresses and phone numbers of senders and recipients of about 100 days of parcels; recipients who never used Sagawa themselves may be included. Nine web services remain stopped; no impact on other systems found.

• Names & contacts
• Operations halted

Seicomart (Seicomart app)

574,647 people (fourth notice)

Unauthorized access via the app's server reached the member database; names, addresses, dates of birth, phone numbers and email addresses were viewed. Password data and purchase history were not leaked.

• Names & contacts

eplus

1,463 records (751 with bank details)

Unauthorized access to a system handling e-ticket refunds leaked refund applicants' emails and other data, including bank account details for transfers; it is separate from the member database.

• Bank data
• Names & contacts

Japan Post (post office app)

69 records of 19 people

Unauthorized access to its post office app led to member, address-book and shipping-label data being taken; no sign of misuse was found.

• Names & contacts

Fakturownia

full data for about 2,250 accounts (partial data for others)

A system vulnerability let an intruder copy much of its database, including contractors' bank account numbers, password hashes and API tokens; card data and banking credentials were not included.

• Bank data
• Passwords
• Names & contacts
• Code & credentials

Sanpo Foods

Confirmed on August 25 that its website had been accessed without authorization, with administrator rights obtained and the site tampered with. It took the site offline to investigate. Contact-form submissions were not stored on the site, and no personal data leak has been confirmed, the company said.

Tokyo Metro (Metopo)

about 59,000 email addresses

Unauthorized access to a Metopo points-service server holding addresses whose mail delivery had been stopped may have exposed about 59,000 email addresses.

• Names & contacts

Starts Publishing (OZmall)

Up to 442,779 people (refined in the Oct 1 second report; first report on Sept 27 said 447,610)

A large volume of unauthorized access from overseas to the OZmall membership site may have exposed current members' and some former members' email addresses, and for some, names and prefecture of residence. Card data is handled by an external payment system and was not involved.

• Names & contacts

Keio Corporation

Group servers were hit by ransomware, disrupting some group companies' business systems; train operations were unaffected and no leak was confirmed.

• Operations halted

Renfe

Said attackers used compromised servers of the connected rail-infrastructure manager to reach limited user data, mainly names and emails; no access to bank, payment or ID data was found.

• Names & contacts

Nippon Rent-A-Car Service (Nippon Rent-A-Car app)

41 members (Sept 26) + 55 members (a separate intrusion disclosed Oct 1)

Unauthorized access to its app's system may have exposed members' names, contacts and bookings; for those who registered them, driver's licence numbers, addresses and birth dates too. Only the last four card digits were involved. On October 1 it added that the investigation had found a separate intrusion using a different method (September 19–21) that may have exposed 55 members' account pages.

• Government ID numbers
• Names & contacts

Saga University

Found suspected ransomware encryption on a NAS used by administrative departments; no impact on education, research or clinical systems was found. Office terminals were back in use on September 27 and normal operations resumed on the 28th.

• Operations halted

Dyfed-Powys Police

A cyber incident temporarily disrupted non-emergency systems such as email and online contact; no access to public data was found, and staff data is still being investigated.

• Operations halted

Australian Government (Medicare statistics portal)

The Prime Minister disclosed that an AI agent under evaluation by an AI company had reached a government Medicare statistics portal; the Australian Cyber Security Centre issued an advisory.

DIVD (Dutch Institute for Vulnerability Disclosure)

Disclosed an intrusion through two unknown flaws in the Zammad help-desk software and assessed that the post-intrusion activity was driven by an AI agent. Volunteers' DIVD email addresses were confirmed taken, and part of its CSIRT ticketing system, which may include IP addresses of vulnerable systems, was extracted.

• Names & contacts

JCOM

about 4.08 million subscriber households

Said that "a large volume of access from outside caused high load on DNS servers", disrupting internet, TV and mobile services for about nine hours; no data leak was mentioned.

• Operations halted

Astrana Health

Told the SEC that social engineering impersonating staff and spoofing its main phone number gave access to systems holding patient, employee and other data.

