Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Possible data leak: After RIZAP reported an unapproved generative-AI upload, disclosed Sep 4, 2026. 726 people across 14 branches. Cards/accounts/credentials out of scope.
Possible data leak: RIZAP fed 19,996 records into an unapproved generative-AI tool (1,167 of them Dokenpo’s). Third-party viewing/training use denied per the notice.
Possible data leak: An employee uploaded specified health-guidance target data to a personal generative-AI service. The vendor said training use did not occur. Headcounts are published by each client; IHI kenpo, Dokenpo, Chikyosai and others disclosed separately as victims.
On the contractor-run “52 Seats of Bliss” booking site, encoded post-booking contact notes were externally decodable from Jan 9, 2025 to Aug 27, 2026; disclosed Sep 2.
Possible data leak: After RIZAP reported an employee fed target data into a generative-AI tool, disclosed Sep 2, 2026. 210 members. Cards/accounts/passwords not included per RIZAP.
Possible data leak: Unauthorized access to the biodiversity-center “survey club” pages was flagged via prefectural police and disclosed Sep 1, 2026. Data for 1,963 members were stored; no confirmed leakage yet; investigation ongoing.
Unauthorized access to some systems confirmed Aug 28, 2026. Credential misuse may have exposed up to ~19k staff records and ~36k external email contacts; disclosed Sep 1. Business files/passwords not confirmed leaked.
A staff mailbox was compromised; 424 records (name, address, email, employer etc.) leaked and spoofed mails were sent; disclosed Sep 1, 2026. No card data held.
An adjunct’s class SNS “hyocom” left student/alumni name, student ID, grades, photos etc. viewable online or to members; disclosed Sep 1, 2026. 1,448 people.
An employee, posed as helping a police inquiry, downloaded business-card records on Aug 17, 2026 and emailed them to a scammer. Internally discovered Aug 24; disclosed Aug 31.
During a major renovation move at Yamagata Junior High, health and dental records for all 387 students went missing. Noticed July 28, 2026; parent briefing Aug 28; disclosed Aug 31.
Possible data leak: Unauthorized server access confirmed Aug 27, 2026; services paused and a status page published around Aug 30. Intrusion into a shipping-info server was confirmed, but the Oct 28 final report found no evidence of viewing/exfiltrating DB personal data.
Yellow Hat detected unauthorised access to its web service-booking system in August 2026, announced a possible leak on August 28, and confirmed customer data was exfiltrated in its October 15 second report.
Unauthorized access to an external cloud holding construction records may have exposed customers’ names/addresses etc.; disclosed Aug 28, 2026.
Minimum-wage basic-survey forms went missing in transit; possible exposure of establishment and worker-related fields totaling a gross 339 people was disclosed Aug 28, 2026.
A phishing mail harvested an EC-platform staff account; unauthorized login and bulk customer export occurred Aug 22–23, 2026. Parent Treasure Factory disclosed Aug 28. 136,464 people (109,311 with addresses). Cards and storefront passwords out of scope.
Possible data leak: Unauthorized access to the Co-op Yamaguchi LINE mini-app disclosed Aug 28, 2026. Second report listed several category counts (members with/without e-money cards, reservation users, etc.). Cards, bank accounts, passwords and sensitive personal data out of scope.
Review of dashcam-upload system Z-Dash found a vulnerability and possible personal-data exposure from unauthorized access on Apr 1 and Apr 6, 2026; disclosed Aug 27. Video, cards and bank accounts out of scope.
Forensic work on Delightful’s Meruhaikun intrusion confirmed 2,255 of COO’s newsletter emails were in the leaked set; disclosed Aug 27, 2026. Vendor root to be linked later.
Unauthorized access to CINRA JOB disclosed Aug 27, 2026. Final report: a program vulnerability let attackers obtain credentials; 21,508 members (incl. withdrawn) may be in scope (name, DOB, sex, address, etc.); no confirmed misuse.