Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Around November 29, 2025, Hogan became aware of unusual activity; the network was accessed without authorisation at various times between October 25 and November 29, 2025 and certain files were accessed or copied.
After external intrusion into subsidiary Hokkaido LNG’s order system, staff/partner data may have leaked; disclosed May 7, 2026.
Unauthorised Microsoft 365 logins at Nikkei America may have exposed staff and partner data after spoofed mails were noticed; disclosed by the parent.
On October 6, 2025, Alliance experienced a network disruption; an unknown actor gained access and potentially acquired data including names, SSNs and driver’s licence numbers.
Possible data leak: Around April 7, 2026, unauthorised activity involving one user account was identified; on April 16 a limited amount of PHI was found to have possibly been accessed.
A meter-reading device was stolen on April 15, 2026 with possible personal-data exposure; disclosed May 7. District withheld for investigation/security.
On May 3, 2026 Nagoya found redacted addresses on Cabinet Office NPO-portal filings readable with certain operations; first notice May 7, final May 21.
On January 9, 2026, an unauthorised actor gained access to a limited portion of file shares through social engineering and copied certain files.
An employee email account was accessed without authorisation; on April 6, 2026 the firm learned the account, accessed around February 6, 2025, contained limited personal information that may have been accessed or acquired.
On April 23, 2026 it was found that redacted officer addresses on the national NPO portal for Tochigi filings could be read with certain operations; disclosed May 1.
After GitHub credential leakage enabled intrusion, a May 1, 2026 first notice said some personal data in repo files may have leaked. No production-DB exfiltration confirmed.
Unauthorised activity in Canvas was detected on April 29, 2026. The actor abused a Free-for-Teacher account and vulnerabilities; usernames, email addresses, course names, enrolment information and messages were exfiltrated. A second intrusion on May 7 via another vulnerability accessed no further data, the company says.
An external tip on April 24, 2026 found class-tour application summaries viewable via the Ota Flex HS form; disclosed May 1.
Server intrusion was confirmed April 16, 2026; on April 23 a hospital trial-document NAS was also found accessed with possible patient-data leakage; disclosed May 1.
In an incident around February 18, 2026, names, addresses, SSNs, driver’s licence numbers and dates of birth may have been accessed or acquired by unauthorised actors.
Certain files stored on the network were viewed and copied by an unauthorised actor on January 19, 2026.
Unauthorised access to a FileZen high-volume transfer server used by the bureau was identified in January 2026; possible exfiltration of stored personal data was disclosed April 28.
On April 3, 2026, a service provider notified Frontwave that non-public information including members’ names and SSNs was inadvertently disclosed to another credit union.
Unauthorised access through an external provider raised the possibility of personal-data exposure, with limited individuals being notified. Possible external acquisition, precise fields and counts are not established in the notices.
Possible data leak: After a April 3, 2026 report of external-VPN abuse, an April 13 review could not rule out access to internal servers holding some employee records; disclosed April 27. No customer/partner exfiltration confirmed.