• Health data
• Names & contacts

GMO Internet (ConoHa WING)

426 accounts (data in their web-server areas)

Disclosed that a third party accessed customers' web-server areas on some shared hosts of its ConoHa WING rental-server service and installed malicious programs. It began on Sept 3, was detected on Sept 16 and removed on Sept 18. Member, contract and payment data are kept in a separate environment and were not leaked, the company said; it did not say whether web-server data was taken. Affected customers were emailed individually; those not contacted are not affected.

CrowdSec

about 170 private repositories

A former employee's machine infected by the poisoned TanStack packages leaked a still-active GitHub token that was used to clone its source code; no client or partner data was included.

• Names & contacts
• Code & credentials

BigCommerce

a 'small number' of merchant storefronts

Told merchants that a third-party app developer was compromised and its API credentials used to take some storefronts' customer names, emails, phone numbers and shipping addresses; its own platform was not breached.

• Names & contacts

Daiko Printing (PhotoGoods)

A card-skimming program was planted on the payment page of its custom-goods service; card numbers, expiry dates and security codes entered from Aug 6 to Sep 11 may have leaked. The service is suspended.

• Card data
• Passwords
• Names & contacts
• Operations halted

CenterPoint Energy

Told the SEC that a third party obtained some customers' personal data through an external-facing system; energy services were not affected.

• Names & contacts

King Printers

Disclosed that it detected unauthorized access to its system platform on September 10 and took its site and related functions offline until 16:00 on September 14. Its second report on September 25 said the aim appears to have been misuse of a generative AI service using credentials the company holds. There is no trace of data being sent out, and no leak of customer personal data or other data has been confirmed (as of September 25). Payment data is not kept on its servers. A detailed forensic investigation by an outside specialist was planned from early October.

• Operations halted

Revolut

a 'very limited' number of customers

Handed some customers' ID copies and statements to an impostor posing as a government agency; systems and funds were not compromised.

• ID documents
• Bank data

Digital Agency (Japan)

about 246,000 records

Unauthorized access to its Government Solution Service may have leaked personal data of government staff and others.

• Names & contacts

ROHTO Pharmaceutical

Unauthorized access to systems used for its mail-order business may have exposed recorded phone-call audio and customer-management data; scope and count are under investigation.

• Names & contacts

The Institute of Energy Economics, Japan (IEEJ)

13 passport records leaked; 759 email addresses and other data possibly leaked

A phishing attack led to unauthorized access to six staff members' Microsoft 365 accounts and 2,798 files were downloaded. A follow-up confirmed 13 passport records leaked and that email addresses and some bank details may have leaked. It was found through a tip from an outside organisation.

• ID documents
• Bank data
• Names & contacts

Florida Highway Safety and Motor Vehicles (DAVID database)

Confirmed that its driver and vehicle database was accessed with a police user's credentials stored on a personal device; it has not stated the number affected or data types.

• Names & contacts

ApplyNow (HR SaaS)

Total under investigation (including 5,784 Yoshinoya Holdings-related records: 4,998 Yoshinoya and 368 Hanamaru applicant records plus 418 group staff records; account counts, not people)

A data-analysis tool vulnerability allowed about a month of unauthorized access to data including My Number, pension numbers and bank details in its e-contract service, plus applicant data. Former client Yoshinoya Holdings said applicant records it believed were deleted when the contract ended (4,998 Yoshinoya, 368 Hanamaru) and 418 records of group staff who handled hiring (user names, emails, encrypted passwords) were among them, 5,784 in total.

• Government ID numbers
• Bank data
• Passwords
• Names & contacts

Veradigm

a 'small number' of customers

Told the SEC that credentials for its API were obtained from a vendor's environment and used to download patient data, in some cases including SSNs; no clinical or medical data was involved.

• Government ID numbers
• Names & contacts

Institute of Science Tokyo

Unauthorized access to its IT infrastructure may have leaked personal data of students and staff, including names, addresses and emails; no leak of hospital patient data was found.

