Confirmed
Office Peeps: network data accessed and acquired
On November 26, 2025, some network data was accessed and acquired by an unauthorised actor.
Company Data Breaches and Security Incidents
Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Confirmed
GS Engineering: files copied in network intrusion
The network was accessed October 27–November 11, 2025 and files were copied without permission.
Confirmed
City of Marina: copies of server files acquired after network intrusion
On August 20, 2025, the city identified unauthorised activity on its network; the investigation found an unauthorised person accessed some systems between August 19 and 20, 2025 and acquired copies of some server files.
Investigating
Orenstein Law (Atlas Orange) reports possible personal-data exposure via employee email
Unauthorised access to employee email accounts may have exposed names with financial or other information.
Investigating
Insightin Health: health plan data may have been accessed via unknown vendor software flaw
In September 2025, an unauthorised person entered the network using a new, unknown flaw in a vendor’s software; files on a few servers may have been viewed or copied between September 17 and 23, 2025, including names, dates of birth, gender and health plan information.
Investigating
DH Smith Company: files may have been acquired after systems intrusion
Around March 27, 2025, DH Smith learned an unauthorised actor had gained access to its systems; the investigation found certain network files may have been acquired that day.
Investigating
Take One Systems: client account passwords may have been leaked after ransomware attack
Possible data leak: On the morning of January 25, 2026, Take One Systems found an internal server at its Gardena office had been encrypted by ransomware and disconnected the network.
Investigating
Nova Biomedical notifies possible personal-information impact from 2025 intrusion
Nova Biomedical’s January 27, 2026 notice warned of possible personal-information impact following a cyberattack on July 22, 2025.
Confirmed
JA Kyosai: misconfiguration briefly exposed other JA policyholder data to administrators
JA Kyosai announced on January 27 that a settings error left other JA policyholder/related personal data viewable to administrators between 08:00 and 09:20 on January 14, 2026.
Confirmed
SoftBank: proxy bug caused 2,019 My SoftBank wrong-profile displays and related MMS faults
SoftBank announced on January 27 that a proxy-server software bug could briefly treat customers as someone else, causing wrong My SoftBank profiles and MMS sender/recipient mix-ups. Not a cyber-attack.
Investigating
GOT: reader-survey names and addresses may have leaked after web-server intrusion
After suspicious web-server access on 11 Dec 2025, GOT announced on 26 Jan 2026 that reader-survey personal data may have leaked.
Investigating
Intellex Just Curtain: 60,663 personal-data and 10,423 card records may have leaked after intrusion
After card-brand alerts, card payments were stopped in May 2025; on 26 Jan 2026 Intellex reported a possible leak from payment-application tampering.
Confirmed
EMC Water: files obtained via Oracle EBS flaw
A previously unknown Oracle EBS vulnerability was used to obtain files from the company’s EBS application.
Investigating
Wisner Baum: files with SSNs and medical data may have been obtained
On October 9, 2025, Wisner Baum detected unusual network activity; the investigation found an unauthorised third party accessed the network between October 8 and 9, 2025 and may have obtained certain files.
Investigating
Ebara Foods Ebara CLUB: other members’ registration data may have been shown (up to 557)
Possible data leak: On January 22 Ebara CLUB showed other members’ profiles after login; the site was stopped, disclosed on January 23, and a February 5 second report explained cause and scope.
Confirmed
MAFF: My Number and payroll data of 4,571 staff and family members leaked via misdirected email
While consolidating FY2025 withholding records, data were sent to a wrong email address; discovery was on January 19 and public notice on January 23.
Investigating
Kashiwa City: personal data in a limited-access page may have leaked after search-engine indexing
Possible data leak: The city announced on January 23 that a URL-restricted business page briefly appeared in search engines and that a posted zip contained personal data.
Confirmed
CHP 11-99 Foundation: staff email account compromised by phishing
Around September 16, 2025, a staff member forwarded a suspicious email to the external provider’s help desk, was told the link was clean, and opened it, leading to compromise; the attacker had full access to the email account, including all folders and attached documents.
Investigating
Itasca Consulting Group reports possible data exposure
Around December 12, 2025, a third party attempted to infiltrate the network and personal information may have been accessed.
Confirmed
MACT Health Board: files with patient SSNs and medical data accessed in disruptive incident
MACT experienced an incident that disrupted its IT systems; the investigation found an unauthorised party accessed some files on its systems between November 12 and 20, 2025.