Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
J:COM announced the intrusion on June 23 and reported the scope on July 6 (updated July 21). Unauthorised access affecting J:COM began on May 16, 2026.
BIGLOBE announced on June 23 the intrusion into the KDDI mail system behind BIGLOBE Mail, and fixed the leaked count on July 6.
A staff email with the wrong attachment sent 1,529 personal-data rows externally; disclosed June 23, 2026 (distinct from the earlier student BCC incident).
After Meruhaikun intrusion, Tengai disclosed June 23, 2026; final report confirmed 1,834 registrants’ email/name etc. Vendor root to be linked later.
On June 17, 2026, KDDI found unauthorised access to the mail platform it provides to six ISPs and announced it on June 23. A vulnerability in third-party software used by the platform was exploited.
Chubu Telecommunications announced on June 23 the intrusion into the KDDI system behind commufa mail and fixed the leaked count on July 6.
KDDI Web Communications announced on June 23 the intrusion into the KDDI system behind CPI rental-server mail; access affecting it began on June 8, 2026.
Through the intrusion into the KDDI system behind Pikara mail, STNet customer mail data leaked between June 14 and 17. STNet announced it on June 23 and fixed the count on July 6.
After Meruhaikun intrusion notice, Unirita disclosed June 22, 2026 that company name, person name and email may be in scope. Count under investigation. Vendor root to be linked later.
Possible data leak: After Meruhaikun intrusion reports, ANDMAMACO disclosed June 22, 2026. No public count. Vendor root to be linked later.
Possible data leak: Suspected malware on some internal systems detected June 19, 2026 and isolated. Exfiltration not confirmed but under investigation; disclosed June 22.
Suspected third-party activity on Exchange Online mailboxes may have exposed information; disclosed June 22, 2026 with PPC report. Detail PDF unreachable; HTML notice used as source.
After Meruhaikun intrusion, JSEG posted June 22, 2026; later confirmed leakage; Aug 17 final report fixed 1,644 subscribers’ email and name. Vendor-wide totals belong on the vendor root and are not summed here.
Possible data leak: After Meruhaikun intrusion affecting its newsletter, e-Clinic disclosed June 20, 2026. Count still under investigation. Vendor root to be linked later.
Unauthorized access to web/mail servers confirmed May 1, 2026 (noticed June 8; first notice June 19; final Oct 28). No clear theft traces, but access was possible so exposure cannot be ruled out. Parent Hasegawa customers unaffected.
Possible data leak: After Meruhaikun intrusion reports, Kyoto Experiment posted and later updated that personal data theft was confirmed. No public count. Vendor root to be linked later.
Possible data leak: After Meruhaikun intrusion on a contracted Toki Fan Club mailer, Sado disclosed June 19, 2026. Of 9,028 members, 4,111 newsletter recipients are in scope. Vendor root to be linked later.
After Delightful Meruhaikun intrusion, Include disclosed possible exposure of B2B newsletter lists on June 19, 2026; second report confirmed 2,243 people. Vendor root to be linked later.
Possible data leak: First notice June 19, 2026 on Meruhaikun intrusion; follow-up confirmed leakage of service-admin and inquiry/contact records. Card data out of scope. Vendor root to be linked later.
Possible data leak: After Delightful’s Meruhaikun intrusion, JSPO posted a June 18, 2026 first notice; a follow-up confirmed email leakage. Vendor root to be linked later.