Investigating
Possible personal-data leak after unauthorized access to Raksul print-submission systems
Raksul confirmed unauthorized access using compromised credentials and said personal information within print and related data may have leaked.
Data breaches
Data breaches
Sources first · Counts reflect this database, not worldwide incident totals.
Confirmed
SEGA reports 2,196,044 newsletter email-address records exposed through Arara
SEGA said 2,196,044 email-address records used for some SEGA and SEGA FAVE newsletters were exposed at mail-service contractor Arara.
Confirmed
Seoul PASS confirms reservation-data leaks on two access occasions
Travolution disclosed on November 9 that unauthorized reservation viewing on November 6 and 8 leaked some Seoul PASS customer information.
Confirmed
Waseda confirms acquisition of 3,342 authentication-related user records
Waseda disclosed on November 9 that unauthorized access on August 31 obtained 3,342 records containing names, campus emails and encrypted password information among other fields.
Investigating
2rinkan reports possible personal-data leak at roadside-service contractor
Unauthorised access at Prestige Core Solution may have exposed some roadside-assistance customers’ personal information. The count and precise fields remain under investigation.
Confirmed
Shiseido confirms exposure of 2,515 skin-analysis data records
Shiseido confirmed 2,515 exposed records including names, email addresses, questionnaire data and skin-analysis results following unauthorized access to its FCA system.
Investigating
Possible leak of SmartNews partner emails and internal user IDs
SmartNews disclosed on November 6 that unauthorized access on October 31 may have exposed publisher and advertiser contacts and some internal user IDs.
Confirmed
M1 discloses breach involving customer identity and contact information
M1 identified a customer-data breach on October 30 and disclosed it on November 6. Impacted data includes names, NRIC/FIN numbers, birth dates, mobile numbers, email and addresses.
Confirmed
Customer data exposed at DOCOMO Online Shop and My docomo
NTT DOCOMO confirmed customer-data exposure after unauthorized access to the two services, describing the scale as at most approximately 300,000 records.
Investigating
Eight Dentsu inquiry records potentially exposed via Studio
Dentsu reported potential exposure following an incident at its service provider.
Investigating
RevSpring reports possible patient-data access via support tool
An unauthorised person may have gained access to a support tool usable to obtain patient information; diagnosis and treatment details were not included.
Investigating
Hoag Hospital reports possible file access
Investigation of suspicious activity on October 8, 2026 found files may have been accessed without authorisation.
Confirmed
Nomura IR Kikan Navi breach exposes investor and analyst information
Unauthorised access to the Kikan Navi investor-relations service led to downloaded data including about 2,000 investor/analyst records and about 250 former-employee records.
Confirmed
Center Theatre Group: file with SSNs mistakenly sent to state agency
On July 27, 2026, an employee inadvertently provided California’s EDD with a file containing names and SSNs of current and other personnel.
Confirmed
Asoview discloses 15,821,184 member records exposed through Arara
An attack on email-service provider Arara exposed 15,821,184 Asoview member records. This is a record count and must not be added to the provider-wide total as a separate population.
Confirmed
7NOW delivery-customer data exposed through contractor
The incident affected CBcloud’s PickGo delivery service.
Confirmed
Suntory group external-cloud data breach
An intruder downloaded files containing personal information.
Confirmed
Cotton Incorporated: user database export exposed and downloaded
During a CottonWorks.com hosting migration, a user-database export was made public and downloaded four times by unknown parties between September 18 and October 15, 2026.
Confirmed
Prestige International: up to about 5.5 million roadside-service records taken
Customer names, contacts, vehicle, incident/breakdown details and some bank-account information were removed from a roadside-assistance operations system. The figure is up to about 5.5 million records including duplicates.
Confirmed
EyeMed sends member file to wrong email address
On September 22, 2026, a file with plan-member information was sent to an incorrect email address; it may include names, addresses, dates of birth and SSNs.