調查中
Chikyosai: RIZAP generative-AI misuse may have exposed 726 members’ data
Possible data leak: After RIZAP reported an unapproved generative-AI upload, disclosed Sep 4, 2026. 726 people across 14 branches. Cards/accounts/credentials out of scope.
日本：依國家或地區查詢資料外洩事件
依企業、國家、產業、發生年份和攻擊方式查詢事件，了解外洩資料、影響範圍、查證狀態、企業應對及來源。
調查中
Dokenpo: RIZAP generative-AI misuse may have exposed 1,167 members’ data
Possible data leak: RIZAP fed 19,996 records into an unapproved generative-AI tool (1,167 of them Dokenpo’s). Third-party viewing/training use denied per the notice.
調查中
RIZAP: mistaken upload of health-guidance data to a consumer generative-AI service may have exposed personal and sensitive health data
Possible data leak: An employee uploaded specified health-guidance target data to a personal generative-AI service. The vendor said training use did not occur. Headcounts are published by each client; IHI kenpo, Dokenpo, Chikyosai and others disclosed separately as victims.
已確認
Seibu Railway: misconfiguration on “52 Seats of Bliss” booking site left reservation data externally readable
On the contractor-run “52 Seats of Bliss” booking site, encoded post-booking contact notes were externally decodable from Jan 9, 2025 to Aug 27, 2026; disclosed Sep 2.
調查中
IHI Group kenpo: RIZAP generative-AI misuse may have exposed 210 members’ data
Possible data leak: After RIZAP reported an employee fed target data into a generative-AI tool, disclosed Sep 2, 2026. 210 members. Cards/accounts/passwords not included per RIZAP.
調查中
Chiba Pref.: biodiversity-center site intrusion may have exposed survey-member personal data
Possible data leak: Unauthorized access to the biodiversity-center “survey club” pages was flagged via prefectural police and disclosed Sep 1, 2026. Data for 1,963 members were stored; no confirmed leakage yet; investigation ongoing.
調查中
Mitsui Fudosan: credential misuse on used systems may have exposed staff and external-contact data
Unauthorized access to some systems confirmed Aug 28, 2026. Credential misuse may have exposed up to ~19k staff records and ~36k external email contacts; disclosed Sep 1. Business files/passwords not confirmed leaked.
已確認
TRUNK: staff mailbox intrusion leaked 424 people’s personal data
A staff mailbox was compromised; 424 records (name, address, email, employer etc.) leaked and spoofed mails were sent; disclosed Sep 1, 2026. No card data held.
已確認
Kwansei Gakuin University: adjunct-used external SNS hyocom left 1,448 students’ data viewable
An adjunct’s class SNS “hyocom” left student/alumni name, student ID, grades, photos etc. viewable online or to members; disclosed Sep 1, 2026. 1,448 people.
已確認
Ando Hazama: employee tricked by fake police sent about 5,000 business-card records
An employee, posed as helping a police inquiry, downloaded business-card records on Aug 17, 2026 and emailed them to a scammer. Internally discovered Aug 24; disclosed Aug 31.
已確認
Niigata City Yamagata JH: health and dental records for 387 students lost
During a major renovation move at Yamagata Junior High, health and dental records for all 387 students went missing. Noticed July 28, 2026; parent briefing Aug 28; disclosed Aug 31.
調查中
Mandarake: server intrusion may have exposed mail-order customers’ shipping data
Possible data leak: Unauthorized server access confirmed Aug 27, 2026; services paused and a status page published around Aug 30. Intrusion into a shipping-info server was confirmed, but the Oct 28 final report found no evidence of viewing/exfiltrating DB personal data.
已確認
Yellow Hat: data of 1,797,124 members exfiltrated from web service-booking system
Yellow Hat detected unauthorised access to its web service-booking system in August 2026, announced a possible leak on August 28, and confirmed customer data was exfiltrated in its October 15 second report.
調查中
Corona: construction-info cloud intrusion may have exposed up to 35,000 customers
Unauthorized access to an external cloud holding construction records may have exposed customers’ names/addresses etc.; disclosed Aug 28, 2026.
調查中
MHLW: lost minimum-wage survey forms may have exposed personal data on 339 people (gross)
Minimum-wage basic-survey forms went missing in transit; possible exposure of establishment and worker-related fields totaling a gross 339 people was disclosed Aug 28, 2026.
已確認
Kindal: phishing takeover of an EC staff account leaked 136,464 customers’ data
A phishing mail harvested an EC-platform staff account; unauthorized login and bulk customer export occurred Aug 22–23, 2026. Parent Treasure Factory disclosed Aug 28. 136,464 people (109,311 with addresses). Cards and storefront passwords out of scope.
調查中
Co-op Yamaguchi: LINE mini-app DB intrusion may have exposed member and related data
Possible data leak: Unauthorized access to the Co-op Yamaguchi LINE mini-app disclosed Aug 28, 2026. Second report listed several category counts (members with/without e-money cards, reservation users, etc.). Cards, bank accounts, passwords and sensitive personal data out of scope.
調查中
Zurich Japan: dashcam-upload system intrusion may have leaked data on up to 1,668 customers
Review of dashcam-upload system Z-Dash found a vulnerability and possible personal-data exposure from unauthorized access on Apr 1 and Apr 6, 2026; disclosed Aug 27. Video, cards and bank accounts out of scope.
已確認
COO: Meruhaikun intrusion leaked 2,255 customer email addresses
Forensic work on Delightful’s Meruhaikun intrusion confirmed 2,255 of COO’s newsletter emails were in the leaked set; disclosed Aug 27, 2026. Vendor root to be linked later.
調查中
CINRA JOB: vulnerability-driven intrusion may have exposed 21,508 members’ data
Unauthorized access to CINRA JOB disclosed Aug 27, 2026. Final report: a program vulnerability let attackers obtain credentials; 21,508 members (incl. withdrawn) may be in scope (name, DOB, sex, address, etc.); no confirmed misuse.