Confirmed
7NOW delivery-customer data exposed through contractor
The incident affected CBcloud’s PickGo delivery service.
Company Data Breaches and Security Incidents
Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Confirmed
Kinko's Japan: smart-membership email addresses leaked via Arara breach
Kinko's Japan announced on November 2 that unauthorised access to Arara Message, used for smart-membership newsletters, leaked member email addresses.
Investigating
Life Corporation: point-card data in the official app may have been viewed after intrusion (298 records)
Life Corporation confirmed unauthorised access to its official app on October 30, 2026, and announced on November 2 that some point-card data may have been viewed.
Confirmed
ManpowerGroup Japan: 158,600 email addresses leaked via Arara service used by a contractor
ManpowerGroup Japan announced on November 2 (updated November 5) that unauthorised access to Arara's repica service, used by its email contractor, leaked email addresses of registered temporary workers and others.
Confirmed
Subway Japan: newsletter member data leaked via Arara breach (up to 1,107,494)
Subway Japan first said on October 29 its customers were not affected, disclosed a possible leak on November 2, and confirmed it on November 5.
Confirmed
Ryobi Bus: 43,221 newsletter email addresses leaked via Arara breach
Ryobi Bus announced on November 2 that Arara reported unauthorised access to its repica service, used for newsletters, had leaked member email addresses.
Confirmed
Fukui Shimbun: 11,084 Fukui Shimbun Passport member email addresses leaked via Arara breach
Fukui Shimbun announced on November 2 that unauthorised access to Arara, used for Fukui Shimbun Passport member email, leaked some members' email addresses.
Confirmed
Suntory group external-cloud data breach
An intruder downloaded files containing personal information.
Confirmed
Hokuriku Electric: about 550,000 Hokulink member email addresses leaked via mail-service breach
Hokuriku Electric said unauthorised access to the email service used by the operator it contracts for Hokulink member emails leaked members' email addresses.
Confirmed
Marui Group: customer data leaked via Securitize Japan digital-bond vendor breach (up to 9,086 people)
Marui Group announced on November 2 that Securitize Japan, which manages its digital bonds, was breached on October 29, 2026, and some applicant personal data leaked.
Confirmed
Bank of the Ryukyus: 96,477 customer email addresses leaked via Arara repica
The bank learned on November 2 that customer email addresses leaked in the repica breach and announced it that day.
Confirmed
Odakyu Travel: 63,006 member email addresses leaked via Arara breach
Odakyu Travel was told on November 2 that some member email addresses leaked through the Arara service used via a marketing tool.
Confirmed
istyle @cosme: data of about 3 million common-ID members leaked after unauthorised access
On October 28, 2026, istyle confirmed that part of its @cosme common-ID member data leaked through unauthorised access.
Confirmed
Kobe Shimbun: about 40,000 newsletter email addresses leaked via Arara breach
Kobe Shimbun was told on November 2 that unauthorised access to Arara, used for its newsletter, leaked recipient email addresses, and published a notice that day.
Confirmed
Cotton Incorporated: user database export exposed and downloaded
During a CottonWorks.com hosting migration, a user-database export was made public and downloaded four times by unknown parties between September 18 and October 15, 2026.
Confirmed
ENEOS: car-lease customer data leaked via Prestige Core Solutions vendor breach (up to 8,500 contracts)
ENEOS announced on November 2 that Prestige Core Solutions, which handles part of ENEOS Car Lease administration, was breached on October 29-30, 2026, and customer personal data leaked.
Investigating
Skymark: employee and former-employee personal data left viewable; possible leak
After inspecting servers following an earlier careers-form issue, Skymark found some employee and former-employee personal data had been viewable from outside or inside the company and announced a possible leak on November 2.
Confirmed
U Co-op: 210,495 email addresses leaked from Arara repica service
U Co-op said registered email addresses leaked from Arara's repica email service.
Confirmed
Prestige International: up to about 5.5 million roadside-service records taken
Customer names, contacts, vehicle, incident/breakdown details and some bank-account information were removed from a roadside-assistance operations system. The figure is up to about 5.5 million records including duplicates.
Investigating
Mizkan: recipient names, addresses and phones may have leaked via Sagawa Express tracking-service breach
Mizkan announced on November 2 that unauthorised access to Sagawa Express's package-tracking service may have leaked shipping-label data for parcels the Mizkan group or its contractors shipped via Sagawa between June 21 and September 30, 2026.