Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Possible data leak: Unauthorized access to 6 Google accounts (4 students, 2 alumni) from Apr 27–Aug 24, 2026 sent 17,668 spam messages; one faculty name/email appeared in a body. Disclosed Sep 8.
Infrastructure intrusion may have exposed name/address/email of students/staff from the merged universities; first notice Sep 7, 2026. Hospital patient data not confirmed; counts under review.
A zero-day in Oracle E-Business Suite allowed unauthorised parties to acquire stored files, including files with names and SSNs.
Legacy Shopserve (Estore) was breached May 21–Aug 1, 2026; on Aug 31 King Jim learned past store customers were in scope and disclosed Sep 4. Current EC out of scope. Cards/passwords not confirmed leaked.
On Aug 27, 2026 a case Teams team wrongly added ~3,500 external and ~2,500 staff accounts; invitees could see each other’s usernames/emails until same-day deletion. Court notices index dates the apology Sep 4.
An unauthorised party accessed the network on July 20–21, 2026; files with employees’ names, SSNs and other HR data may have been involved.
Possible data leak: After RIZAP reported an unapproved generative-AI upload, disclosed Sep 4, 2026. 726 people across 14 branches. Cards/accounts/credentials out of scope.
Possible data leak: RIZAP fed 19,996 records into an unapproved generative-AI tool (1,167 of them Dokenpo’s). Third-party viewing/training use denied per the notice.
A compromised static database used for legacy business automation exposed registration data through 2019, including names, CPF/CNPJ and contacts. No reliable aggregate count is supplied.
Possible data leak: An employee uploaded specified health-guidance target data to a personal generative-AI service. The vendor said training use did not occur. Headcounts are published by each client; IHI kenpo, Dokenpo, Chikyosai and others disclosed separately as victims.
On the contractor-run “52 Seats of Bliss” booking site, encoded post-booking contact notes were externally decodable from Jan 9, 2025 to Aug 27, 2026; disclosed Sep 2.
Suspicious network activity was identified around March 18, 2026; certain files may have been accessed and/or acquired without authorisation.
Around May 25, 2026, a security incident in its AWS environment occurred; files containing personal information may have been subject to unauthorised access or acquisition.
Possible data leak: After RIZAP reported an employee fed target data into a generative-AI tool, disclosed Sep 2, 2026. 210 members. Cards/accounts/passwords not included per RIZAP.
Possible data leak: Unauthorized access to the biodiversity-center “survey club” pages was flagged via prefectural police and disclosed Sep 1, 2026. Data for 1,963 members were stored; no confirmed leakage yet; investigation ongoing.
Unauthorized access to some systems confirmed Aug 28, 2026. Credential misuse may have exposed up to ~19k staff records and ~36k external email contacts; disclosed Sep 1. Business files/passwords not confirmed leaked.
A staff mailbox was compromised; 424 records (name, address, email, employer etc.) leaked and spoofed mails were sent; disclosed Sep 1, 2026. No card data held.
An adjunct’s class SNS “hyocom” left student/alumni name, student ID, grades, photos etc. viewable online or to members; disclosed Sep 1, 2026. 1,448 people.
Suspicious network activity was identified around March 27, 2026; certain files may have been downloaded without authorisation.
An employee, posed as helping a police inquiry, downloaded business-card records on Aug 17, 2026 and emailed them to a scammer. Internally discovered Aug 24; disclosed Aug 31.