Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Suspicious activity in users’ cloud applications was detected on November 24, 2025; a criminal third party accessed the accounts and downloaded files containing names, account numbers, dates of birth and SSNs or other ID numbers.
Certain files in the network environment were or may have been accessed between June 2 and 4, 2025; names with SSNs or taxpayer IDs may be involved.
A security incident involving infrastructure managed by a third-party technology provider may have exposed personal information.
Unauthorised logins to the smartphone app may have allowed viewing of personal information. The completed external investigation reported June 19 found no traces of leakage or secondary harm.
Certain files were accessed and acquired without authorisation on March 19, 2026.
On December 15, 2025, an unauthorised individual accessed one employee email account for a limited period; certain emails may have been accessed or removed.
Possible data leak: 83 leased staff laptops went missing/stolen; 3 held personal data including a 115,526-row resident file on a Civic Affairs PC; disclosed May 29, 2026 (distinct from the Minatogawa JHS HDD incident).
Between March 1 and 3, 2026, an unauthorised actor obtained data stored in one of the RXNT solutions used by some customers.
An unauthorised actor accessed a legacy file server managed by a third party between December 8 and 16, 2025 and acquired certain files.
The environment was accessed without authorisation from February 16 to 18, 2026, and certain files were accessed.
On or about March 5, 2026, an unknown actor accessed and acquired data in the email environment, including names with SSNs, dates of birth, medical and health insurance information.
Possible data leak: Multi-child benefit notices for unlicensed-care households were mailed from a wrong address list; noticed May 27, 2026 and disclosed May 28.
Possible data leak: Systems were accessed without authorisation around October 13, 2025; on May 11, 2026 files subject to unauthorised access or acquisition were found to contain personal information.
IAC became aware of unauthorised activity on February 24, 2025 and took systems offline; around March 4, 2025 it learned files were taken by an unauthorised actor.
On March 10, 2026, an unauthorised actor accessed the network and potentially copied a limited number of files that may have contained names, SSNs and direct-deposit account information.
An external photography subcontractor suffered a breach.
Possible data leak: A security incident on April 26–27, 2026 (per the CA filing) involved customer names and other templated data elements; the bank says it has no evidence the data was targeted or misused.
Unauthorised satsuki logins exposed 27,163 guest records, 111 directly affected partner records and 14,400 other partner records. Different categories are neither summed nor treated as people.
DB overload on May 25, 2026 led to confirmed intrusion; possible exfiltration of operator name, ID, password and email was disclosed May 28.
Carnival disclosed on May 27 that an April 10 call impersonating internal IT obtained employee credentials and led to personal-data exfiltration.