Investigating
Possible personal-data leak after unauthorized access to Raksul print-submission systems
Raksul confirmed unauthorized access using compromised credentials and said personal information within print and related data may have leaked.
Data breaches
Data breaches
Sources first · Counts reflect this database, not worldwide incident totals.
Confirmed
SEGA reports 2,196,044 newsletter email-address records exposed through Arara
SEGA said 2,196,044 email-address records used for some SEGA and SEGA FAVE newsletters were exposed at mail-service contractor Arara.
Confirmed
Seoul PASS confirms reservation-data leaks on two access occasions
Travolution disclosed on November 9 that unauthorized reservation viewing on November 6 and 8 leaked some Seoul PASS customer information.
Confirmed
Waseda confirms acquisition of 3,342 authentication-related user records
Waseda disclosed on November 9 that unauthorized access on August 31 obtained 3,342 records containing names, campus emails and encrypted password information among other fields.
Confirmed
Sato Food Service: 318,513 Sato Kids Club email addresses leaked via Arara
Sato Food Service confirmed on November 5, and announced in its November 7 second report, that Sato Kids Club email addresses were taken in the breach of Arara, used via GMO Commerce.
Confirmed
Signal Talk Maru-Jan: member email addresses and passwords leaked after intrusion
Signal Talk confirmed that abuse of an admin-system function around November 4, 2026 allowed member data to be downloaded, leaking email addresses and passwords.
Confirmed
Pacific League Marketing: email addresses leaked via Arara (five clubs) and a Lotte Marines site intrusion
In its November 6 notice, Pacific League Marketing disclosed two events: email-address leakage via Arara Message used by five Pacific League clubs, and a separate intrusion into the Chiba Lotte Marines official smartphone site.
Investigating
MOTEX: customer data (company names, names, emails, phones) may have leaked after website intrusion
Parent KCCS announced on November 4 that MOTEX websites had been accessed without authorisation and, in a November 6 second report, said customer data may have leaked.
Confirmed
Thirty-Three Bank: data of 914 free-loan customers leaked via SMBC Consumer Finance guarantee breach
Thirty-Three Bank announced on November 6 that SMBC Consumer Finance, guarantor of its free loan, reported that a guarantee-system intrusion leaked data of 914 of the bank's customers.
Confirmed
TeamSpirit: 28,824 personal-data records of customer users and staff leaked via development-server intrusion
On October 27, 2026, TeamSpirit confirmed a third party logged into a development server and used credentials stored there to take data from its cloud environment.
Investigating
2rinkan reports possible personal-data leak at roadside-service contractor
Unauthorised access at Prestige Core Solution may have exposed some roadside-assistance customers’ personal information. The count and precise fields remain under investigation.
Investigating
JNSA: user data may have leaked after intrusion into its security-literacy check service
On November 4, 2026, JNSA found unauthorised access to its security-literacy check service and announced on November 6 that user personal data may have leaked.
Investigating
EDION: customer data may have leaked after intrusion into e-commerce site log storage
On November 5, 2026, EDION found unauthorised access to e-commerce log storage and announced on November 6 that some customer data recorded in those logs may have leaked. No access to the customer database itself was confirmed.
Confirmed
Shiseido confirms exposure of 2,515 skin-analysis data records
Shiseido confirmed 2,515 exposed records including names, email addresses, questionnaire data and skin-analysis results following unauthorized access to its FCA system.
Investigating
Bank of Okinawa: data of 211 Chekit loan customers viewed; possible leak via collection vendor
Possible data leak: The Bank of Okinawa announced on November 6 that unauthorised access to the LENDY Servicer negotiation-record system, used for Chekit loan collections, viewed data of 211 customers and that exfiltration is considered likely.
Investigating
Sendai City: My Number card reservation email addresses may have leaked via Arara breach
Sendai City announced on November 6 that unauthorised access to Arara Message, used for completion mail in the TKC-run My Number card reservation system, may have leaked applicants' email addresses.
Investigating
Possible leak of SmartNews partner emails and internal user IDs
SmartNews disclosed on November 6 that unauthorized access on October 31 may have exposed publisher and advertiser contacts and some internal user IDs.
Investigating
BitCash (WebMoney): some payment data may have leaked after unauthorised access
BitCash announced on November 6 that unauthorised access to the WebMoney system may have leaked some payment-related data.
Confirmed
Mitsui Direct: about 234,000 customer records leaked via website intrusion
Mitsui Direct detected unauthorised access to its website early on November 4, suspended all web and app procedures, and confirmed a leak of quote and policyholder data.
Confirmed
M1 discloses breach involving customer identity and contact information
M1 identified a customer-data breach on October 30 and disclosed it on November 6. Impacted data includes names, NRIC/FIN numbers, birth dates, mobile numbers, email and addresses.