Disclosed Oct 8, 2026. Linked to the Sep 30 intrusion into Sagawa’s parcel-inquiry service; shipper/recipient name, address and phone for Fuji official-store buyers in the prior 100 days (incl. subscriptions) may be in scope. Whether Fuji customers are actually included still under confirmation. Cards/passwords out of scope per Sagawa. No headcount. Sagawa root not yet registered (official body unread).
Intrusion via an unrecognized legacy PMS account leaked name/phone/email/nationality/stay/property/rate data for 7,919 web-booked guests (Apr 8–Sep 14, 2026) at 8 properties. No address/card/passport. Disclosed Oct 7.
Suspicious access from early Oct 5, 2026. Personal data in 195 accounts (88 members / 107 staff etc.) may have been viewed; disclosed Oct 7. No payment data held.
HIS announced on its website on October 7, 2026, after completing its review, that unauthorised access to the file server of Thailand subsidiary H.I.S. TOURS may have exfiltrated data.
Possible data leak: On Oct 6, 2026 illicit mail was sent from the Shibusawa MIX admin system. About 2,200 applicant names/emails were viewed; 3 had further details viewed; some registration data altered. Exfiltration/misuse not confirmed. Disclosed Oct 7.
Suspicious server access on Oct 3, 2026; software feature abuse led to exfiltration of member ID/name/email/phone for up to 1,735,154 app/online-store members. Address/DOB/cards/passwords/purchase history not leaked. Disclosed Oct 6.
Intrusion from Sep 24, 2026; site defacement Sep 29. Membership/event/inquiry name/email (sometimes address/phone) for up to 15,959 records may have leaked; disclosed Oct 6.
On Oct 4, 2026 intrusion into the usage-history service caused 521 automatic emails containing card number, DOB and email. No name/address/phone/ride-history leak. Service stopped same day. Disclosed Oct 6.
Between ~20:30 Oct 2 and ~08:00 Oct 3, 2026, illicit admin login and malware on i-ask may have exfiltrated enquiry DBs for up to 5 client tenants on the same server. Blocked same morning; public notice Oct 6. Up to 713,126 enquiry-unit records (duplicates possible). Name/email/enquiry text etc.
Vendor SC’s servers holding Citizen web inquiry forms were compromised Oct 2–3, 2026; about 100,000 name/address/phone/email records may have been taken. No intrusion into Citizen EC/member/internal systems. Disclosed Oct 6.
Nakabayashi announced on October 6 that ApplyNow, used for 2020-2023 graduate hiring, reported on October 5 that unauthorised access had leaked applicant data.
Possible data leak: SQLi on Oct 2, 2026; traces found Oct 3. Illicit admin account used to export customer/order data. Up to 54,916 records (shop name, address, phone, email, orders). No cards/bank/passwords. Disclosed Oct 6.
Possible data leak: A staff account was phished; on Aug 26, 2026 spoofed mail went to 463 of 967 address-book contacts. Name/email contacts appear leaked; disclosed Oct 6.
Possible data leak: Enterprise-facing pages included student name/email in response payloads viewable via browser developer tools (not on the normal UI). Disclosed Oct 5, 2026. Lead cites up to 314,009; page uses max-style framing → blank.
An Amazon Pay donation restore bug left 254 application records viewable to other users between Nov 13, 2025 and Sep 7, 2026 (name/address/phone/email/shipping). Fixed. Disclosed Oct 5.
Suspicious access to Machi Talk beta found Oct 2, 2026; service stopped Oct 5. At least one email confirmed leaked; DOB/sex may also have leaked. Counts under review.
Unauthorized access to the official app confirmed Sep 15, 2026. Personal data on 174,933 registrants (Nov 1, 2024–Sep 15, 2026, including churned) may have leaked; disclosed Oct 5. Passwords on a separate server out of scope.
Temairazu reservation-system intrusion may have exposed guest personal data; disclosed Oct 5, 2026. Suspicious messages seen for some reservations made by Sep 21 with stay on/after Sep 21. No card data held. Related to the Temairazu root incident.