Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
In early Sep 2026 a contractor reported losing one business PC. Possible contents: customer email addresses only (no name/address/DOB). No misuse found. Disclosed Sep 14.
Unauthorized access via a website vulnerability confirmed Sep 8, 2026; first notice Sep 14. Oct 14 follow-up: name, organisation, address, phone, email and enquiry text from contact forms may have leaked. No headcount published.
Possible data leak: Six faculty/staff accounts (5 in the Sep 14 report, +1 staff in the Oct 27 update) were phished and used to send 3,977 spam messages. No large exfiltration found, but some mailbox data access cannot be ruled out. University-level notice first dated Sep 14, 2026 (page fetched as Oct 27 update). Separate from faculty-specific notices.
Possible data leak: On Sep 11, 2026 ~15:00–17:50, Dozle Store checkouts were redirected to a non-official page via a third-party Shopify app. Payments on the fake page were not accepted as Dozle orders. Impact on Dozle-held customer data still under investigation; disclosed Sep 12 (updates Sep 15/18).
Summary view was left enabled on the symposium form from Aug 24–Sep 10, 2026, exposing other applicants’ name, email and optional questions. 149 people. Disclosed Sep 11. No cards/accounts/passwords collected.
After a Jul 29, 2026 tip, investigation found phishing of six staff M365 accounts with traces of 5,417 mail views and 3,272 file views (2,798 downloads). Disclosed Sep 11. No person-level headcount given.
After ApplyNow’s Sep 9, 2026 disclosure, the vendor reported on Sep 10 that FY2022–FY2026 presentation-video exam applicants’ name, email, phone and exam numbers may have been taken (~800). City disclosed Sep 11. Video files out of scope.
Misused telephone-system credentials enabled customer-data access.
Mass file access detected Jun 25, 2026; VPN appliance intrusion confirmed Jul 9. About 246,000 staff/related personal records may have leaked; disclosed Sep 11. Public citizens’ data, My Number and bank accounts out of scope.
A Sep 6, 2026 proposal mail put recipients in To instead of BCC, exposing 339 addresses. Disclosed Sep 10. No other fields leaked.
External media used to migrate data from Nippon Maru went missing in Jul 2026; passenger/crew personal data may have been on it; disclosed Sep 10. Counts still under review.
An information-disclosure file’s masking could be undone, revealing withheld fields. Scope: 536 students (gross) in tuition-waiver records. Disclosed Sep 10, 2026.
A contractor furusato campaign survey let respondents view prior answers (address, name, phone, email) from Aug 31–Sep 1, 2026. 218 respondents. Disclosed Sep 9.
A vulnerable analytics tool enabled access to service databases.
One staff mailbox was phished and used to send spam. Stored personal data may have been viewed; disclosed Sep 8, 2026. Separate from the Law faculty incident.
A staff email to a business partner wrongly attached fan-club data (15,612 people as of Jul 3, 2026); 2 of 11 recipients opened it. Occurred Sep 2; disclosed Sep 8. Cards/accounts out of scope.
Possible data leak: Unauthorized access to 6 Google accounts (4 students, 2 alumni) from Apr 27–Aug 24, 2026 sent 17,668 spam messages; one faculty name/email appeared in a body. Disclosed Sep 8.
Infrastructure intrusion may have exposed name/address/email of students/staff from the merged universities; first notice Sep 7, 2026. Hospital patient data not confirmed; counts under review.
Legacy Shopserve (Estore) was breached May 21–Aug 1, 2026; on Aug 31 King Jim learned past store customers were in scope and disclosed Sep 4. Current EC out of scope. Cards/passwords not confirmed leaked.
On Aug 27, 2026 a case Teams team wrongly added ~3,500 external and ~2,500 staff accounts; invitees could see each other’s usernames/emails until same-day deletion. Court notices index dates the apology Sep 4.