Investigating
Hoag Hospital reports possible file access
Investigation of suspicious activity on October 8, 2026 found files may have been accessed without authorisation.
Data breaches
Data breaches
Sources first · Counts reflect this database, not worldwide incident totals.
Confirmed
Nomura IR Kikan Navi breach exposes investor and analyst information
Unauthorised access to the Kikan Navi investor-relations service led to downloaded data including about 2,000 investor/analyst records and about 250 former-employee records.
Confirmed
Duskin DDuet: 657,886 member email addresses leaked via Arara breach
Duskin was told on November 2 that unauthorised access to Arara, provider of the repica service used for DDuet emails, leaked member email addresses.
Confirmed
Solaseed Air: about 490,000 customer email addresses leaked via external email-system breach
Solaseed Air announced on November 4 that unauthorised access to an external email system it uses led to downloaded files containing customer email addresses.
Confirmed
Plenus: Hotto Motto newsletter vendor breach leaked member data (up to about 7 million records)
Plenus said that on November 2, 2026 its outsourced provider reported unauthorised access to the Hotto Motto newsletter delivery service, leaking member data including email addresses.
Confirmed
Kracie Yakuhin Kampoful Life: 59,428 member email addresses leaked via Arara
Kracie announced that Kampoful Life member email addresses leaked through the Arara service used for its emails.
Confirmed
BOATRACE Promotion: Telebote newsletter email addresses leaked via Arara breach (up to 684,772)
BOATRACE Promotion was told on November 3 that the Arara Message breach, used via Japan Leisure Channel, leaked recipient addresses of Telebote member newsletters and campaign mails.
Confirmed
Hasegawa: 305 customer email addresses leaked via Arara breach
Hasegawa was told on November 2 that Arara's repica service, used for email, had leaked recipient addresses, and announced this on November 4.
Confirmed
Mitsui Sumitomo Insurance: about 37,000 customer records leaked from policyholder portal intrusion
After detecting unauthorised access on the night of November 2, the insurer announced a partial service suspension on November 4 and on November 6 confirmed a leak of policyholder-portal users' data.
Confirmed
Aioi Nissay Dowa: about 444,000 customer records leaked from policyholder portal intrusion
Aioi Nissay Dowa detected unauthorised access to its policyholder portal on the night of November 2, suspended related services on the 3rd, posted a notice on November 4, and announced a confirmed leak on November 6.
Investigating
Monteroza: newsletter member data may have leaked via Arara breach (625,429 email addresses)
Monteroza learned on November 2 that newsletter members' personal data may have leaked through unauthorised access to its vendor Arara's servers.
Confirmed
Shochiku Multiplex Theaters: 3,320,305 SMT Members records leaked via Arara breach
Shochiku Multiplex Theaters announced on November 4 that the Arara Message breach used for SMT Members email had exfiltrated member registration data, with a confirmed count.
Investigating
Dentsu Soken: personal data in a client FACERE environment may have leaked via access misconfiguration
Dentsu Soken announced on November 4 that a misconfigured access permission in a client environment of its FACERE service allowed unauthorised access on September 10, 2026, and personal data may have leaked.
Confirmed
Workman: newsletter subscribers' email addresses leaked via Arara breach (up to about 1.45 million)
Workman was told that unauthorised access to Arara, which it uses for newsletters, leaked email addresses of Workman Online Store newsletter subscribers.
Confirmed
Seijo Ishii: online-shop newsletter email addresses leaked via Arara breach (up to 168,630)
Seijo Ishii said Seijo Ishii.com newsletter members' email addresses leaked in the Arara server intrusion.
Confirmed
KALDI online store: 820,420 newsletter email addresses leaked via Arara breach
Camel Coffee was told on November 2, 2026 that unauthorised access to Arara, used via an external marketing service for its online-store newsletter, leaked subscribers' email addresses.
Investigating
Yokohama City: personal data may have leaked via e-application email-service intrusion
Possible data leak: Yokohama City announced on November 3 that unauthorised access was detected on the email-sending service used by its e-application system and that impact on the city's environment and any personal-data leak were still being checked.
Confirmed
Center Theatre Group: file with SSNs mistakenly sent to state agency
On July 27, 2026, an employee inadvertently provided California’s EDD with a file containing names and SSNs of current and other personnel.
Investigating
Denny's Japan: member data may have leaked after unauthorised access to its app
Possible data leak: On October 30, 2026, Denny's Japan found that during the old-to-new app migration third parties had fraudulently created credentials and could access some accounts; it announced this on November 3.
Confirmed
Asoview discloses 15,821,184 member records exposed through Arara
An attack on email-service provider Arara exposed 15,821,184 Asoview member records. This is a record count and must not be added to the provider-wide total as a separate population.