Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Possible data leak: After the April 2, 2026 cyber-attack on YCC Information Systems, the town disclosed that its FY2016 care-prevention survey data had remained on the vendor’s server.
After seeing sales claims on an overseas site on April 11, 2026, STARTDASH found third-party access to an internal log console from April 1–6 and disclosed possible exposure of 39,267 users on April 14.
Possible data leak: After disclosing a GitHub-credential-origin intrusion from early April, a April 24 update reported DB-access traces and 225,846 unique people in scope. No card data.
After announcing a system outage on April 14, 2026, a follow-up said attackers stole account credentials, entered the network and may have viewed or taken partner-employee personal data.
After Nippon Telenet (subcontractor of UPR) was attacked on March 9, 2026, Mobility Platform was told on April 13 that MaaS Car-related data may have leaked and disclosed April 14.
Possible data leak: Contractor Higashiyama Sangyo suffered ransomware on March 10, 2026, reported April 3 and Nambu disclosed April 13. No impact confirmed on Nambu’s own systems.
After Nippon Telenet’s March 9, 2026 ransomware event, UPR was first told it was out of scope, then on April 8 told its car-share call-centre data may have leaked; disclosed April 13.
Possible data leak: After a late March 16, 2026 intrusion that halted core systems and encrypted servers, an April 13 filing said some outbound transfers were seen, limited to employee-type fields without customer PII.
A mail to 108 in-prefecture travel-agency contacts used the To field so addresses were mutually visible.
Unauthorised access to a fuel-procurement system resulted in copying of names, company names, phone numbers, email addresses and other data about personnel, former staff and business contacts. No count was disclosed.
On March 28, 2026 a uniform pick-up notice was sent with To instead of Bcc; a deletion request followed the same day and an apology was posted April 9.
After recognising possible unauthorised access on April 6, 2026, a full investigation from April 8 confirmed intrusion and data theft; disclosed the same day. Many realtor customers issued victim-side notices.
The health-promotion section found a 2025 fiscal-year counseling reservation book missing and disclosed on April 8, 2026, mailing apologies to those listed.
After an IT-environment intrusion, Murata’s April 6 second and April 27 third notices said about 73k employee-related and about 15k external-contact records may have been taken.
After detecting a cloud-server outage on March 11, 2026 and confirming ransomware-style intrusion, the clinic disclosed on April 6 that personal data of 369 patients had been taken.
Ransomware on the file server was confirmed early on April 2, 2026 (first notice April 3). The April 14 fourth notice said entrusted partner data may have leaked; the May 20 fifth notice found no clear outbound traces but did not fully rule out access.
On March 25, 2026 an internal mail with a guest CSV was wrongly sent to one contractor employee; deletion was confirmed the same day and disclosed April 3.
From 28 Nov 2024 contractor SocioFuture sent ostensibly cleared templates to another bank with customer data left in hidden sheets; discovered March 27, 2026 after the other bank noticed and disclosed April 3.
After an external tip on March 24, 2026, Awa Bank found its OA test environment had been accessed and customer-related data leaked; disclosed April 3. Separate from live banking systems.
A MetLife-seconded worker had improperly given the bank’s life-insurance contract data to MetLife; disclosed March 27, 2026 after MetLife’s report.