調查中
San’in Godo Bank: lost vendor PC may have exposed customer email addresses
In early Sep 2026 a contractor reported losing one business PC. Possible contents: customer email addresses only (no name/address/DOB). No misuse found. Disclosed Sep 14.
日本：依國家或地區查詢資料外洩事件
依企業、國家、產業、發生年份和攻擊方式查詢事件，了解外洩資料、影響範圍、查證狀態、企業應對及來源。
調查中
Azuma Sangyo: website intrusion may have exposed contact-form customer data
Unauthorized access via a website vulnerability confirmed Sep 8, 2026; first notice Sep 14. Oct 14 follow-up: name, organisation, address, phone, email and enquiry text from contact forms may have leaked. No headcount published.
調查中
Nihon University: phishing of faculty/staff mailboxes may have exposed stored personal data
Possible data leak: Six faculty/staff accounts (5 in the Sep 14 report, +1 staff in the Oct 27 update) were phished and used to send 3,977 spam messages. No large exfiltration found, but some mailbox data access cannot be ruled out. University-level notice first dated Sep 14, 2026 (page fetched as Oct 27 update). Separate from faculty-specific notices.
調查中
Dozle: malicious Shopify app redirected checkouts to a fake page; customer data may have been exposed
Possible data leak: On Sep 11, 2026 ~15:00–17:50, Dozle Store checkouts were redirected to a non-official page via a third-party Shopify app. Payments on the fake page were not accepted as Dozle orders. Impact on Dozle-held customer data still under investigation; disclosed Sep 12 (updates Sep 15/18).
已確認
Sankei: RESPECTion! symposium form misconfiguration left 149 applicants’ answer summaries viewable
Summary view was left enabled on the symposium form from Aug 24–Sep 10, 2026, exposing other applicants’ name, email and optional questions. 149 people. Disclosed Sep 11. No cards/accounts/passwords collected.
已確認
IEEJ: phishing of Microsoft 365 accounts led to external leakage of mail and files
After a Jul 29, 2026 tip, investigation found phishing of six staff M365 accounts with traces of 5,417 mail views and 3,272 file views (2,798 downloads). Disclosed Sep 11. No person-level headcount given.
調查中
Fuji City: ApplyNow platform intrusion may have exposed staff-exam applicants’ personal data
After ApplyNow’s Sep 9, 2026 disclosure, the vendor reported on Sep 10 that FY2022–FY2026 presentation-video exam applicants’ name, email, phone and exam numbers may have been taken (~800). City disclosed Sep 11. Video files out of scope.
已確認
Rohto mail-order customer and call-recording breach
Misused telephone-system credentials enabled customer-data access.
調查中
Digital Agency: VPN intrusion into GSS may have leaked about 246,000 staff and related personal records
Mass file access detected Jun 25, 2026; VPN appliance intrusion confirmed Jul 9. About 246,000 staff/related personal records may have leaked; disclosed Sep 11. Public citizens’ data, My Number and bank accounts out of scope.
已確認
Ichini: Senkyo.com mail sent with To: instead of BCC leaked 339 email addresses
A Sep 6, 2026 proposal mail put recipients in To instead of BCC, exposing 339 addresses. Disclosed Sep 10. No other fields leaked.
調查中
Mitsui Ocean Cruises: lost transfer media may have exposed passenger and crew personal data
External media used to migrate data from Nippon Maru went missing in Jul 2026; passenger/crew personal data may have been on it; disclosed Sep 10. Counts still under review.
已確認
Saitama Pref.: incomplete PDF masking in a disclosure released personal data on 536 students (gross)
An information-disclosure file’s masking could be undone, revealing withheld fields. Scope: 536 students (gross) in tuition-waiver records. Disclosed Sep 10, 2026.
已確認
Kamogawa City: furusato survey misconfiguration let applicants view 218 peers’ personal data
A contractor furusato campaign survey let respondents view prior answers (address, name, phone, email) from Aug 31–Sep 1, 2026. 218 respondents. Disclosed Sep 9.
已確認
ApplyNow breach affects 396,920 people
A vulnerable analytics tool enabled access to service databases.
調查中
Nihon University CST: phishing takeover of a staff mailbox may have exposed stored personal data
One staff mailbox was phished and used to send spam. Stored personal data may have been viewed; disclosed Sep 8, 2026. Separate from the Law faculty incident.
已確認
Kyoto Sanga F.C.: fan-club file for 15,612 members emailed in error
A staff email to a business partner wrongly attached fan-club data (15,612 people as of Jul 3, 2026); 2 of 11 recipients opened it. Occurred Sep 2; disclosed Sep 8. Cards/accounts out of scope.
調查中
Rikkyo University: compromised student/alumni Google accounts may have exposed mailbox personal data
Possible data leak: Unauthorized access to 6 Google accounts (4 students, 2 alumni) from Apr 27–Aug 24, 2026 sent 17,668 spam messages; one faculty name/email appeared in a body. Disclosed Sep 8.
調查中
Science Tokyo: possible personal-data leak after infrastructure intrusion affecting students and staff
Infrastructure intrusion may have exposed name/address/email of students/staff from the merged universities; first notice Sep 7, 2026. Hospital patient data not confirmed; counts under review.
已確認
King Jim: Shopserve intrusion leaked legacy EC customers’ personal data
Legacy Shopserve (Estore) was breached May 21–Aug 1, 2026; on Aug 31 King Jim learned past store customers were in scope and disclosed Sep 4. Current EC out of scope. Cards/passwords not confirmed leaked.
已確認
Osaka High Court: Teams mis-invite of about 6,000 accounts exposed usernames and emails to each other
On Aug 27, 2026 a case Teams team wrongly added ~3,500 external and ~2,500 staff accounts; invitees could see each other’s usernames/emails until same-day deletion. Court notices index dates the apology Sep 4.