Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Plenus said that on November 2, 2026 its outsourced provider reported unauthorised access to the Hotto Motto newsletter delivery service, leaking member data including email addresses.
Kracie announced that Kampoful Life member email addresses leaked through the Arara service used for its emails.
BOATRACE Promotion was told on November 3 that the Arara Message breach, used via Japan Leisure Channel, leaked recipient addresses of Telebote member newsletters and campaign mails.
Hasegawa was told on November 2 that Arara's repica service, used for email, had leaked recipient addresses, and announced this on November 4.
After detecting unauthorised access on the night of November 2, the insurer announced a partial service suspension on November 4 and on November 6 confirmed a leak of policyholder-portal users' data.
Aioi Nissay Dowa detected unauthorised access to its policyholder portal on the night of November 2, suspended related services on the 3rd, posted a notice on November 4, and announced a confirmed leak on November 6.
Monteroza learned on November 2 that newsletter members' personal data may have leaked through unauthorised access to its vendor Arara's servers.
Shochiku Multiplex Theaters announced on November 4 that the Arara Message breach used for SMT Members email had exfiltrated member registration data, with a confirmed count.
Dentsu Soken announced on November 4 that a misconfigured access permission in a client environment of its FACERE service allowed unauthorised access on September 10, 2026, and personal data may have leaked.
Workman was told that unauthorised access to Arara, which it uses for newsletters, leaked email addresses of Workman Online Store newsletter subscribers.
Seijo Ishii said Seijo Ishii.com newsletter members' email addresses leaked in the Arara server intrusion.
Camel Coffee was told on November 2, 2026 that unauthorised access to Arara, used via an external marketing service for its online-store newsletter, leaked subscribers' email addresses.
Possible data leak: Yokohama City announced on November 3 that unauthorised access was detected on the email-sending service used by its e-application system and that impact on the city's environment and any personal-data leak were still being checked.
Possible data leak: On October 30, 2026, Denny's Japan found that during the old-to-new app migration third parties had fraudulently created credentials and could access some accounts; it announced this on November 3.
An attack on email-service provider Arara exposed 15,821,184 Asoview member records. This is a record count and must not be added to the provider-wide total as a separate population.
The incident affected CBcloud’s PickGo delivery service.
Kinko's Japan announced on November 2 that unauthorised access to Arara Message, used for smart-membership newsletters, leaked member email addresses.
Life Corporation confirmed unauthorised access to its official app on October 30, 2026, and announced on November 2 that some point-card data may have been viewed.
ManpowerGroup Japan announced on November 2 (updated November 5) that unauthorised access to Arara's repica service, used by its email contractor, leaked email addresses of registered temporary workers and others.
Subway Japan first said on October 29 its customers were not affected, disclosed a possible leak on November 2, and confirmed it on November 5.