Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
On November 25, 2024, Mindpath experienced a network disruption; limited information on its network may have been copied by an unauthorised actor between November 11 and 25, 2024.
Possible data leak: After disclosing a GitHub-credential-origin intrusion from early April, a April 24 update reported DB-access traces and 225,846 unique people in scope. No card data.
After announcing a system outage on April 14, 2026, a follow-up said attackers stole account credentials, entered the network and may have viewed or taken partner-employee personal data.
After Nippon Telenet (subcontractor of UPR) was attacked on March 9, 2026, Mobility Platform was told on April 13 that MaaS Car-related data may have leaked and disclosed April 14.
Possible data leak: Contractor Higashiyama Sangyo suffered ransomware on March 10, 2026, reported April 3 and Nambu disclosed April 13. No impact confirmed on Nambu’s own systems.
After Nippon Telenet’s March 9, 2026 ransomware event, UPR was first told it was out of scope, then on April 8 told its car-share call-centre data may have leaked; disclosed April 13.
Possible data leak: After a late March 16, 2026 intrusion that halted core systems and encrypted servers, an April 13 filing said some outbound transfers were seen, limited to employee-type fields without customer PII.
On February 26, 2026, suspicious activity was detected on part of the network; certain files may have been accessed without authorisation on February 26–27, 2026.
A mail to 108 in-prefecture travel-agency contacts used the To field so addresses were mutually visible.
Possible data leak: An unauthorised actor accessed systems between July 27 and August 15, 2025 and may have copied or viewed files.
Possible data leak: Unusual network activity beginning December 8, 2025 may have allowed personal information to be viewed or copied.
Unusual activity was identified on February 23, 2026; unauthorised access between February 17 and 23 resulted in copies of files being taken, which on March 13 were found to contain names and SSNs.
Unauthorised access to one employee email account from January 30 to March 12, 2026 may have exposed names, dates of birth, tax IDs, account numbers and other data.
In January and/or February 2026, patients’ protected health information was sent by email without encryption; discovered February 17, 2026. Emails may have included names, demographic details, limited clinical information (including diagnoses) and insurance information.
Unauthorised access to a fuel-procurement system resulted in copying of names, company names, phone numbers, email addresses and other data about personnel, former staff and business contacts. No count was disclosed.
On March 28, 2026 a uniform pick-up notice was sent with To instead of Bcc; a deletion request followed the same day and an apology was posted April 9.
After recognising possible unauthorised access on April 6, 2026, a full investigation from April 8 confirmed intrusion and data theft; disclosed the same day. Many realtor customers issued victim-side notices.
The health-promotion section found a 2025 fiscal-year counseling reservation book missing and disclosed on April 8, 2026, mailing apologies to those listed.
On March 4, 2026, TruView confirmed a cybercriminal may have accessed personal information in its environment between July 18 and August 15, 2024.
After suspicious activity in its systems, the agency determined that driver names, licence numbers and dates of birth may have been temporarily accessed by an unauthorised person. The CA filing lists February 22, 2026.