Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
An HDD removed for disposal from a cardiac exam device and stored in a locked warehouse was found missing on April 16, 2026 and remains unfound. It held exam data from Dec 1998–Dec 2023. Disclosed July 31. No confirmed external leak or misuse.
Possible data leak: Some customer-loaned tablets returned to Hacobu were later lost in internal handling. Depending on return state, a third party might have logged into the service and viewed driver name/phone/email/company entered at booking. No confirmed external exfiltration.
After a ~Sep 2023 EHR refresh, old PCs were sent to a waste contractor for physical HDD destruction, but drives were not destroyed, were built into other parts and sold online. Sensitive patient name/DOB/clinical data had leaked; disclosed July 30, 2026.
From 15:20 to 22:28 on July 23, 2026 a settings flaw on the Hareruya2 Pokémon lottery left applicant data externally viewable. Four accesses were logged without copy/download; no misuse found; disclosed July 30.
On July 27, 2026 the agriculture guidance center emailed 125 new farmers with recipients in To instead of Bcc, exposing emails and some display names to each other; noticed after a recipient report; disclosed July 29.
On July 13, 2026 Suginami mailed a lifestyle survey to 3,000 sampled residents; labels for 121 foreign nationals wrongly included nationality. Caused by selecting the wrong export field. An anonymous tip on July 25 led to the July 29 disclosure.
The life-insurance contract inquiry system allowed viewing other users’ personal data via certain external operations. Flagged by a security firm; first notice July 29, 2026. Investigation found a guest-user permission mis-grant from 2021-07-01 until the July 27, 2026 shutdown.
Possible data leak: Unauthorized server access noticed June 23, 2026. Attacks on multiple servers were confirmed and external leakage of customer data could not be ruled out; disclosed July 28 (following a July 2 outage notice). Headcount still under investigation.
Possible data leak: After parking vendor Meitetsu Kyosho’s server compromise, leakage of monthly-parking customers (2018-07-01 to 2024-10-31) could not be ruled out; disclosed July 28, 2026. Same-batch related link to the Meitetsu root to be appended after commit.
Possible data leak: Between the Aug 1, 2025 release and the July 13, 2026 fix, an auth-design flaw could under certain conditions let third parties view customer data; disclosed July 28. Fixed; no confirmed viewing or misuse.
For the “Kizuna Kama” kids program across 10 venues, response-visibility settings were wrong so co-venue applicants could see each other. A registrant reported it July 7, 2026; fixed immediately; disclosed July 28. Not exposed to the open internet.
Vulnerability-driven intrusion and file tampering (malware implant) confirmed. Possible exposure of customers who paid by card from 2017-11-09 through site stop on 2026-06-30; disclosed July 27.
Possible data leak: A work USB holding FY2025 specific and late-elderly checkup target data went missing inside the town hall; on July 9, 2026 it could not be located; disclosed July 27. No misuse found, but leakage cannot be ruled out.
On July 21, 2026 the prefecture emailed town child-support recipient files and wrongly attached all eight towns’ files to each town. One town opened then deleted; the others deleted unopened; disclosed July 27.
The RA Connect system (Kevzara patient support for Asahi Kasei Therapeutics) was intruded on June 15, 2026; acquisition from web-public files confirmed July 11; disclosed July 24.
Intrusion into OCS FAMILY LINK SERVICE servers leaked personal data. Second notice (2026-07-24) disclosed possible exposure; third confirmed leakage; fourth attributed it to a program vulnerability in part of the service.
As program sponsor, disclosed July 24 after contractor CMIC HCI’s system (intruded June 15, 2026) was found to have leaked program-related personal data. Same-batch related link to the CHI root to be appended after commit.
Possible data leak: Unauthorized access via a vulnerability in website software. First notice July 24, 2026; investigation results August 7. External exfiltration not confirmed.
A regional farm plan PDF updated March 30, 2026 left farm-operator names readable. Staff noticed July 17, replaced the file, and disclosed July 23.
On the morning of July 16, 2026 staff mis-changed admin settings on the web application form so that until just after 13:00 all applicants could view others’ data; a junior high reported it, settings were fixed, and the prefecture disclosed July 22.