• Names & contacts

Weverse

422,584 records (by account ID)

A vulnerability in an external payment API exposed purchase, payment and refund records; names and contact details were reportedly not included.

IDScan.net

The ID-verification provider said government ID numbers stored in its cloud platform may have been accessed and copied.

• Government ID numbers
• Names & contacts

Tottori Prefecture (radiation monitoring)

The main server of its radiation monitoring system was hit by ransomware and stopped; monitoring continued through the backup station and the system held no personal data.

• Operations halted

Mitsui Fudosan

up to 55,000 records (up to 19,000 staff, up to 36,000 outside parties)

Misused credentials for some systems may have let an outsider view names and emails of staff and outside contacts; no leak of business data or passwords was found.

• Names & contacts

Amadeus (iHotelier)

a 'very limited number'

A spokesperson said unusual activity on an API connected to iHotelier was detected on Sept 11; guests' names, contact and booking details were involved, but not payment data or passwords.

• Names & contacts

Mandarake

Found an intrusion into its shipping-data server and stopped online sales; names, addresses, phone numbers and emails of customers who ordered before Aug 28 may have leaked. No sign of exfiltration had been found so far.

• Names & contacts
• Operations halted

McKesson

Told the SEC that data was taken from certain third-party applications, affecting a subset of customers; distribution was not affected.

• Names & contacts

Kindal

136,464 customers

An outsider logged in to a staff account on its e-commerce platform and bulk-exported customer data twice; card numbers and login passwords were not included.

• Names & contacts

Hasbro

Began notifying employees that their personal and financial information was accessed, in some cases including national ID numbers or financial account data.

• Government ID numbers
• Bank data
• Names & contacts

Boston Scientific

Told the SEC that a cyber incident caused a global network outage affecting manufacturing, ordering and shipping.

• Operations halted

Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF)

Found a breach of a standalone system, shut it down and designated it a 'major incident' reportable to Congress; information about investigation targets was reportedly involved.

• Names & contacts

Solimut Mutuelle de France

Told members that a cyberattack abusing an online service caused a personal data breach; it has not stated how many people or what data.

Nutex Health

Told the SEC that information on its servers was accessed and exfiltrated; whether patient or employee data was involved is being assessed, and no material operational impact was found.

SickKids (Hospital for Sick Children)

A vulnerability in third-party software used by SickKids and other organizations exposed personal data of current and former staff and job applicants; clinical systems and patient data were not affected.

• Names & contacts

VOISING

About 170,000 records

A known flaw in a BI tool it uses was exploited before patching, leaking fan-club and store members' names, addresses and purchase history; some data was posted online.

• Names & contacts

State of Berlin

Two Senate departments were cut off from the state network, leaving them without external connectivity for about nine days; the state refused to pay, and stolen data was later reported published.

• Operations halted

Charm (pet supplies e-commerce)

about 390,000 records (about 370,000 confirmed, about 20,000 possible)

Unauthorized access to its online store leaked names, addresses, dates of birth and password hashes; unauthorized logins to 239 accounts were also found and orders on its main sites were suspended.

• Passwords
• Names & contacts
• Operations halted

Trezor

80,689 customers

Its logistics partner's analytics environment was breached via an unpatched flaw, exposing customers' names, phones, emails and shipping addresses; wallets, keys and backups were not affected.

• Names & contacts

RIZAP (APORITO online store)

A malicious script on its online store may have exposed personal and card data of customers between May 1 and August 5.

• Card data
• Names & contacts

REXT Holdings (WonderGOO, Shinseido, Jeans Mate and others)

Ransomware forced some store closures and limits on cashless payment; its fourth report in September said part of the possibly leaked data had been posted online.

• Operations halted

Kilo Code (Anaconda)

A breach at its BI provider Metabase exposed some users' names, emails, billing addresses, Slack access tokens and parts of prompts; payment card data was not included.

• Passwords
• Names & contacts

n8n

136 reported records

Disclosed an intrusion through a Metabase flaw. August 11 revision of 136 reported records: seven confirmed accessed with usernames/emails; five with names/usernames/emails/bcrypt-hashed passwords; 62 with names/emails possibly accessed; 62 described as containing no sensitive information.

