Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
In the early hours of August 6, 2026, attackers entered via a network device, took business documents from group servers and devices, and deployed ransomware. The first report was published the same day.
Possible data leak: An incident on work tool BAND occurred July 10, 2026 and was recognized as unauthorized access on July 15. Some members and staff (name, DOB, address, phone, email, etc.) were in scope; individuals notified by Aug 5; disclosed Aug 6. Cards, bank accounts and My Number not handled on BAND.
Suspicious activity on managed mailbox info@e-house.co.jp on July 22, 2026 led to lockout and investigation. Possible leak of name/email/phone/company name/address disclosed Aug 6. Aug 21 update confirmed spam misuse of the account.
An external HDD left on a faculty desk was found missing on June 15, 2026 (taken out in early April for migration). It held FY2023–2024 grades, exams, attendance, guidance notes, etc.; disclosed Aug 5.
On Aug 4, 2026 an external tip indicated some staff accounts in the mail/work environment may have been misused; disclosed Aug 5. No impact on core news/editing systems.
Defacement of the Yamanakako seminar-house booking site was found April 22, 2026 and attributed to likely unauthorized access. Possible leakage of booking users from 2022-05-09 to 2026-04-22 disclosed Aug 5.
Possible data leak: A bullying investigation committee report posted July 23, 2026 had inadequate personal-data protection; noticed Aug 3 and disclosed Aug 4. Posting stopped, corrected and re-posted; individuals notified. No published count/fields.
Possible data leak: On the contracted on-demand learning site “KYOiku TV”, names and registration dates of members using Favorites were viewable by anyone; some also appeared in search results. Feature/site stopped; disclosed Aug 4.
Chubu Electric learned of unauthorized access following an external tip on July 29 and disclosed on August 4 that staff-related email and contacts may have been viewed or leaked.
GitHub credentials in a development config were obtained and used to access repositories. Customer data stored during analysis/development was exfiltrated. Confirmed-notice count corrected to 62,689 people.
A procedure document for one merchant wrongly included admin credentials that could view other merchants’ customer data from March 26 to June 23, 2026. That merchant said it did not view the data. Not exposed to the open internet. Disclosed Aug 3.
Group lodging facilities were intruded from the evening of July 29 through the morning of July 30, 2026; possible external leakage of guest names/contacts disclosed Aug 3. Stay details and card numbers stated not leaked. No headcount.
Takeout ordering site intruded on July 29, 2026; possible exposure of Mar–Jul 2026 orderers’ name, kana, phone, email and order details (including guest/cancel); disclosed Aug 3. Payments held by external processor.
On the Kitakyushu HS trial-enrollment site, a confirm button exposed other applicants’ data. From July 3–24, 2026, 293 applicants’ names (kana) and questions were viewable; a junior high reported it; disclosed Aug 3.
Possible data leak: On July 27, 2026 an employee entered credentials on a partner-spoofing phishing page. On July 30 attackers logged into the work mailbox, stole contacts and phished 553 of them impersonating the employee; disclosed Aug 3.
On July 13, 2026 Chikugo agriculture-forestry office staff emailed 11 municipalities/farm groups a survey and wrongly attached a file with 300 applicants’ names, ages, subsidy amounts, etc.; deletion confirmed; disclosed Aug 3.
From May 21 to August 1, 2026, attackers exploited an application vulnerability on ShopServe servers and sent database contents out. Estore detected and blocked it on August 1 and announced it that day.
EPARK Relax & Esthe announced on July 31 an intrusion into its PeakManager booking platform. Its September 24 second report confirmed the customer database was transferred out and then deleted (since restored).
Possible data leak: Corporate site was intruded via a vulnerability from July 18–30, 2026; investigation found inquiry/recruitment-form DB contents were viewable/obtainable by third parties; first notice July 31. No published count.
Og detected unauthorized access on July 27 and announced on July 31 that information of 44,399 Travel Plan customers may have been viewed or leaked.