Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Suspicious server access on Oct 3, 2026; software feature abuse led to exfiltration of member ID/name/email/phone for up to 1,735,154 app/online-store members. Address/DOB/cards/passwords/purchase history not leaked. Disclosed Oct 6.
Intrusion from Sep 24, 2026; site defacement Sep 29. Membership/event/inquiry name/email (sometimes address/phone) for up to 15,959 records may have leaked; disclosed Oct 6.
On Oct 4, 2026 intrusion into the usage-history service caused 521 automatic emails containing card number, DOB and email. No name/address/phone/ride-history leak. Service stopped same day. Disclosed Oct 6.
Between ~20:30 Oct 2 and ~08:00 Oct 3, 2026, illicit admin login and malware on i-ask may have exfiltrated enquiry DBs for up to 5 client tenants on the same server. Blocked same morning; public notice Oct 6. Up to 713,126 enquiry-unit records (duplicates possible). Name/email/enquiry text etc.
Vendor SC’s servers holding Citizen web inquiry forms were compromised Oct 2–3, 2026; about 100,000 name/address/phone/email records may have been taken. No intrusion into Citizen EC/member/internal systems. Disclosed Oct 6.
A September 4, 2025 network intrusion affected names and, where provided, SSNs, driver’s licence or state ID and passport numbers.
Nakabayashi announced on October 6 that ApplyNow, used for 2020-2023 graduate hiring, reported on October 5 that unauthorised access had leaked applicant data.
Possible data leak: SQLi on Oct 2, 2026; traces found Oct 3. Illicit admin account used to export customer/order data. Up to 54,916 records (shop name, address, phone, email, orders). No cards/bank/passwords. Disclosed Oct 6.
Possible data leak: A staff account was phished; on Aug 26, 2026 spoofed mail went to 463 of 967 address-book contacts. Name/email contacts appear leaked; disclosed Oct 6.
Possible data leak: Enterprise-facing pages included student name/email in response payloads viewable via browser developer tools (not on the normal UI). Disclosed Oct 5, 2026. Lead cites up to 314,009; page uses max-style framing → blank.
An Amazon Pay donation restore bug left 254 application records viewable to other users between Nov 13, 2025 and Sep 7, 2026 (name/address/phone/email/shipping). Fixed. Disclosed Oct 5.
On October 3, 2026, GMO Research & AI confirmed unauthorised access to infoQ servers, exfiltration of member data and fraudulent point exchanges.
Suspicious access to Machi Talk beta found Oct 2, 2026; service stopped Oct 5. At least one email confirmed leaked; DOB/sex may also have leaked. Counts under review.
Unauthorized access to the official app confirmed Sep 15, 2026. Personal data on 174,933 registrants (Nov 1, 2024–Sep 15, 2026, including churned) may have leaked; disclosed Oct 5. Passwords on a separate server out of scope.
Temairazu reservation-system intrusion may have exposed guest personal data; disclosed Oct 5, 2026. Suspicious messages seen for some reservations made by Sep 21 with stay on/after Sep 21. No card data held. Related to the Temairazu root incident.
Monogatari detected unauthorised access to the Yakiniku King app member system on October 2 and confirmed a member-data leak on October 3.
Staff Google Workspace accounts were illicitly logged into from late Jul 2026; email/name data on 1,646 people may have leaked. Found via Google notice in early Aug; passwords changed. Readers/sources not included. Disclosed Oct 4 (separate from the M365 incident).
Possible data leak: Staff Microsoft 365 accounts were compromised; about 9,000 spoofed emails were sent. Recipient emails/names and some message content appear leaked. Malicious mails on Sep 30, 2026; passwords reset; no further logins seen. Counts under review. Disclosed Oct 4.
On Sep 30, 2026, abuse of a feature gap may have identified 3,687 emails as Study Sapuri registrations; disclosed Oct 3. No name/password/payment exfiltration found. Fix completed same day.
Suspected intrusion late Sep 27–28, 2026 via illicit login and planted code reaching member/order DBs. Possible exposure of member ID, name, address, phone, email, DOB, sex and order details. Cards held by payment processor. Count unknown. Disclosed Oct 2 with individual emails.