按企业、国家、行业、发生年份和攻击方式查询事件，了解泄露数据、影响范围、核实状态、企业应对及来源。
Park24 detected unauthorised access to its Times Car car-sharing system on September 25, 2026, announced a possible member-data leak that day, and confirmed leaked ID-document images in its September 29 third report.
Anomaly on Sep 22, 2026 led to confirming unauthorized access. 1,536,322 reservation records (name, phone, email, shop/menu/time etc.) leaked; disclosed Sep 25 (Oct updates added support forms).
On Sep 7, 2026 a resident-system contractor mis-stored a Kotoura data file into another municipality’s private area; one staffer viewed it the same day and it was deleted. 828 people across several municipal datasets. No copy/print/external exfiltration found. Press notice Sep 25.
Unauthorized access via an EC admin-login vulnerability on Smaregi EC Repeat/B2B. Up to four merchant environments may be affected; customer/order/admin data may have been viewed or taken. Vulnerability fixed Sep 18; disclosed Sep 25, 2026.
A private 2018 membership list was mis-attached to an Aicon Navi event filing and approved. Third-party viewing found Sep 20, 2026 and removed same day. 599 people’s name, age, education, occupation etc. Disclosed Sep 21 (org name added Sep 22).
On Sep 16, 2026 ApplyNow confirmed leakage of FY2022–FY2025 video-interview entrants; city disclosed Sep 19. 1,701 records (name, email, phone). Videos out of scope.
Metabase vulnerability exploitation detected Sep 16, 2026. Confirmed theft of registrant data: ~40k Azas and ~20k Suloop accounts; disclosed Sep 18. Passwords not managed in the system.
Shopserve was breached May 21–Aug 1, 2026; on Sep 17 PFU learned legacy PFU Direct customers were in scope and disclosed Sep 18. Up to 169,355 orders (not unique people). Current EC out of scope. Cards/member IDs/passwords not confirmed leaked for PFU.
ApplyNow (then Open Cloud) intrusion may have exposed FY2020 video-screening applicants’ name, email, phone, DOB, sex and some address/occupation data; disclosed Sep 18, 2026. Notice cites 313 records but states the figure is not yet fixed.
On Sep 16, 2026 ApplyNow confirmed leakage of FY2023–FY2026 video-interview entrants; city disclosed Sep 17. 1,276 records (name, kana, phone, email, job category).
Unauthorized access to the corporate-site server may have exposed stored customer data; disclosed Sep 17, 2026. Breakdowns (~192 individuals, ~722 corporates, ~7,670 email-only) are approximate. Cards/passwords not stored. C-VALUE shopping is separate.
ApplyNow intrusion on Sep 7, 2026 may have exposed FY2022–2023 recording-interview registrants’ exam numbers, names, phones and emails (~600). Disclosed Sep 17. Videos out of scope.
Intrusion into contractor/subsidiary Chibagin Shoten’s corporate-site server may have exposed bank customers’ name, address, email, phone and application numbers; disclosed Sep 17, 2026. ~722 individuals and ~1,616 corporates. Cards/passwords not stored.
Possible data leak: Daiko Printing announced on September 16 that a skimming program capturing payment-page inputs had been present on PhotoGoods from August 6 to September 11, 2026.
Customer files sat on a publicly listable storage area from ~Nov 2017. Reported Sep 14, 2026; first notice Sep 16. Third notice (Oct 30) fixed timeline/counts to 2,492 organisations / 45,030 people (deduped emails). Passwords/MFA/cards out of scope. First disclosure remains Sep 16.
Helpfeel reported exfiltration during the September 11–12 Gyazo intrusion. Its final investigation also confirmed viewing or acquisition of 432 images belonging to 133 users.
Anomalies on Sep 8, 2026 led to finding multiple intrusions Sep 2–8. Possible exposure of name/address/phone/email for 1,409 riders/reservations; disclosed Sep 15. Cards held in a separate system.
Recording-interview system for a summer mid-career exam was breached Aug 9–Sep 7, 2026. City first disclosed a possible leak of 106 applicants on Sep 15; vendor confirmed name (kana), email and phone on Sep 24 (Oct 1 follow-up). First disclosure remains Sep 15.
Vendor confirmed FY2022 general-affairs exam applicants’ name, phone, email, DOB and receipt numbers leaked (113). Official follow-up page dated Oct 7, 2026 references a prior notice; first city disclosure treated as Sep 15, 2026.
Metabase vulnerability abuse from Aug 11, 2026 led to theft of customer data; disclosed Sep 15. Scope: about 440,000 accounts including churned users (unique people may be fewer). Email, nickname, sex, DOB, height/weight etc., hashed passwords, card last-4. PPC confirmed report Oct 23.