Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
During a major renovation move at Yamagata Junior High, health and dental records for all 387 students went missing. Noticed July 28, 2026; parent briefing Aug 28; disclosed Aug 31.
Possible data leak: Unauthorized server access confirmed Aug 27, 2026; services paused and a status page published around Aug 30. Intrusion into a shipping-info server was confirmed, but the Oct 28 final report found no evidence of viewing/exfiltrating DB personal data.
Yellow Hat detected unauthorised access to its web service-booking system in August 2026, announced a possible leak on August 28, and confirmed customer data was exfiltrated in its October 15 second report.
McKesson first publicly reported unauthorized access and exfiltration on August 28. It discovered activity on August 25 that occurred during August 20–25.
Unauthorized access to an external cloud holding construction records may have exposed customers’ names/addresses etc.; disclosed Aug 28, 2026.
Minimum-wage basic-survey forms went missing in transit; possible exposure of establishment and worker-related fields totaling a gross 339 people was disclosed Aug 28, 2026.
Possible data leak: A network disruption occurred around November 15, 2025; information on the network was subject to unauthorised access between October 27 and November 15, 2025.
A phishing mail harvested an EC-platform staff account; unauthorized login and bulk customer export occurred Aug 22–23, 2026. Parent Treasure Factory disclosed Aug 28. 136,464 people (109,311 with addresses). Cards and storefront passwords out of scope.
Possible data leak: Unauthorized access to the Co-op Yamaguchi LINE mini-app disclosed Aug 28, 2026. Second report listed several category counts (members with/without e-money cards, reservation users, etc.). Cards, bank accounts, passwords and sensitive personal data out of scope.
Review of dashcam-upload system Z-Dash found a vulnerability and possible personal-data exposure from unauthorized access on Apr 1 and Apr 6, 2026; disclosed Aug 27. Video, cards and bank accounts out of scope.
Suspicious automated access tied to one account on a third-party e-signature cloud platform led to files being downloaded from a single ISC workspace between June 8 and 11, 2026.
Forensic work on Delightful’s Meruhaikun intrusion confirmed 2,255 of COO’s newsletter emails were in the leaked set; disclosed Aug 27, 2026. Vendor root to be linked later.
Unauthorized access to CINRA JOB disclosed Aug 27, 2026. Final report: a program vulnerability let attackers obtain credentials; 21,508 members (incl. withdrawn) may be in scope (name, DOB, sex, address, etc.); no confirmed misuse.
On May 7, 2026, Indico determined a cybersecurity incident may have involved unauthorised access to online repositories with customer information; names, SSNs, account numbers and institution names may have been present.
Possible data leak: Unauthorized access to the corporate site was identified June 29, 2026. Investigation could not fully rule out external exposure of contact-form personal data; disclosed Aug 27.
Actua detected an intrusion on August 16 and disclosed on August 26 that data in recruitment and temporary-worker management files had been copied.
Possible data leak: Unauthorized access to part of a used cloud service confirmed Aug 25, 2026 and disclosed Aug 26. Condo-sales customer data were stored there; no confirmed leakage/misuse yet; access stopped pending investigation.
One staff mailbox was taken over via phishing and used to send 3,177 suspicious mails. The attacker could view the mailbox, so stored personal data may have been obtained; disclosed Aug 25, 2026 (updated Sep). Separate from the Sangenjaya campus incident.
After a CMS vulnerability disclosure, intrusion traces were found on the Hololive OCG site. Inquiry-form name/email/phone/content from July 4–19, 2026 may have been obtained; disclosed Aug 25. No confirmed defacement or proven exfiltration. Card-exchange desk out of scope.
Possible data leak: On Aug 24, 2026 unusual log-read API calls with the Stripe live key from non-company IPs were detected and the key revoked. First notice Aug 25; follow-up identified 100 possibly affected customers notified Sep 2. No financial misuse found. Service login passwords out of scope.