Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Tochigi Bank announced on November 2 that part of its email-delivery service ran on Arara servers that were breached, leaking some customer email addresses, and gave the count in a November 3 second report.
Zaif announced a possible leak on November 2 and, in a November 4 second report, confirmed that customer email addresses registered with Arara Message had been exfiltrated.
TKC was informed that unauthorised access to Arara Message, its outsourced email-delivery service, leaked email addresses and names of users of TKC systems.
Fanplus and Ticketplus announced on November 2 that unauthorised access to Arara Message leaked email addresses of their services' users.
On November 1, 2026, Nojima detected unauthorised access to the member-management system of its Nojima Online e-commerce site and confirmed member data of that site and its used-smartphone buy-back site had leaked.
Kagome announced on October 31 that unauthorised access to the digital-securities platform used for its 2023 perk-bearing bonds may have leaked purchaser personal data.
Possible data leak: Starts Securities announced on October 31 that unauthorised access to Securitize, provider of its Starts Asset Token platform, obtained some customer data.
Club Tourism detected external unauthorised access to a server on October 30, 2026 and announced on October 31 that internet-member data may have leaked.
Kintetsu GHD announced on October 31 that unauthorised access to the digital-securities platform used for perks on its 135th unsecured bonds may have leaked data of investors who bought ¥1 million or more.
Rakuten Securities announced on October 31 that unauthorised access to the NTT DATA contractor digital-securities platform used for perk applications on bonds it sold may have leaked some customer data.
NTT DATA suspended STdirectServices after unauthorised access to a contractor SaaS it uses, saying personal data handled there may have leaked, and announced this on October 31.
On September 22, 2026, a file with plan-member information was sent to an incorrect email address; it may include names, addresses, dates of birth and SSNs.
Files on the network were accessed and copied without authorisation between June 13 and 22, 2026.
Sony Bank announced on October 30 (updated November 4) that unauthorised access to Securitize Japan, its digital-securities vendor, leaked customer data.
On March 9, 2026, NCH learned an unauthorised actor may have taken files containing names, SSNs, taxpayer IDs and driver’s licence numbers.
Ryobi Systems found on October 27 that suspected impersonation logins to AITEL health-check booking accounts had viewed other users' data, and announced this on October 30.
A portable HDD used for medical-billing backups went missing from the claims unit in June 2026 (Reiwa 8) and was announced on October 30; accidental disposal is also considered possible.
Between about September 23 and 28 and around October 17, 2026, unknown parties accessed personal information of some US Crypto Life users, including via a third-party service provider.
Four employees’ Microsoft 365 accounts were intermittently accessed August 26–September 2, 2026 and documents were copied or downloaded.
NTT Smile Energy detected suspicious access to the Ecomegane web server on October 28, shut it down, and announced on October 30 that database-server attack traces meant customer data may have leaked.