기업명, 국가, 업종, 발생 연도, 공격 방식으로 사건을 검색하고 유출 정보, 피해 규모, 확인 상태, 기업 대응과 출처를 확인하세요.
Shopserve was breached May 21–Aug 1, 2026; on Sep 17 PFU learned legacy PFU Direct customers were in scope and disclosed Sep 18. Up to 169,355 orders (not unique people). Current EC out of scope. Cards/member IDs/passwords not confirmed leaked for PFU.
An unauthorised actor used a compromised credential to acquire data from a file share used for civil-litigation discovery between December 28, 2025 and January 22, 2026.
An unauthorised actor accessed the network around June 22, 2026; the accessed systems contained personal information.
ApplyNow (then Open Cloud) intrusion may have exposed FY2020 video-screening applicants’ name, email, phone, DOB, sex and some address/occupation data; disclosed Sep 18, 2026. Notice cites 313 records but states the figure is not yet fixed.
PCP selection forms and welcome packets mailed between May 13 and July 8, 2026 contained other members’ data; names, dates of birth and member IDs may have gone to unrelated members.
Protected health information may have been accessed or acquired during unauthorised network access between December 22, 2025 and January 3, 2026.
On Sep 16, 2026 ApplyNow confirmed leakage of FY2023–FY2026 video-interview entrants; city disclosed Sep 17. 1,276 records (name, kana, phone, email, job category).
Unauthorized access to the corporate-site server may have exposed stored customer data; disclosed Sep 17, 2026. Breakdowns (~192 individuals, ~722 corporates, ~7,670 email-only) are approximate. Cards/passwords not stored. C-VALUE shopping is separate.
ApplyNow intrusion on Sep 7, 2026 may have exposed FY2022–2023 recording-interview registrants’ exam numbers, names, phones and emails (~600). Disclosed Sep 17. Videos out of scope.
Intrusion into contractor/subsidiary Chibagin Shoten’s corporate-site server may have exposed bank customers’ name, address, email, phone and application numbers; disclosed Sep 17, 2026. ~722 individuals and ~1,616 corporates. Cards/passwords not stored.
Possible data leak: Daiko Printing announced on September 16 that a skimming program capturing payment-page inputs had been present on PhotoGoods from August 6 to September 11, 2026.
Customer files sat on a publicly listable storage area from ~Nov 2017. Reported Sep 14, 2026; first notice Sep 16. Third notice (Oct 30) fixed timeline/counts to 2,492 organisations / 45,030 people (deduped emails). Passwords/MFA/cards out of scope. First disclosure remains Sep 16.
Helpfeel reported exfiltration during the September 11–12 Gyazo intrusion. Its final investigation also confirmed viewing or acquisition of 432 images belonging to 133 users.
Anomalies on Sep 8, 2026 led to finding multiple intrusions Sep 2–8. Possible exposure of name/address/phone/email for 1,409 riders/reservations; disclosed Sep 15. Cards held in a separate system.
Certain servers were accessed without authorisation at various times between July 9 and September 9, 2025, and stored information was viewed or obtained.
Recording-interview system for a summer mid-career exam was breached Aug 9–Sep 7, 2026. City first disclosed a possible leak of 106 applicants on Sep 15; vendor confirmed name (kana), email and phone on Sep 24 (Oct 1 follow-up). First disclosure remains Sep 15.
Files on company systems may have been accessed or acquired without authorisation between April 24 and May 7, 2026, and contained personal information.
Vendor confirmed FY2022 general-affairs exam applicants’ name, phone, email, DOB and receipt numbers leaked (113). Official follow-up page dated Oct 7, 2026 references a prior notice; first city disclosure treated as Sep 15, 2026.
Metabase vulnerability abuse from Aug 11, 2026 led to theft of customer data; disclosed Sep 15. Scope: about 440,000 accounts including churned users (unique people may be fewer). Email, nickname, sex, DOB, height/weight etc., hashed passwords, card last-4. PPC confirmed report Oct 23.
In early Sep 2026 a contractor reported losing one business PC. Possible contents: customer email addresses only (no name/address/DOB). No misuse found. Disclosed Sep 14.