Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Unauthorized access to web/mail servers confirmed May 1, 2026 (noticed June 8; first notice June 19; final Oct 28). No clear theft traces, but access was possible so exposure cannot be ruled out. Parent Hasegawa customers unaffected.
Possible data leak: After Meruhaikun intrusion reports, Kyoto Experiment posted and later updated that personal data theft was confirmed. No public count. Vendor root to be linked later.
Possible data leak: After Meruhaikun intrusion on a contracted Toki Fan Club mailer, Sado disclosed June 19, 2026. Of 9,028 members, 4,111 newsletter recipients are in scope. Vendor root to be linked later.
Vendor Xsolis became aware on January 22, 2026 of unauthorised activity from a targeted phishing attack; patient information may have been accessed.
After Delightful Meruhaikun intrusion, Include disclosed possible exposure of B2B newsletter lists on June 19, 2026; second report confirmed 2,243 people. Vendor root to be linked later.
Possible data leak: First notice June 19, 2026 on Meruhaikun intrusion; follow-up confirmed leakage of service-admin and inquiry/contact records. Card data out of scope. Vendor root to be linked later.
An unauthorised actor accessed certain systems and copied files between August 22 and November 7, 2024.
Possible data leak: After Delightful’s Meruhaikun intrusion, JSPO posted a June 18, 2026 first notice; a follow-up confirmed email leakage. Vendor root to be linked later.
Malicious activity targeting an employee on March 16, 2026 let an unauthorised third party access IT systems and copy a number of data files.
After unusual activity in February 2025, Alcott found an unauthorised user accessed systems storing personal data; a review completed March 2026 found names, SSNs and dates of birth may have been accessed.
A user-management misconfiguration allowed registered users to view each other’s directory data inside the system; discovered Apr 23, 2026 and disclosed June 16. Not exposed to the open internet.
Possible data leak: A PC discarded in late April 2026 still held data and briefly reached a third party. After recovery, exposure of 2013-09 to 2016-03 online-shop buyers could not be ruled out; disclosed June 16.
After card-brand alerts, card payments stopped March 9, 2026. Investigation found possible card leakage (Mar 21, 2025–Mar 10, 2026) with some misuse risk, plus customer-data exposure (Apr 6, 2021–Mar 10, 2026); disclosed June 15.
On June 10, 2026 an Oe JHS trip teacher booklet was lost in Tokyo, covering trip lists (120), allergy lists (11) and a class roster (126); disclosed June 15 (distinct from the NPO-portal redaction incident).
Possible data leak: An unauthorised actor accessed systems from around March 21 to April 6, 2025 and possibly viewed and/or obtained files.
A network disruption in November 2025 was confirmed as a cyber incident; certain files may have been viewed or taken between November 13 and 18, 2025, including data relating to customers’ members.
On June 8, 2026 staff meant to send a blank form but attached a personal-data contact list to one committee member; after deletion confirmation a June 12 press release followed.
On June 8, 2026 staff emailed a 4,363-row member file with personal data to two external recipients; deletion confirmed June 9; disclosed June 12.
On April 29, 2026, an Excel file Lockton sent to three RFP participants on behalf of Dexcom inadvertently included additional employee personal information.
Ransomware on a FAX file server confirmed June 1, 2026 after VPN intrusion. 633 partner/customer records in FAX PDFs from Aug 1, 2024–June 1, 2026 may have been exfiltrated; disclosed June 12.