기업명, 국가, 업종, 발생 연도, 공격 방식으로 사건을 검색하고 유출 정보, 피해 규모, 확인 상태, 기업 대응과 출처를 확인하세요.
Possible data leak: Vendor reported management-server intrusion on June 30, 2026; first notice July 7. Second notice found brute-force admin login and download of inquiry-mail bodies from before June 29, 2026.
On June 25, 2026 staff found names/lot numbers in published bid drawings; posting paused July 2; first notice July 6. July 24 results finalized people counts for bid drawings and public-works evaluation sheets. No secondary harm found.
Possible data leak: On July 6, 2026 IPSJ disclosed that some young-researchers’ personal data remained technically viewable via lingering ex-officer access and unrevoked sharing links from accounting work; access has been closed and individuals notified.
Server intrusion noticed April 28, 2026; possible personal-data exposure found June 19; first notice July 3. Second notice cites possible theft/misuse of an auth-federation account.
After self-checks prompted by other cities’ masking failures, 57 files made with print-menu PDF conversion still allowed masked text to be viewed via certain operations; disclosed July 3, 2026. Files recovered/destroyed; no secondary use found.
Possible data leak: Noticed June 30, 2026; site stopped July 1; first notice July 2 (then stated no personal data held). On July 23 inquiry-form data was found stored; second notice July 24. Final report confirmed vulnerability abuse but no view/exfil traces. Separate from the ApplyNow incident.
Unauthorized login to an employee mailbox/cloud on June 17, 2026; noticed via suspicious mail on June 24; first notice July 1. Second notice attributes it to phishing impersonating a business partner.
Unauthorized access to the EC site confirmed June 22, 2026; first notice July 1. Second notice confirmed vulnerability abuse and exfiltration of customer data.
Possible data leak: Tabiq’s Amazon S3 bucket holding selfie/signature/passport images was publicly reachable. Press coverage began May 15, 2026; the company’s count-bearing formal notice is dated June 30. disclosedOn uses the formal official notice date; the earlier press piece is attached as a source.
After Delightful Meruhaikun intrusion on June 16, 2026, FLOW disclosed possible exposure of 1,593 LyuVie mailer name/email rows. Address, phone and cards were not stored in that system. Vendor root to be linked later.
Intrusion into Aflac Yorisou Net and related systems leaked customer/agency data; first notice June 30, 2026. Second notice corrected earliest access to June 10 and restated customers as “about 4.4 million”.
A junior-high teacher kept student personal data on a personal SD card and lost it on June 13, 2026; the city disclosed June 29. Scope is 904 students (some alumni FY2014–2025 and some current Year-3).
NAS encryption noticed June 2, 2026 and isolated. Possible exposure of event-participant character contacts (name, org, phone, email, address) disclosed June 29. No confirmed exfiltration or secondary harm yet.
Possible data leak: A volunteer/officials QR page was found searchable externally on June 22, 2026 and removed the same day; disclosed June 26. Viewable from May 1, 2024 through June 22, 2026.
On June 24, 2026 an Ishinomaki HS teacher mis-posted graded Math II exams for 182 Year-2 students to the school groupware; removed same day; prefecture disclosed June 26. No SNS secondary leak confirmed.
On June 17, 2026 a teacher ran remote-access malware after a support scam. No illicit operations were found on the school admin system, but local files with some student names, class, grades and guidance notes may have been exposed; disclosed June 25.
Possible data leak: After Meruhaikun intrusion on June 16, 2026 affecting training mailers, ELEC disclosed June 25. Count/fields still under investigation. Address, phone and payment data not stored in that system. Vendor root to be linked later.
On June 16, 2026 staff emailed a citywide farmland-management file (filterable to all farmers) to one farm corporation instead of that corporation’s subset; noticed June 19, disclosed June 25. Deletion confirmed; no misuse found.
After a June 12, 2026 provider alert, investigation found mailbox intrusion on the Rakuraku Assessment account may have exposed 523 customer/partner mail records; disclosed June 24.
On June 16, 2026 a contracted coordinator CC’d 297 support companies instead of BCC; disclosed June 24.