Confirmé
DriveWealth: personal data exfiltrated
Unauthorised network access on September 4–5, 2026 resulted in names and other data being exfiltrated.
Fuites de données et incidents de sécurité des entreprises
Recherchez par entreprise, pays, secteur, année et méthode d’attaque. Consultez les données concernées, la portée, la vérification, les réponses et les sources.
En cours d’enquête
Shudo Gakuen: server intrusion may have exposed staff/student personal and bank-account data
Unauthorized access to a managed server confirmed Sep 26, 2026; possible leakage of partner bank details plus staff/some students/external lecturers’ name/address/phone/bank data across Hiroshima Shudo University and affiliated schools; disclosed Sep 30. Counts under review. No confirmed public posting or misuse.
En cours d’enquête
QUO Card: LINE official-account campaign system intrusion may have exposed display names and prize info
Third-party intrusion into the LINE official-account campaign-only system; LINE display names and campaign prize info for some customers may have been viewed or exfiltrated; disclosed Sep 29, 2026. Counts under review. No payment/bank/sensitive data on that system.
En cours d’enquête
Poppins Payroll reports possible access via Metabase flaw
On September 3, 2026, unauthorised access to a system via the Metabase vulnerability may have exposed personal information.
Confirmé
TOPPAN: mis-sent Sompo Japan premium-deduction contractor list covering 177,426 policyholders to another insurer
On Sep 1, 2026 a manual send mixed a Sompo Japan policyholder ZIP (kana name, deduction policy no., business ID) into another insurer’s package. Recipient deleted it; no further exfiltration found. 177,426 policyholders (may fall after dedupe). Disclosed Sep 29.
Confirmé
Fukuoka Pref.: misposted kaigo-certification application file left personal data on 183 officers viewable
A kaigo workplace-certification application file posted by a contractor left name/DOB/sex/title for 183 officers at 24 corporations viewable. Disclosed Sep 29, 2026.
Confirmé
Seicomart: app-mediated intrusion into member servers led to viewing of 574,647 club members’ data
Unauthorized access reached member servers via the Seicomart app. First notice Sep 29, 2026 cited ~570k accounts; fourth notice Oct 5 fixed 574,647 people (name, sex, DOB, address, phone, email). Passwords/cards out of scope. First disclosure remains Sep 29.
Confirmé
Unirita: intrusion into in-house document system led to theft of customer and employee data
After seeing a public claim on Sep 28, 2026, Unirita confirmed intrusion and theft from a specific SaaS document system; first notice Sep 29. Oct 9 update confirmed leakage of contracts, customer auth credentials, customer-employee/external personal data, and employee personal data. No count published. Distinct from the Meruhai vendor incident. First disclosure remains Sep 29.
En cours d’enquête
City of McMinnville reports possible data copying
Information may have been accessed and copied without authorisation between June 1 and July 18, 2026.
Confirmé
Nagoya City: mis-attached Excel on an air-survey notice exposed contact data for 572 business sites for about an hour
On Sep 28, 2026 at 10:00 an air-emissions survey notice was posted with an Excel sheet containing site contacts’ name/phone/email; replaced ~11:00. Viewable about one hour. 572 businesses. Disclosed Sep 29.
Confirmé
Yamato Transport: about 5.26 million deferred-payment customer records exfiltrated
Yamato confirmed unauthorised access to its Kuroneko deferred-payment service on September 28, 2026, announced it on September 29, and confirmed exfiltration in its October 16 fourth report.
En cours d’enquête
Temairazu: TEMAIRAZU intrusion may have led to viewing/acquisition of guest reservation data
After suspicious guest messages from around Sep 21, 2026, Temairazu confirmed TEMAIRAZU intrusion. Guest name/phone/email, property name, check-in/out dates and rates may have been viewed or acquired. Oct 9 timely disclosure cites up to about 4.45 million people. No card data held. First disclosure remains Sep 28.
Confirmé
Lean on Me: Metabase vulnerability abuse led to theft of personal data on 82,723 people
Metabase vulnerability abuse stole Special Learning/Shift and related customer data; first notice Sep 28, 2026. Oct 27 confirmed report fixed the headcount at 82,723 and noted some sensitive health-related fields. First disclosure remains Sep 28.
Confirmé
Shueisha: data of 2,835 bloggers leaked from HAPPY PLUS COMMUNITY system
Shueisha announced on September 28 that unauthorised access to HAPPY PLUS COMMUNITY, its fashion-media blogger management system, had allowed registered data to be viewed and taken.
En cours d’enquête
Nagano Toshi Gas: Ryomo Systems intrusion may have exposed customer personal data
On Sep 24, 2026 Ryomo reported possible exfiltration of Nagano Toshi Gas customer data after a network intrusion; city-gas company disclosed Sep 28. Counts/fields still under review. No secondary misuse found.
En cours d’enquête
Isesaki City: Ryomo tablet-support intrusion may have exposed 3,789 student account records
Ryomo ransomware incident on Aug 14, 2026; on Sep 24 the city learned student school/grade/name/account/password data (3,789) may have leaked; disclosed Sep 28. Address/grades/health out of scope.
En cours d’enquête
Saga University: personal data may have leaked after ransomware hit admin NAS (about 80,000 people; patient data under review)
Possible data leak: Saga University found apparent ransomware on an administrative NAS on September 24, 2026, announced it on September 28, and on October 30 said leakage of personal data including patient data could not be ruled out.
Confirmé
Buchalter: limited firm data acquired without authorisation
On August 28, 2026, Buchalter learned a limited amount of its data was subject to unauthorised acquisition, including information relating to San Bernardino County matters.
En cours d’enquête
Brazil’s CAPES reports possible exposure of personal and bank data in Meus Dados
Improper access to Meus Dados may have exposed CPF identifiers, email/phone and bank information. No affected-person or record total is published.
En cours d’enquête
Daito Gas: Ryomo Systems intrusion may have exposed about 124,000 customers’ data
Ryomo Systems network intrusion may have exposed files with name/address/phone/billing IDs for customers from Nov 2023–Apr 2024 (~124,000); disclosed Sep 28, 2026. No bank/card data. Core customer system not breached.