Confirmed
So-net member database breach
Member names, email addresses, phone numbers and other fields were exposed.
Data breaches
Data breaches
Sources first · Counts reflect this database, not worldwide incident totals.
Confirmed
BANDAI SPIRITS: 346,247 THE GUNDAM BASE MEMBERS email addresses leaked via Ymir Link breach
Bandai Namco Entertainment and BANDAI SPIRITS announced on October 27 that THE GUNDAM BASE MEMBERS email addresses leaked through the breach of Ymir Link, the Bandai Namco ID email contractor.
Investigating
Sarku Japan reports possible employee-data exposure
On September 7, 2026, parts of systems became inaccessible in a cybersecurity incident; employment-related personal data may have been affected.
Investigating
Rakuten Travel: customer data may have been exposed via intrusions into overseas-hotel and multilingual booking sites
Possible data leak: Rakuten said customer data was targeted by unauthorised access to some overseas-hotel booking pages run by subsidiary Rakuten Travel Xchange (detected September 10) and to the Rakuten Travel multilingual site (detected October 20).
Investigating
ValueCommerce: 6,096 unique address-book emails may have been taken via Cuenote FC breach
Possible data leak: ValueCommerce announced on October 26 that address-book data appeared to have been exported from Cuenote FC; a October 30 update reported 6,096 unique emails (7,588 gross).
Investigating
Cybozu: newsletter recipient emails may have leaked via Cuenote FC breach
Possible data leak: Cybozu announced that on October 26 Ymir Link said emails and related data in its Cuenote FC environment were likely leaked—after saying on October 20 that Cybozu was out of scope.
Confirmed
Yakult Honsha: 39,505 personal-data records leaked via website intrusion
Yakult confirmed and announced a website intrusion on October 26, 2026, and in its October 30 second report confirmed personal data of inquiry-form users and others had leaked.
Investigating
Mainichi Shimbun: newsletter email addresses may have leaked via Cuenote FC breach
Possible data leak: Mainichi Shimbun announced on October 26 that Ymir Link said some Cuenote FC data used for newsletters was likely taken externally, and stopped delivery that day.
Confirmed
Navigate360: data copied from system
An unauthorised third party accessed a system and obtained copies of data between November 21, 2025 and March 5, 2026.
Investigating
Nomura Securities: i-Port subscriber emails may have leaked via email-contractor breach
Nomura Securities announced on October 23 that Ymir Link, which emails i-Port subscribers, reported on October 22 that unauthorised access may have leaked stored email addresses and related data.
Investigating
Lexitas reports possible exposure from misconfigured DepositionNet server
Possible data leak: A server configuration error made OnDemand (DepositionNet) files accessible without authentication since around September 2019; they may contain names with SSNs or driver’s licence numbers.
Investigating
BASS Medical Group reports possible PHI access
Personal and/or protected health information may have been accessed or acquired without authorisation.
Investigating
Sendai Gender Equal Foundation: newsletter data may have leaked via Blastmail breach
The foundation announced (page updated November 4) that Rakus Light Cloud's Blastmail, used for its "Mail de Ernab" newsletter, may have leaked recipient data after an intrusion notice.
Confirmed
Capcom: email addresses and IDs of 11,774,247 CAPCOM ID accounts leaked
Capcom found traces of unauthorised access to CAPCOM ID on October 19, 2026 and confirmed a leak of registered data and unauthorised password changes on some accounts.
Investigating
DNP honto: newsletter member data may have leaked via Cuenote FC breach
DNP announced on October 21 that Ymir Link, email contractor for its honto bookstore, reported on October 19 that unauthorised access may have leaked honto customer data.
Confirmed
Osaka University: data of 77,851 people leaked after contractor NEC's shared files were downloaded
Osaka University was told by contractor NEC on October 9 that files containing university personal data had been downloaded by a third party on September 26.
Confirmed
Dorsata: Metabase flaw allowed database access
A Metabase vulnerability allowed unauthorised access to the database platform from August 10 to 12, 2026; affected data contained patients’ PHI but not SSNs.
Confirmed
Blastmail breach: all subscriber-account data and some delivery lists taken
Unauthorised access at subsidiary RAKUS Light Cloud’s Blastmail led to removal of all customer-account records including company/contact names, contacts and contract/payment histories; some delivery lists were also leaked.
Confirmed
Osaka Metropolitan University: related personal data leaked after NEC-subcontractor cyber-attack
In a fifth report on October 21, Osaka Metropolitan University said NEC reported on October 20 that a subcontractor attacked in late September used legitimate accounts to access university systems, and that university-related personal data in NEC cloud storage had leaked.
Confirmed
NEC: subcontractor cyber-attack caused customer system outages and leak of files including personal data
NEC announced on October 20 that a development/maintenance subcontractor was attacked in late September, stolen credentials were abused, customer environments were accessed and files in a shared cloud storage—including personal data—leaked.