Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Unauthorized access via a website vulnerability confirmed Sep 8, 2026; first notice Sep 14. Oct 14 follow-up: name, organisation, address, phone, email and enquiry text from contact forms may have leaked. No headcount published.
Possible data leak: Six faculty/staff accounts (5 in the Sep 14 report, +1 staff in the Oct 27 update) were phished and used to send 3,977 spam messages. No large exfiltration found, but some mailbox data access cannot be ruled out. University-level notice first dated Sep 14, 2026 (page fetched as Oct 27 update). Separate from faculty-specific notices.
An unauthorised actor accessed one of Accela’s secure file transfer portals and acquired copies of files on December 11–12, 2025. Accela is notifying on behalf of government clients.
During unauthorised access to the local network between October 8 and 15, 2025, names, dates of birth, gender and Medi-Cal member IDs may have been accessed.
Possible data leak: On Sep 11, 2026 ~15:00–17:50, Dozle Store checkouts were redirected to a non-official page via a third-party Shopify app. Payments on the fake page were not accepted as Dozle orders. Impact on Dozle-held customer data still under investigation; disclosed Sep 12 (updates Sep 15/18).
Certain information may have been copied from the network by an unauthorised third party during activity on January 20–21, 2026.
Exploitation of a security vulnerability let an unauthorised third party access Mercadien files from about September 17, 2025, including data received from clients such as credit unions.
Summary view was left enabled on the symposium form from Aug 24–Sep 10, 2026, exposing other applicants’ name, email and optional questions. 149 people. Disclosed Sep 11. No cards/accounts/passwords collected.
After a Jul 29, 2026 tip, investigation found phishing of six staff M365 accounts with traces of 5,417 mail views and 3,272 file views (2,798 downloads). Disclosed Sep 11. No person-level headcount given.
After ApplyNow’s Sep 9, 2026 disclosure, the vendor reported on Sep 10 that FY2022–FY2026 presentation-video exam applicants’ name, email, phone and exam numbers may have been taken (~800). City disclosed Sep 11. Video files out of scope.
Misused telephone-system credentials enabled customer-data access.
Mass file access detected Jun 25, 2026; VPN appliance intrusion confirmed Jul 9. About 246,000 staff/related personal records may have leaked; disclosed Sep 11. Public citizens’ data, My Number and bank accounts out of scope.
A Sep 6, 2026 proposal mail put recipients in To instead of BCC, exposing 339 addresses. Disclosed Sep 10. No other fields leaked.
External media used to migrate data from Nippon Maru went missing in Jul 2026; passenger/crew personal data may have been on it; disclosed Sep 10. Counts still under review.
An information-disclosure file’s masking could be undone, revealing withheld fields. Scope: 536 students (gross) in tuition-waiver records. Disclosed Sep 10, 2026.
A contractor furusato campaign survey let respondents view prior answers (address, name, phone, email) from Aug 31–Sep 1, 2026. 218 respondents. Disclosed Sep 9.
Unauthorised access to certain files occurred on November 11–19, 2025; the files may have included information on client companies’ employees and vendors.
A vulnerable analytics tool enabled access to service databases.
One staff mailbox was phished and used to send spam. Stored personal data may have been viewed; disclosed Sep 8, 2026. Separate from the Law faculty incident.
A staff email to a business partner wrongly attached fan-club data (15,612 people as of Jul 3, 2026); 2 of 11 recipients opened it. Occurred Sep 2; disclosed Sep 8. Cards/accounts out of scope.