依企業、國家、產業、發生年份和攻擊方式查詢事件，了解外洩資料、影響範圍、查證狀態、企業應對及來源。
Unauthorized external access confirmed Oct 6, 2026 and blocked. Multiple files may have been exfiltrated and may include customer data (under investigation). Mega Egg customer data not confirmed leaked. No headcount. Disclosed Oct 9.
Commune reported an Oct 6, 2026 intrusion on Oct 7. Admin-account abuse on Toki Labo led to confirmed viewing/acquisition and leakage of display name, username, email and profile (including name/address/age/phone) for 2,950 members registered after the May 12, 2026 renewal. Disclosed Oct 9.
Commune intrusion Oct 5–6, 2026 may have exposed user ID, display name, email and optional profile fields for 1,450 Lookmee Room members. Core Lookmee product / parent-child data on separate systems unaffected. Disclosed Oct 9.
Possible data leak: Around 21:50 on Oct 7, 2026, Kissei Shoji staff received a data-theft notice email. Parent Kissei Pharmaceutical disclosed Oct 9. Exfiltration cannot be ruled out and may include sensitive personal information. Counts/confirmation under investigation.
Commune platform intrusion with admin impersonation led to confirmed viewing/acquisition of email, nickname, age, sex and profile data for all 358 members. Name/address not leaked (Oct 11 update). Disclosed Oct 9.
Commune server intrusion confirmed leakage of ZENB GARDEN member data for 897 people (email, sex, nickname, profile, etc.). Upper bound all 949 members. Name/address/phone/payment/official-store data and passwords not in scope/not leaked. Disclosed Oct 9.
On Oct 6, 2026 Commune-hosted Mount Cafe club was accessed; member-list data for an estimated 291 members (email, display name, profile, etc.) may have been viewed/taken. Confirmed exfiltration not established. Disclosed Oct 9.
On Oct 6, 2026 attackers allegedly impersonated admins on Commune-hosted BASE FOOD Labo; about 1,500 members’ email/nickname/profile data may have been viewed/taken (estimate). Passwords/DMs and shop address/card data out of scope. Disclosed Oct 9.
Commune platform intrusion (vendor-operated) may have exposed email, nickname, account name, bio, profile, groups, points and last-active time for 1,694 Wangan Midnight Arcade Portal members. Disclosed Oct 9, 2026 (updated Oct 14).
ApplyNow interview-service intrusion (Sep 7, 2026) leaked 86 FY2022–FY2023 staff-exam applicant records (name, email, phone, DOB, occupation, sex, exam no., pass/fail) and 30 city-admin records. Resumes/videos out of scope. City disclosed Oct 9.
Disclosed Oct 8, 2026. Third parties obtained mypage credentials via phone solicitation (and possibly other means) and logged in as customers. Services: BiZiMo, Hikari Giga, CLOUD LINE, Toppa!, Dantotsu, CP WiMAX. Possibly viewed name/address/phone/email/contract/billing (no cards/bank on mypage). 38,809 unauthorized logins counted per contract, not per person. No system intrusion/vulnerability confirmed.
Nippon Columbia Group employee PC infected with malware Oct 1–2, 2026; Daiichi Kosho data temporarily on that device may have leaked. Disclosed Oct 8 after Oct 5 vendor report. About 8,724,000 records (customers ~8.63M / staff ~93k after de-dup). Name, sex, DOB, email, phone. No intrusion into Daiichi systems. Actual exfiltration/misuse not confirmed.
On Oct 6, 2026 ~19:18–20:17, attackers impersonated admins on VALX’s Commune-hosted FUN community. Member-list data for an estimated 2,950 of 3,813 members may have been viewed/taken (email, nickname, profile, etc.). Passwords/DMs/store payment data out of scope. Disclosed Oct 8.
Scala Communications i-ask (used for website enquiries) was compromised; about 26,500 enquiry records (including repeat contacts) may have leaked name/DOB/address/phone/email/policy number/enquiry text (may include medical details). No intrusion into ORIX systems. No My Number/card numbers. Disclosed Oct 8. Distinct from the July agency mis-email incident.
Unauthorized access to vendor Commune’s servers left viewing records of Aomori Biiki member data; personal data may have leaked. Disclosed Oct 8, 2026. No exact headcount in the HTML notice (attachment PDF not retrieved) → blank.
An October 7 investigation found Lawson ID was accessed without authorisation on September 12-14 and the app reservation service on September 17.
Third-party access to hospital mail accounts may have exposed staff personal data; patient information confirmed not included. No confirmed misuse. No headcount. Disclosed Oct 8, 2026.
First notice Oct 8, 2026; follow-up Oct 16. Commune admin-impersonation led to illicit viewing of email, account name, user ID, company, role, name, SNS handle and prefecture for 1,200 nest Portal members (incl. churned). Portal suspended. Official pages unreachable at research time; body confirmed via public search of the official text and IncidentLog, official URLs retained.
Intrusion detected Oct 8, 2026 12:48; confirmed third-party and blocked 14:01; PPC flash report and police consult same day. Personal data for some NewsPicks users through Oct 8 (name, employer, email, address, phone, card name, last 3–4 card digits) may have leaked. Encrypted passwords not confirmed leaked. No exact headcount in the notice.
Customer notice emails and authenticity page on Oct 8, 2026; detailed notice Oct 9. Paths: (1) server intrusion Oct 2–4 leaking ~14.64M registrants (incl. ~4.13M hashed passwords); (2) ops-system intrusion Sep 20 affecting 17,780 records (duplicates; more under review) with name/phone/refund bank details; (3) bus booking completion pages viewable without login Aug 3–Oct 1 (~12,000 bookings scraped). No card numbers or passport images held. First disclosure Oct 8.