• Passwords
• Names & contacts

CEC Co., Ltd.

Part of its Tokyo data center was hit by unauthorized access that disrupted services; the next day it confirmed ransomware. Its September final report said no data leak occurred.

• Operations halted

Chubu Electric Power

about 74,100 people (about 2,400 outside contacts, about 71,700 group directory entries)

Misused credentials may have let an outsider view employee emails and the group contact directory; no impact on power supply and no leak of electricity or gas customer data was found.

• Names & contacts

Intermarché Drive

287,605 users

Confirmed that Drive users' names, dates of birth, phone numbers, addresses, loyalty card numbers and order data were exposed; bank details, passwords and emails were not.

• Names & contacts

Police National Legal Database (PNLD)

Confirmed that contact details of police officers, staff and criminal-justice professionals were taken and published on the dark web.

• Names & contacts

CEVA Logistics

eight European warehouses

Told customers a cyber intrusion hit part of its European contract logistics, halting shipments from eight warehouses; recipients' names, addresses and phone numbers were affected, but not payment or bank data.

• Names & contacts
• Operations halted

CHAEVI

298,333 records

A hack of the EV-charging platform leaked email addresses and, for some users, encrypted passwords; resident registration, passport and card numbers were not included.

• Passwords
• Names & contacts

Origin Energy

about 900,000 current and former customers

Told the ASX that customer data was accessed and disclosed without authorization, including partial card and bank numbers.

• Names & contacts

Hugging Face

Disclosed an intrusion carried out end to end by an autonomous AI agent; no tampering with public models or datasets was found.

• Code & credentials

Abbott (cancer diagnostics)

A voice-phishing attack led to access to some legacy systems; some affected files held personal and health information.

• Health data

Media4u (business SMS service)

95,412 records (22,928 may contain personal data)

The account list of its SMS platform's admin console leaked and 280 fraudulent text messages were sent through the service; no passwords or payment data were included.

• Names & contacts

Nichirei

53,866 records (sum of the table in the 7th report, Sept 18)

A cyberattack disrupted cold storage and frozen-food shipments; its seventh report in September confirmed leaks of delivery-recipient and business-contact data and employee, family and job-applicant data including pay and residence status.

• Names & contacts
• Operations halted

Hachioji Gakuen Hachioji Junior and Senior High School

Disclosed on July 13 that school servers were hit by unauthorized access and ransomware. Its second report on September 30 said an attacker got into a server on July 8 and in the early hours of July 10 files on the servers and some staff computers were encrypted, including files with personal data of current and former students, parents, applicants and staff; restoring them is extremely difficult. The investigation found no outflow of files containing personal data, but because the attacker deleted some logs, the school says an outflow cannot be completely ruled out.

• Operations halted

Singapore Land Authority

about 70,000 people

Unauthorized access to a test dataset that should have been anonymised, held in a vendor-managed cloud, exposed national ID (NRIC) numbers and addresses.

• Government ID numbers
• Names & contacts

Shun Hing Group

about 921,000 people (privacy commissioner's account as reported)

The company says contact details and other information may have been affected. Reports describe about 920,000 customers and about 1,000 staff and suppliers, with ID numbers and bank accounts potentially involved for the latter group.

• Names & contacts

Meitetsu Kyosho (Cariteco)

Disclosed a ransomware outage and in August said data of current and former Cariteco car-sharing members, including driver's license information, may have leaked.

• ID documents
• Card data
• Names & contacts
• Operations halted

Kaga Solnet

165,587 people

Unauthorized access to its e-commerce site for university students and staff sent customer data externally.

• Names & contacts

Trenitalia

Notified customers that outside parties accessed passenger data tied to tickets and passes (contacts, travel details, and in one of the notices ==tax codes==); credentials and payment data were not included.

• Government ID numbers
• Names & contacts

University of Nottingham

A vulnerability in software behind its student records platform let an outside party take a large amount of student, alumni and applicant data; the platform was taken offline.

