Confirmed
Sheppard Mullin: documents disclosed after attorney was socially engineered
On August 31, 2026, one attorney fell victim to sophisticated social engineering, resulting in certain documents being disclosed to an unknown third party.
Data breaches
Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Investigating
Greencoop Fukuoka: work-PC theft may have exposed personal data in 33,526 records
Possible data leak: On Sep 17, 2026 a work PC was stolen from a parked vehicle. 33,526 records (Saga paused members 367; Fukuoka bottle-milk bookings 33,118; traffic-accident-related 41). No bank/card/email. No confirmed external misuse. Disclosed Oct 2.
Investigating
Dai-ichi Life: employee and retiree data may have leaked from HR-system intrusion (about 120,000)
Dai-ichi Life detected unauthorised access to its employee HR system on September 24, 2026 and said employee and retiree data may have been viewed and leaked.
Investigating
JOGMEC: system intrusion may have exposed about 8,500 email addresses
After an external tip, JOGMEC confirmed on Sep 9, 2026 that a system intrusion may have leaked personal data: ~1,100 staff emails and ~7,400 external emails. Sub-counts not summed → blank. Disclosed Oct 2.
Investigating
Crystal Jemmy: Sagawa parcel-inquiry intrusion may have exposed customer shipping data
After Sagawa announced intrusion into its parcel-inquiry service that may have exposed sender/recipient name/address/phone, Crystal Jemmy posted on Oct 2, 2026 that its customers may be in scope. Counts/confirmation pending. Cards/passwords out of scope per Sagawa.
Investigating
Miyoshi City: ApplyNow intrusion may have exposed 1,035 recruitment-applicant records
ApplyNow intrusion may have exposed name/email/phone for 1,035 applicants from FY2022–2024 video interviews; city learned Sep 30 and disclosed Oct 2, 2026. Video files out of scope. Data retained after contract end.
Investigating
Safer Internet Association: Sakura rental-server intrusion may have exposed reporter and contact data
After Sakura Internet reported intrusion on its rental server, SIA disclosed on Oct 2, 2026 that name, email, hotline reports, inquiries, event sign-ups and mail content may have been viewed/acquired. Actual access not confirmed. No count.
Investigating
ZonExpert: compromise of delegated Amazon seller accounts may have exposed buyer personal data
Delegated Amazon Seller Central user accounts were illicitly altered, potentially allowing viewing of buyers’ name/address/phone/order history for Aug 8–18, 2025. No card data. Actual viewing/acquisition not confirmed. First public notice Oct 1, 2026.
Confirmed
JAEA: intrusion into JRR-3 research-support site leaked ID images etc. for 175 people
Unauthorized download of 2,419 files from the research-support site found Sep 25, 2026; personal data confirmed Sep 29; disclosed Oct 1. 369 user-uploaded files (175 people) including photo IDs (some with My Number), special health-check results and radiation-worker certificates. Account credentials out of scope. Oct 30 update refined counts.
Investigating
Aldrich reports possible exposure after email account compromise
An employee email account was accessed by an unknown individual on August 22–23, 2026; personal information in the account may have been affected.
Investigating
Ticket Plus: Tixplus cache-setting change may have briefly shown other users’ personal data
After a Sep 28, 2026 cache-setting change, concurrent hits on certain pages could show another user’s name/address/phone/email/card last-4. Up to 107 people’s data may have been shown; up to 322 users may have seen others’ data. Disclosed Oct 1. Sub-counts not summed → blank. App/Trade out of scope.
Investigating
Nishiyamato Academy reports possible personal-data exposure
Unauthorised network access was identified around March 27, 2026; potentially impacted files contained personal data.
Confirmed
Yoshinoya HD: ApplyNow platform intrusion leaked part-time applicants’ and hiring-staff data
ApplyNow platform used by Yoshinoya/Hanamaru (Apr 2022–Jun 2024) was breached Aug 9–Sep 7, 2026. Leaked Interview Cloud applicants (4,998 Yoshinoya / 368 Hanamaru), recording-interview applicants, and 418 hiring-staff accounts; disclosed Sep 30. Sub-counts are not summed.
Investigating
Osaka Kyoiku Bunka: support-scam on Ikiiki PCs may have exposed children’s and parents’ personal data
Possible data leak: Support-scam remote-access apps on after-school PCs left children’s (1,261), parents’ (953) and staff (58) personal data viewable for ~15–50 minutes; foundation and Osaka City disclosed Sep 30, 2026. No outbound transfer found in the reviewed scope. Sub-counts not summed → blank (Osaka City text says “up to 2,272”).
Investigating
Nabari Kintetsu Gas: Ryomo ransomware may have exposed about 6,800 propane customers’ data
Ryomo file-server ransomware may have exposed ~6,800 propane customers’ name/address/billing IDs; disclosed Sep 30, 2026. City/community gas out of scope. No bank/card data.
Investigating
American Family Connect: driver’s licence numbers may have been obtained via quoting flow
Between June 30 and August 20, 2026, a third party used personal data obtained elsewhere to generate auto-insurance quotes and may have acquired driver’s licence numbers in the process.
Confirmed
Manns Wine: Shopserve intrusion leaked legacy online-shop customers’ personal data
Legacy Shopserve was breached May 21–Aug 1, 2026; Manns Wine online-shop members/orders from Apr 2006–Sep 22, 2025 were in scope (vendor report Sep 28–29); disclosed Sep 30. Current EC migrated Sep 25, 2025 and is out of scope.
Investigating
G-Plan: G Point system intrusion may have exposed up to about 70,000 member identifiers
Anomaly on Sep 25, 2026 confirmed unauthorized access to G Point; service stopped same day. Possible exposure: up to ~70,000 member identifiers. Scope still under investigation; disclosed Sep 30.
Confirmed
Benefit One: survey-download bug exposed personal data on 13,460 employees to another company admin
A Jun 2025 survey-download bug showed other companies’ employee data. Reported Jul 30, 2026 by one admin. Scope: 2,322 organisations / 13,460 people. Only that one download occurred; data deleted. Disclosed Sep 30.
Investigating
Hiroshima Gas: investigating possible customer-data impact from Ryomo Systems intrusion
Possible data leak: Following Ryomo Systems’ internal-network intrusion (maintainer of Hiroshima Gas customer systems), the company posted on Sep 30, 2026 that customer-data leakage was not confirmed at that time and review continues. Related to the Ryomo incident.