Confirmed
Silver Summit Medical: patient data acquired at third-party vendor
Data including personal and health information received by SSMC was acquired without authorisation from a third-party vendor’s systems between November 27 and 30, 2025.
Data breaches
Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Investigating
GEX: ransomware incident may have allowed viewing of inquiry-customer personal data
Possible data leak: Ransomware access to a personal-data server confirmed in Feb 2026 with immediate isolation. Aug 19 notice: inquiry customers’ personal data were temporarily viewable; no confirmed exfiltration or misuse.
Investigating
Doshisha University: ransomware on exam-prep portal may have leaked student emails
The Career Center’s written-exam prep portal server was hit by ransomware on Apr 19, 2026 and taken offline. University-issued emails entered at registration may have leaked; no public posting confirmed; disclosed Aug 19.
Investigating
WEBLIFE: OEM customer-management intrusion may have leaked emails and related data
Possible data leak: OEM website CMS was intruded Aug 14–17, 2026; first notice Aug 18. Follow-ups (Aug 26/28) cleared name/address/phone/DOB and left email (and some non-PII admin fields) as still possibly exposed. Passwords and cards out of scope; direct-sales users out of scope.
Confirmed
VOISING: BI-tool intrusion leaked about 170,000 customers’ personal data
Unauthorized access to an internal BI tool began around Aug 10, 2026; a data download was confirmed Aug 16. First notice Aug 18 confirmed leakage; Sep 30 fourth report fixed a vulnerability cause and about 170,000 records. Some data appeared on SNS. Cards and passwords out of scope.
Investigating
Apple American Group and Pan American Group: employee data may have been in accessed files
An unknown actor accessed certain servers between April 8 and 9, 2026 and accessed or acquired files; information provided during employment may have been present.
Investigating
Kyoiku Software: dormant-server ransomware may have exposed 4,627 self-scoring-system users
Provider tip found a long-unused rental server hit by ransomware encryption and intrusion traces around Apr 30–May 1, 2026. After investigation, possible viewing of self-scoring-system user data through 2016 was disclosed Aug 17. No card data held.
Investigating
Merced Union High School District: personal data may have been compromised
Possible data leak: Unauthorised network activity was identified on August 12, 2025; files subject to the activity could have included names with dates of birth, SSNs and some health-related information.
Investigating
Langwasser & Company CPAs: client data may have been accessed after fraudulent tax filings
Around May 5, 2026, the firm learned a limited number of fraudulent tax returns were filed; the investigation found an unauthorised actor may have had access to personal information.
Confirmed
KBC Gakuen: DM name/address row shift mailed 2,471 people’s names to wrong households
On Aug 3, 2026 a guardian reported DM names and addresses were shifted by one row; caused by a row-delete error when building the mail file. Individual apology letters sent by Aug 12; disclosed Aug 17.
Confirmed
Forrestall CPAs: files viewed and obtained
Between December 22 and 30, 2025, an unauthorised individual viewed and obtained certain files on the network.
Confirmed
SAKURA internet: intrusions into rental servers and sales system; 1,360,563 member accounts possibly viewed or taken
SAKURA internet detected anomalies on a maintenance server of its rental-server service on August 9, 2026, announced it on August 17, and in its September 10 third report said the sales-management database was also accessed without authorisation.
Investigating
Ryomo Systems: VPN ransomware intrusion may have exposed business-partner and customer personal data
VPN account abuse on Aug 12, 2026; detected Aug 14; ransomware confirmed. Third notice (Sep) reports intrusion traces on some servers and possible leakage of partner/customer/employee personal data; counts still under review. First public notices were Aug 15 and 19 (this source is the third notice stating those dates).
Confirmed
May Trucking: files with names and SSNs acquired
Suspicious activity was detected on June 21, 2026; files were acquired without authorisation at that time and may have included names and SSNs.
Confirmed
Charm: customer delivery data possibly leaked after intrusion into online pet store
Charm detected unauthorised access to its Charm Honten online pet store on August 12, 2026, announced it on August 13 and reported it to the PPC.
Confirmed
Terry J. Dubrow, MD practice: patient data acquired, confirmed after extortion contact
After being contacted by an actor claiming access, the practice found its network was accessed from January 16, 2025 and data acquired, potentially including patient chart information, licence numbers and contact details.
Investigating
Tokyo Gas Network: lost work PC may have exposed about 20,000 customer records
Possible data leak: On Aug 5, 2026 a staff member lost a bag with a work PC after drinking; reported Aug 6. Phone recovered; PC still missing. It held about 20,000 completed-works customer records and 152 supply-inquiry records; device requires ID/password; disclosed Aug 13.
Investigating
Akatake Engineering: ransomware incident may have exposed staff and partner-contact personal data
Partial server-file encryption found Aug 10, 2026; first notice Aug 13. Final report (Oct 13) found no clear exfiltration traces but could not rule out theft; possible exposure of 125 employee records and 11,587 partner-contact records.
Confirmed
CSC: files copied from third-party hosted database
An unauthorised actor accessed a third-party hosted database between August 10 and 25, 2025 and copied and took certain files.
Confirmed
White Essence: reservation-site vulnerability led to exfiltration of about 1.05 million accounts’ data
Unauthorized access to reservation/core systems confirmed Aug 5, 2026; systems paused with first notice Aug 12. Oct 5 follow-up confirmed a reservation-site program vulnerability was abused to reach the core system and exfiltrate data on about 1.05 million accounts (customers, clinic affiliates, HQ staff).