Sources first · Counts reflect this database, not worldwide incident totals.
MediaNavi announced on October 30 that unauthorised access to Rakus Light Cloud's Blastmail, used for its newsletter, leaked all held recipient email addresses and names.
A voice-phishing attack let a criminal actor access files containing protected health information.
On October 28, 2026, Matsuya Foods found unauthorised access to the Matsuya official-app management system and announced on October 30 that member data had leaked.
Ryohin Keikaku detected unauthorised external access and said email addresses, birth dates and gender in the MUJI app may have been leaked.
After an alert on August 24, 2026 about an employee account, Marathon Health validated on September 9 that personal information was obtained by an unauthorised person.
A breach at email provider Blastmail exposed email addresses for 489,564 customers. The November 4 second report no longer qualifies this as the maximum used in the initial notice.
Belc first posted notice of the Arara email-service intrusion on October 29 and, in a November 3 update, confirmed customer data had leaked.
Arara confirmed exfiltration through unauthorized access to its email-delivery platform. Its November 6 deduplicated scope of 81,329,467 email addresses also includes addresses that may have been acquired.
Japan Post announced on October 29 that unauthorised access to a contractor server used for international-mail My Page newsletters may have leaked some subscribers' email addresses.
Chugoku Electric announced on October 29 that unauthorised access to Sagawa Express's parcel-inquiry service, used for point-exchange deliveries, may have leaked some customer delivery data.
Clubnets announced a first report on October 29 that unauthorised access to the CN Points satellite systems may have leaked some members' personal data.
Unauthorised access during September 23–24 involved customer names, CPF identifiers, email, phones, delivery addresses and order numbers. Access to passwords or payment data was not identified.
Asahi Shimbun announced on October 29 that unauthorised access to Ymir Link's Cuenote FC may have leaked customer data registered for events and similar activities—not Asahi Shimbun Digital subscription data.
Life Card was told on October 26 that unauthorised access to Ymir Link's Cuenote FC may have leaked some customer data, and announced this on October 28.
A zero-day in self-hosted Metabase was exploited and data may have been acquired on August 9–10, 2026.
A breach at Yumirulink’s Cuenote FC leaked 140,443 email addresses of some newsletter subscribers and campaign entrants. An October 30 update corrected the initial notice: sex, prefecture and member codes were not leaked.
Possible data leak: Resona Bank, jointly with Saitama Resona and Kansai Mirai, announced on October 27 that Ymir Link's Cuenote FC breach likely exfiltrated group customer data used for email delivery.
Possible data leak: Saitama Resona Bank, jointly with Resona and Kansai Mirai, announced on October 27 that the Ymir Link email-contractor breach likely exfiltrated group customer data.
Possible data leak: Kansai Mirai Bank, jointly with Resona and Saitama Resona, announced on October 27 that the Ymir Link email-contractor breach likely exfiltrated group customer data.
Between September 13 and 17, 2026, online-store data was accessed through a third-party application, including names, emails, addresses, phones and order history.