En cours d’enquête
MSC: website intrusion may have exposed 297 form users’ personal data
After unauthorized access to the corporate website, form-submission data may have been viewable; disclosed Aug 25, 2026. 297 people in scope.
Fuites de données et incidents de sécurité des entreprises
Recherchez par entreprise, pays, secteur, année et méthode d’attaque. Consultez les données concernées, la portée, la vérification, les réponses et les sources.
En cours d’enquête
Ramrock: Mimamori CUBE EC-site intrusion may have exposed personal data
Unauthorized access to the EC site disclosed Aug 25, 2026. Camera footage not confirmed compromised. Possible personal-data exposure prompted partial network shutdown and an external investigation; counts/fields not fixed in the first notice.
En cours d’enquête
LACMA: files with personal data may have been affected by network intrusion
Possible data leak: LACMA detected suspicious activity on July 11, 2025; an unauthorised third party accessed part of the network from July 7 to 11, 2025, and impacted files contained personal information.
Confirmé
Yokohama Waterworks: 219 people’s returned exemption-cancellation notices went missing
Of exemption-cancellation notices mailed for water-rate discounts, 174 households / 219 people returned as undeliverable and were stored in the office; after a layout change they were found missing on Aug 3, 2026. Apology letters from Aug 19; disclosed Aug 24. No known need to remove them from the office; documents still unfound.
En cours d’enquête
ANA Trading: e-GIFT platform intrusion may have leaked corporate-contact personal data
Unauthorized access to the corporate “e-GIFT” admin system on Aug 11–12, 2026 may have briefly exposed contact name, company, IDs and partially masked email; disclosed Aug 24. Second report tied unauthorized gift redemptions to the same intrusion. End-recipient PII not held. Cards/passwords out of scope.
En cours d’enquête
Fancrew: credential-stuffing logins may have exposed 59,389 members’ profile data
Credential-stuffing logins from Aug 20 22:00 to Aug 24 13:00, 2026 prompted a temporary shutdown; first notice Aug 24. Second report: 59,389 successful logins, possible my-page viewing, and two accounts with unauthorized point redemptions; service resumed Aug 25. No internal ID/password leak traces.
Confirmé
Ehime Pref.: open-data food-permit file wrongly posted applicants’ home addresses and phones
When updating the open-data food-business permit list, a wrong Excel was posted so facility address/phone fields held applicants’ home address/landline. Online from afternoon Aug 18 to ~18:30 Aug 20, 2026; removed after an external tip; disclosed Aug 21.
En cours d’enquête
Genesis Healthcare Management: client patient data may have been impacted after file access
Files on management company Genesis’s network holding Kern Psychiatric Health and Wellness Center data were accessed without authorisation; names, SSNs, ID numbers, dates of birth and diagnoses may have been impacted.
Confirmé
IMADEYA: stolen Shopify Admin API token used to exfiltrate order/customer data
After phishing reports on the night of Aug 20, 2026 that correctly cited name/order no./amount, IMADEYA opened an investigation and posted Aug 21. Second report confirmed a Shopify Admin API token from an in-house integration was stolen and used from overseas IPs to pull order/customer data. Card data not leaked.
Confirmé
The Health Trust and FASS: information accessed or copied
An unknown actor accessed certain systems before March 26, 2025 and again between June 8 and 11, 2025, and accessed and/or copied information.
En cours d’enquête
POLAM FCU: former employee may have exfiltrated documents
Around May 20, 2025, the credit union learned a former employee potentially accessed and/or exfiltrated a limited number of documents without authorisation.
En cours d’enquête
Southern Illinois University: Oracle EBS files may have been accessed or acquired
Around July 24, 2026, SIU found files containing personal information in its Oracle E-Business Suite environment may have been subject to unauthorised access or acquisition between July 10 and August 16, 2025.
En cours d’enquête
NE Chemcat: internal-system intrusion may have leaked staff and related personal data
Suspicious activity on May 28, 2026 led to finding misuse of an employee account; systems were locked down. External review completed July 31; Aug 20 notice says files in some internal systems may have leaked. Cause assessed as malware on an endpoint.
En cours d’enquête
Okawa City: hidden Excel sheet may have exposed 188 past welfare commissioners’ names/phones
Possible data leak: A Dec 2025 Excel roster of welfare commissioners posted on the city site retained a hidden sheet with past names/phones. A resident tip on Aug 6, 2026 led to remediation; disclosed Aug 20.
En cours d’enquête
Elitz: cloud ACL gap on tenant-application email archives may have exposed personal data
Possible data leak: Subsidiary Elitz’s cloud store of tenant-application email exchanges had an access-control gap found Aug 17, 2026 by an external assessor and fixed same day; holding company disclosed Aug 20. Final report (Sep 11) found no clear technical evidence of exfiltration and said no current leak risk. No public count.
Confirmé
Inission Power confirms parts of databases appeared online after ransomware
Inission Power Oy and Inission Power Finland Oy reported that parts of affected databases were found online after a ransomware incident detected on June 22.
En cours d’enquête
Expo 2025 Association: subcontractor Microsoft 365 intrusion may have exposed staff/performer data
On May 13, 2026 a subcontractor’s Microsoft 365 account was compromised via phishing and blocked same day. Expo-related mail/attachments may have exposed staff and performer personal data; disclosed Aug 20. General visitors and card data not in scope.
En cours d’enquête
Anicom Sompo: Meruhaikun intrusion may have leaked 14,330 lost-pet search supporters’ data
Possible data leak: Delightful’s Meruhaikun mailer used for the lost-pet support service was intruded, possibly exposing “Maigo Search Team” supporter registrations; disclosed Aug 20, 2026. Not a direct intrusion into Anicom/Pafe systems. Vendor root to be linked later.
En cours d’enquête
COTA: cyberattack may have allowed viewing of staff, partner, shareholder and customer data
Possible data leak: Unauthorized access found Mar 27, 2026 after PC anomalies; full isolation followed. After a Mar 30 outage notice, expert review found no confirmed exfiltration/misuse but could not rule out viewing; Aug 20 notice listed category counts for notification. No card data.
Confirmé
Shizuoka Pref.: Google Form misconfiguration let applicants view 109 peers’ personal data
A Google Form for a prefectural disaster-leader training showed other applicants’ answers via the “show summary” setting. Flagged Aug 10, 2026; fixed same day; apologies Aug 12–17; disclosed Aug 19.