按企业、国家、行业、发生年份和攻击方式查询事件，了解泄露数据、影响范围、核实状态、企业应对及来源。
Possible data leak: Unauthorized access to the corporate site was identified June 29, 2026. Investigation could not fully rule out external exposure of contact-form personal data; disclosed Aug 27.
Possible data leak: Unauthorized access to part of a used cloud service confirmed Aug 25, 2026 and disclosed Aug 26. Condo-sales customer data were stored there; no confirmed leakage/misuse yet; access stopped pending investigation.
One staff mailbox was taken over via phishing and used to send 3,177 suspicious mails. The attacker could view the mailbox, so stored personal data may have been obtained; disclosed Aug 25, 2026 (updated Sep). Separate from the Sangenjaya campus incident.
After a CMS vulnerability disclosure, intrusion traces were found on the Hololive OCG site. Inquiry-form name/email/phone/content from July 4–19, 2026 may have been obtained; disclosed Aug 25. No confirmed defacement or proven exfiltration. Card-exchange desk out of scope.
Possible data leak: On Aug 24, 2026 unusual log-read API calls with the Stripe live key from non-company IPs were detected and the key revoked. First notice Aug 25; follow-up identified 100 possibly affected customers notified Sep 2. No financial misuse found. Service login passwords out of scope.
After unauthorized access to the corporate website, form-submission data may have been viewable; disclosed Aug 25, 2026. 297 people in scope.
Unauthorized access to the EC site disclosed Aug 25, 2026. Camera footage not confirmed compromised. Possible personal-data exposure prompted partial network shutdown and an external investigation; counts/fields not fixed in the first notice.
Of exemption-cancellation notices mailed for water-rate discounts, 174 households / 219 people returned as undeliverable and were stored in the office; after a layout change they were found missing on Aug 3, 2026. Apology letters from Aug 19; disclosed Aug 24. No known need to remove them from the office; documents still unfound.
Unauthorized access to the corporate “e-GIFT” admin system on Aug 11–12, 2026 may have briefly exposed contact name, company, IDs and partially masked email; disclosed Aug 24. Second report tied unauthorized gift redemptions to the same intrusion. End-recipient PII not held. Cards/passwords out of scope.
Credential-stuffing logins from Aug 20 22:00 to Aug 24 13:00, 2026 prompted a temporary shutdown; first notice Aug 24. Second report: 59,389 successful logins, possible my-page viewing, and two accounts with unauthorized point redemptions; service resumed Aug 25. No internal ID/password leak traces.
When updating the open-data food-business permit list, a wrong Excel was posted so facility address/phone fields held applicants’ home address/landline. Online from afternoon Aug 18 to ~18:30 Aug 20, 2026; removed after an external tip; disclosed Aug 21.
After phishing reports on the night of Aug 20, 2026 that correctly cited name/order no./amount, IMADEYA opened an investigation and posted Aug 21. Second report confirmed a Shopify Admin API token from an in-house integration was stolen and used from overseas IPs to pull order/customer data. Card data not leaked.
Suspicious activity on May 28, 2026 led to finding misuse of an employee account; systems were locked down. External review completed July 31; Aug 20 notice says files in some internal systems may have leaked. Cause assessed as malware on an endpoint.
Possible data leak: A Dec 2025 Excel roster of welfare commissioners posted on the city site retained a hidden sheet with past names/phones. A resident tip on Aug 6, 2026 led to remediation; disclosed Aug 20.
Possible data leak: Subsidiary Elitz’s cloud store of tenant-application email exchanges had an access-control gap found Aug 17, 2026 by an external assessor and fixed same day; holding company disclosed Aug 20. Final report (Sep 11) found no clear technical evidence of exfiltration and said no current leak risk. No public count.
On May 13, 2026 a subcontractor’s Microsoft 365 account was compromised via phishing and blocked same day. Expo-related mail/attachments may have exposed staff and performer personal data; disclosed Aug 20. General visitors and card data not in scope.
Possible data leak: Delightful’s Meruhaikun mailer used for the lost-pet support service was intruded, possibly exposing “Maigo Search Team” supporter registrations; disclosed Aug 20, 2026. Not a direct intrusion into Anicom/Pafe systems. Vendor root to be linked later.
Possible data leak: Unauthorized access found Mar 27, 2026 after PC anomalies; full isolation followed. After a Mar 30 outage notice, expert review found no confirmed exfiltration/misuse but could not rule out viewing; Aug 20 notice listed category counts for notification. No card data.
A Google Form for a prefectural disaster-leader training showed other applicants’ answers via the “show summary” setting. Flagged Aug 10, 2026; fixed same day; apologies Aug 12–17; disclosed Aug 19.
Possible data leak: Ransomware access to a personal-data server confirmed in Feb 2026 with immediate isolation. Aug 19 notice: inquiry customers’ personal data were temporarily viewable; no confirmed exfiltration or misuse.