依企業、國家、產業、發生年份和攻擊方式查詢事件，了解外洩資料、影響範圍、查證狀態、企業應對及來源。
Possible data leak: Starts Securities announced on October 31 that unauthorised access to Securitize, provider of its Starts Asset Token platform, obtained some customer data.
Club Tourism detected external unauthorised access to a server on October 30, 2026 and announced on October 31 that internet-member data may have leaked.
Kintetsu GHD announced on October 31 that unauthorised access to the digital-securities platform used for perks on its 135th unsecured bonds may have leaked data of investors who bought ¥1 million or more.
Rakuten Securities announced on October 31 that unauthorised access to the NTT DATA contractor digital-securities platform used for perk applications on bonds it sold may have leaked some customer data.
NTT DATA suspended STdirectServices after unauthorised access to a contractor SaaS it uses, saying personal data handled there may have leaked, and announced this on October 31.
Sony Bank announced on October 30 (updated November 4) that unauthorised access to Securitize Japan, its digital-securities vendor, leaked customer data.
Ryobi Systems found on October 27 that suspected impersonation logins to AITEL health-check booking accounts had viewed other users' data, and announced this on October 30.
A portable HDD used for medical-billing backups went missing from the claims unit in June 2026 (Reiwa 8) and was announced on October 30; accidental disposal is also considered possible.
NTT Smile Energy detected suspicious access to the Ecomegane web server on October 28, shut it down, and announced on October 30 that database-server attack traces meant customer data may have leaked.
MediaNavi announced on October 30 that unauthorised access to Rakus Light Cloud's Blastmail, used for its newsletter, leaked all held recipient email addresses and names.
On October 28, 2026, Matsuya Foods found unauthorised access to the Matsuya official-app management system and announced on October 30 that member data had leaked.
Ryohin Keikaku detected unauthorised external access and said email addresses, birth dates and gender in the MUJI app may have been leaked.
A breach at email provider Blastmail exposed email addresses for 489,564 customers. The November 4 second report no longer qualifies this as the maximum used in the initial notice.
Belc first posted notice of the Arara email-service intrusion on October 29 and, in a November 3 update, confirmed customer data had leaked.
Arara confirmed exfiltration through unauthorized access to its email-delivery platform. Its November 6 deduplicated scope of 81,329,467 email addresses also includes addresses that may have been acquired.
Japan Post announced on October 29 that unauthorised access to a contractor server used for international-mail My Page newsletters may have leaked some subscribers' email addresses.
Chugoku Electric announced on October 29 that unauthorised access to Sagawa Express's parcel-inquiry service, used for point-exchange deliveries, may have leaked some customer delivery data.
Clubnets announced a first report on October 29 that unauthorised access to the CN Points satellite systems may have leaked some members' personal data.
Asahi Shimbun announced on October 29 that unauthorised access to Ymir Link's Cuenote FC may have leaked customer data registered for events and similar activities—not Asahi Shimbun Digital subscription data.
Life Card was told on October 26 that unauthorised access to Ymir Link's Cuenote FC may have leaked some customer data, and announced this on October 28.