Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
After self-checks prompted by other cities’ masking failures, 57 files made with print-menu PDF conversion still allowed masked text to be viewed via certain operations; disclosed July 3, 2026. Files recovered/destroyed; no secondary use found.
Possible data leak: Noticed June 30, 2026; site stopped July 1; first notice July 2 (then stated no personal data held). On July 23 inquiry-form data was found stored; second notice July 24. Final report confirmed vulnerability abuse but no view/exfil traces. Separate from the ApplyNow incident.
Unauthorised activity was found on April 16, 2026; a person accessed and downloaded some TriWest information, which may have included names, DoD benefits numbers, ZIP codes and authorisation request types.
Unauthorized login to an employee mailbox/cloud on June 17, 2026; noticed via suspicious mail on June 24; first notice July 1. Second notice attributes it to phishing impersonating a business partner.
Unauthorized access to the EC site confirmed June 22, 2026; first notice July 1. Second notice confirmed vulnerability abuse and exfiltration of customer data.
Possible data leak: Tabiq’s Amazon S3 bucket holding selfie/signature/passport images was publicly reachable. Press coverage began May 15, 2026; the company’s count-bearing formal notice is dated June 30. disclosedOn uses the formal official notice date; the earlier press piece is attached as a source.
A single system was accessed without authorisation and personal information uploaded by users was downloaded around May 1, 2026.
After Delightful Meruhaikun intrusion on June 16, 2026, FLOW disclosed possible exposure of 1,593 LyuVie mailer name/email rows. Address, phone and cards were not stored in that system. Vendor root to be linked later.
Intrusion into Aflac Yorisou Net and related systems leaked customer/agency data; first notice June 30, 2026. Second notice corrected earliest access to June 10 and restated customers as “about 4.4 million”.
A junior-high teacher kept student personal data on a personal SD card and lost it on June 13, 2026; the city disclosed June 29. Scope is 904 students (some alumni FY2014–2025 and some current Year-3).
NAS encryption noticed June 2, 2026 and isolated. Possible exposure of event-participant character contacts (name, org, phone, email, address) disclosed June 29. No confirmed exfiltration or secondary harm yet.
Possible data leak: A volunteer/officials QR page was found searchable externally on June 22, 2026 and removed the same day; disclosed June 26. Viewable from May 1, 2024 through June 22, 2026.
On June 24, 2026 an Ishinomaki HS teacher mis-posted graded Math II exams for 182 Year-2 students to the school groupware; removed same day; prefecture disclosed June 26. No SNS secondary leak confirmed.
Certain files on the network were accessed and exfiltrated without permission on March 27, 2025; most of the information relates to former employees.
An unknown unauthorised actor accessed certain systems between January 23 and February 20, 2025 and accessed and/or acquired files.
On June 17, 2026 a teacher ran remote-access malware after a support scam. No illicit operations were found on the school admin system, but local files with some student names, class, grades and guidance notes may have been exposed; disclosed June 25.
Certain information in its systems was subject to unauthorised access or acquisition around February 3, 2026, which may have included personal data.
Employee W-2s were emailed to two former student workers and were subject to unauthorised access from April 13 to May 21, 2026.
Possible data leak: After Meruhaikun intrusion on June 16, 2026 affecting training mailers, ELEC disclosed June 25. Count/fields still under investigation. Address, phone and payment data not stored in that system. Vendor root to be linked later.
On June 16, 2026 staff emailed a citywide farmland-management file (filterable to all farmers) to one farm corporation instead of that corporation’s subset; noticed June 19, disclosed June 25. Deletion confirmed; no misuse found.