Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
From 15:20 to 22:28 on July 23, 2026 a settings flaw on the Hareruya2 Pokémon lottery left applicant data externally viewable. Four accesses were logged without copy/download; no misuse found; disclosed July 30.
On July 27, 2026 the agriculture guidance center emailed 125 new farmers with recipients in To instead of Bcc, exposing emails and some display names to each other; noticed after a recipient report; disclosed July 29.
On July 13, 2026 Suginami mailed a lifestyle survey to 3,000 sampled residents; labels for 121 foreign nationals wrongly included nationality. Caused by selecting the wrong export field. An anonymous tip on July 25 led to the July 29 disclosure.
The life-insurance contract inquiry system allowed viewing other users’ personal data via certain external operations. Flagged by a security firm; first notice July 29, 2026. Investigation found a guest-user permission mis-grant from 2021-07-01 until the July 27, 2026 shutdown.
Possible data leak: Unauthorized server access noticed June 23, 2026. Attacks on multiple servers were confirmed and external leakage of customer data could not be ruled out; disclosed July 28 (following a July 2 outage notice). Headcount still under investigation.
On June 2, 2026, the Department learned of anomalous unauthorised activity involving an employee and determined a data file with names, addresses, CIN or Medi-Cal numbers, phone numbers and IHSS case numbers was accessed on August 26, 2025.
Possible data leak: After parking vendor Meitetsu Kyosho’s server compromise, leakage of monthly-parking customers (2018-07-01 to 2024-10-31) could not be ruled out; disclosed July 28, 2026. Same-batch related link to the Meitetsu root to be appended after commit.
Possible data leak: Between the Aug 1, 2025 release and the July 13, 2026 fix, an auth-design flaw could under certain conditions let third parties view customer data; disclosed July 28. Fixed; no confirmed viewing or misuse.
On April 23, 2026, an unauthorised actor accessed the network and acquired certain files.
For the “Kizuna Kama” kids program across 10 venues, response-visibility settings were wrong so co-venue applicants could see each other. A registrant reported it July 7, 2026; fixed immediately; disclosed July 28. Not exposed to the open internet.
Vulnerability-driven intrusion and file tampering (malware implant) confirmed. Possible exposure of customers who paid by card from 2017-11-09 through site stop on 2026-06-30; disclosed July 27.
Possible data leak: A work USB holding FY2025 specific and late-elderly checkup target data went missing inside the town hall; on July 9, 2026 it could not be located; disclosed July 27. No misuse found, but leakage cannot be ruled out.
On July 21, 2026 the prefecture emailed town child-support recipient files and wrongly attached all eight towns’ files to each town. One town opened then deleted; the others deleted unopened; disclosed July 27.
Unauthorised code placed on the Sports Affinity platform checkout captured payment card information entered from around May 8, 2026.
Suspicious activity was identified on March 26, 2026; on June 28 the investigation found an unauthorised individual may have accessed files and folders holding personal information.
Systems were accessed without authorisation on February 12, 2026, detected and contained on February 13; affected files were identified around March 17 and personal information may be involved.
The RA Connect system (Kevzara patient support for Asahi Kasei Therapeutics) was intruded on June 15, 2026; acquisition from web-public files confirmed July 11; disclosed July 24.
Intrusion into OCS FAMILY LINK SERVICE servers leaked personal data. Second notice (2026-07-24) disclosed possible exposure; third confirmed leakage; fourth attributed it to a program vulnerability in part of the service.
As program sponsor, disclosed July 24 after contractor CMIC HCI’s system (intruded June 15, 2026) was found to have leaked program-related personal data. Same-batch related link to the CHI root to be appended after commit.
On May 18, 2026, Bridgeway learned of a potential employee email compromise and system access; access occurred March 5 to May 19, and personal information may have been involved.