Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Mass unauthorized access detected Sep 26, 2026. Possible viewing of member/some-ex-member emails and some name/prefecture fields; second notice cites up to 442,779 people. Cards via external payment out of scope. First disclosure Sep 27.
Possible data leak: Ransomware against group servers confirmed early Sep 26, 2026. Some group sales systems disrupted. Exfiltration not confirmed but under investigation; disclosed same day. Rail operations unaffected.
Unauthorised activity was identified October 18, 2025; members’ data was among potentially impacted data.
Sensitive information including names, dates of birth and SSNs was inadvertently posted to a data-sharing platform.
On January 11, 2026, an unauthorised third party accessed some systems; personal information may be involved.
Amadeus platform used for LEGOLAND Japan Hotel bookings was breached; 1,557 reservations’ name/email/phone were in scope. No confirmed access to cards/passwords/passports. Disclosed Sep 25, 2026.
Third-party intrusion into ApplyNow’s recruiting platform (used for Maisen part-time interviews) leaked applicant personal data; disclosed Sep 25, 2026. No count on the page. One of the ApplyNow root-incident victim organisations.
Park24 detected unauthorised access to its Times Car car-sharing system on September 25, 2026, announced a possible member-data leak that day, and confirmed leaked ID-document images in its September 29 third report.
Anomaly on Sep 22, 2026 led to confirming unauthorized access. 1,536,322 reservation records (name, phone, email, shop/menu/time etc.) leaked; disclosed Sep 25 (Oct updates added support forms).
On Sep 7, 2026 a resident-system contractor mis-stored a Kotoura data file into another municipality’s private area; one staffer viewed it the same day and it was deleted. 828 people across several municipal datasets. No copy/print/external exfiltration found. Press notice Sep 25.
Unauthorized access via an EC admin-login vulnerability on Smaregi EC Repeat/B2B. Up to four merchant environments may be affected; customer/order/admin data may have been viewed or taken. Vulnerability fixed Sep 18; disclosed Sep 25, 2026.
Files containing personal information may have been accessed and acquired without authorisation between November 6 and 29, 2025.
On May 7, 2026, an unauthorised actor accessed systems and acquired stored files.
An unknown actor accessed some systems and downloaded files between January 19 and 27, 2026.
A vulnerability in the vendor-built pharmacy website let an unknown party access it with elevated privileges; names, addresses, dates of birth, health, insurance, prescription and payment-card data may have been involved.
Suspicious activity was identified; the investigation found files were downloaded by an unauthorised actor, with notified individuals’ data downloaded on May 1, 2026.
A ransomware attack discovered October 27, 2025 involved an unauthorised party accessing the network and acquiring files.
A private 2018 membership list was mis-attached to an Aicon Navi event filing and approved. Third-party viewing found Sep 20, 2026 and removed same day. 599 people’s name, age, education, occupation etc. Disclosed Sep 21 (org name added Sep 22).
On Sep 16, 2026 ApplyNow confirmed leakage of FY2022–FY2025 video-interview entrants; city disclosed Sep 19. 1,701 records (name, email, phone). Videos out of scope.
Metabase vulnerability exploitation detected Sep 16, 2026. Confirmed theft of registrant data: ~40k Azas and ~20k Suloop accounts; disclosed Sep 18. Passwords not managed in the system.