Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
A breach at Yumirulink’s Cuenote FC leaked 140,443 email addresses of some newsletter subscribers and campaign entrants. An October 30 update corrected the initial notice: sex, prefecture and member codes were not leaked.
Possible data leak: Resona Bank, jointly with Saitama Resona and Kansai Mirai, announced on October 27 that Ymir Link's Cuenote FC breach likely exfiltrated group customer data used for email delivery.
Possible data leak: Saitama Resona Bank, jointly with Resona and Kansai Mirai, announced on October 27 that the Ymir Link email-contractor breach likely exfiltrated group customer data.
Possible data leak: Kansai Mirai Bank, jointly with Resona and Saitama Resona, announced on October 27 that the Ymir Link email-contractor breach likely exfiltrated group customer data.
Member names, email addresses, phone numbers and other fields were exposed.
Bandai Namco Entertainment and BANDAI SPIRITS announced on October 27 that THE GUNDAM BASE MEMBERS email addresses leaked through the breach of Ymir Link, the Bandai Namco ID email contractor.
Possible data leak: Rakuten said customer data was targeted by unauthorised access to some overseas-hotel booking pages run by subsidiary Rakuten Travel Xchange (detected September 10) and to the Rakuten Travel multilingual site (detected October 20).
Possible data leak: ValueCommerce announced on October 26 that address-book data appeared to have been exported from Cuenote FC; a October 30 update reported 6,096 unique emails (7,588 gross).
Possible data leak: Cybozu announced that on October 26 Ymir Link said emails and related data in its Cuenote FC environment were likely leaked—after saying on October 20 that Cybozu was out of scope.
Yakult confirmed and announced a website intrusion on October 26, 2026, and in its October 30 second report confirmed personal data of inquiry-form users and others had leaked.
Possible data leak: Mainichi Shimbun announced on October 26 that Ymir Link said some Cuenote FC data used for newsletters was likely taken externally, and stopped delivery that day.
Nomura Securities announced on October 23 that Ymir Link, which emails i-Port subscribers, reported on October 22 that unauthorised access may have leaked stored email addresses and related data.
The foundation announced (page updated November 4) that Rakus Light Cloud's Blastmail, used for its "Mail de Ernab" newsletter, may have leaked recipient data after an intrusion notice.
Capcom found traces of unauthorised access to CAPCOM ID on October 19, 2026 and confirmed a leak of registered data and unauthorised password changes on some accounts.
DNP announced on October 21 that Ymir Link, email contractor for its honto bookstore, reported on October 19 that unauthorised access may have leaked honto customer data.
Osaka University was told by contractor NEC on October 9 that files containing university personal data had been downloaded by a third party on September 26.
Unauthorised access at subsidiary RAKUS Light Cloud’s Blastmail led to removal of all customer-account records including company/contact names, contacts and contract/payment histories; some delivery lists were also leaked.
In a fifth report on October 21, Osaka Metropolitan University said NEC reported on October 20 that a subcontractor attacked in late September used legitimate accounts to access university systems, and that university-related personal data in NEC cloud storage had leaked.
NEC announced on October 20 that a development/maintenance subcontractor was attacked in late September, stolen credentials were abused, customer environments were accessed and files in a shared cloud storage—including personal data—leaked.
Possible data leak: NTTPC issued a caution on October 20 after Ymir Link's Cuenote FC, used for service email, was breached and data taken externally; impact on its customers was not confirmed but could not be ruled out.