• Government ID numbers
• Bank data
• Names & contacts
• Operations halted

GitHub

An employee device was compromised through a poisoned extension and internal repositories were taken; no impact on customer repositories was found.

• Code & credentials

Nx (Nx Console extension)

one extension version

Credentials stolen in the TanStack compromise were used to publish a malicious extension build, which stayed up for under an hour.

• Code & credentials

TanStack (npm packages)

84 malicious versions across 42 packages

Chained CI/CD weaknesses let malicious versions be published in a six-minute window; they were deprecated within about an hour.

• Code & credentials

Instructure (Canvas LMS)

User data across many institutions using its learning platform was accessed, and a week later user-facing pages were altered.

• Names & contacts

Vercel

a limited subset of customers

An intruder who compromised a third-party AI tool used by an employee reached internal systems and decrypted environment variables (which may include API keys and database credentials) for a limited subset of customers.

• Code & credentials

Booking.com

According to the company's statement as reported, unauthorized third parties reached some guests' booking information; reservation PINs were reset and affected users notified.

• Names & contacts

The Awa Bank

27,745 records

The test environment of an internal office system was accessed without authorization, leaking customer data stored there.

• Bank data
• Names & contacts

Federal Bureau of Investigation

Told Congress that a breach of an internal system holding surveillance returns was a 'major incident'.

• Names & contacts

axios (npm package)

Malicious versions of the widely used HTTP library were published from a compromised maintainer account and removed within hours.

• Code & credentials

Standard Bank of South Africa

Disclosed unauthorized access to client data including national ID and account numbers; core banking was unaffected, but the data later appeared to have been published.

• Government ID numbers
• Bank data
• Names & contacts

BTG Pactual

about R$100 million of its own reserves

Unauthorized transactions diverted about R$100 million of its own settlement reserves; Pix payments were paused for about a day. Customer accounts and data were not accessed and most funds were recovered.

• Operations halted

Trivy (Aqua Security)

Malicious Trivy releases and GitHub Actions tags were published, targeting CI/CD secrets (API tokens, cloud credentials and more) accessible to affected workflows.

• Code & credentials

Companies House (WebFiling)

A flaw introduced in a WebFiling update let logged-in users view and potentially change other companies' non-public details such as officers' dates of birth and home addresses; the service was taken offline.

• Names & contacts
• Operations halted

Stryker

Told the SEC that a cyber incident disrupted its Microsoft environment worldwide, affecting ordering, manufacturing and shipping.

• Operations halted

Advantest

Detected unusual activity in its IT environment on February 15 and disclosed a cybersecurity incident involving ransomware on February 19. Its individual notice dated October 6 (published by the California Attorney General) said an unauthorized third party extracted data from its servers. The data listed varies by person and includes contact details, dates of birth, Social Security numbers, national ID numbers, driver's licences, passport numbers, medical and financial information. It has not disclosed how many people are affected; those notified are offered 18 months of free credit and web monitoring.

• Government ID numbers
• Health data
• Names & contacts

Nippon Medical School Musashi Kosugi Hospital

about 130,000 patients, about 1,700 staff

A ransomware attack exposed personal data of about 130,000 patients; no leak of medical records was confirmed.

• Names & contacts

Anabuki Housing Service

207,773 records (final count)

Disclosed ransomware on some servers; its sixth report in May fixed the possibly leaked personal records at 207,773.

• Names & contacts

Canada Computers & Electronics

Personal and payment card data of guest-checkout customers who bought between late December 2025 and January 22, 2026 was compromised.

• Card data
• Names & contacts

Endesa Energía

Told customers that unauthorized access to its commercial platform may have exposed national ID numbers, contact and contract data and possibly bank account numbers; passwords were not affected.

• Government ID numbers
• Bank data
• Names & contacts

Betterment

Social engineering gave an intruder access to third-party marketing and operations platforms; a fake crypto message went to some customers and contact data was exposed. Accounts and passwords were not affected, the company says.

• Names & contacts