依企業、國家、產業、發生年份和攻擊方式查詢事件，了解外洩資料、影響範圍、查證狀態、企業應對及來源。
On Oct 6, 2026 attackers allegedly impersonated admins on Commune-hosted BASE FOOD Labo; about 1,500 members’ email/nickname/profile data may have been viewed/taken (estimate). Passwords/DMs and shop address/card data out of scope. Disclosed Oct 9.
Commune platform intrusion (vendor-operated) may have exposed email, nickname, account name, bio, profile, groups, points and last-active time for 1,694 Wangan Midnight Arcade Portal members. Disclosed Oct 9, 2026 (updated Oct 14).
ApplyNow interview-service intrusion (Sep 7, 2026) leaked 86 FY2022–FY2023 staff-exam applicant records (name, email, phone, DOB, occupation, sex, exam no., pass/fail) and 30 city-admin records. Resumes/videos out of scope. City disclosed Oct 9.
Disclosed Oct 8, 2026. Third parties obtained mypage credentials via phone solicitation (and possibly other means) and logged in as customers. Services: BiZiMo, Hikari Giga, CLOUD LINE, Toppa!, Dantotsu, CP WiMAX. Possibly viewed name/address/phone/email/contract/billing (no cards/bank on mypage). 38,809 unauthorized logins counted per contract, not per person. No system intrusion/vulnerability confirmed.
Nippon Columbia Group employee PC infected with malware Oct 1–2, 2026; Daiichi Kosho data temporarily on that device may have leaked. Disclosed Oct 8 after Oct 5 vendor report. About 8,724,000 records (customers ~8.63M / staff ~93k after de-dup). Name, sex, DOB, email, phone. No intrusion into Daiichi systems. Actual exfiltration/misuse not confirmed.
On Oct 6, 2026 ~19:18–20:17, attackers impersonated admins on VALX’s Commune-hosted FUN community. Member-list data for an estimated 2,950 of 3,813 members may have been viewed/taken (email, nickname, profile, etc.). Passwords/DMs/store payment data out of scope. Disclosed Oct 8.
Scala Communications i-ask (used for website enquiries) was compromised; about 26,500 enquiry records (including repeat contacts) may have leaked name/DOB/address/phone/email/policy number/enquiry text (may include medical details). No intrusion into ORIX systems. No My Number/card numbers. Disclosed Oct 8. Distinct from the July agency mis-email incident.
Unauthorized access to vendor Commune’s servers left viewing records of Aomori Biiki member data; personal data may have leaked. Disclosed Oct 8, 2026. No exact headcount in the HTML notice (attachment PDF not retrieved) → blank.
An October 7 investigation found Lawson ID was accessed without authorisation on September 12-14 and the app reservation service on September 17.
Third-party access to hospital mail accounts may have exposed staff personal data; patient information confirmed not included. No confirmed misuse. No headcount. Disclosed Oct 8, 2026.
First notice Oct 8, 2026; follow-up Oct 16. Commune admin-impersonation led to illicit viewing of email, account name, user ID, company, role, name, SNS handle and prefecture for 1,200 nest Portal members (incl. churned). Portal suspended. Official pages unreachable at research time; body confirmed via public search of the official text and IncidentLog, official URLs retained.
Intrusion detected Oct 8, 2026 12:48; confirmed third-party and blocked 14:01; PPC flash report and police consult same day. Personal data for some NewsPicks users through Oct 8 (name, employer, email, address, phone, card name, last 3–4 card digits) may have leaked. Encrypted passwords not confirmed leaked. No exact headcount in the notice.
Customer notice emails and authenticity page on Oct 8, 2026; detailed notice Oct 9. Paths: (1) server intrusion Oct 2–4 leaking ~14.64M registrants (incl. ~4.13M hashed passwords); (2) ops-system intrusion Sep 20 affecting 17,780 records (duplicates; more under review) with name/phone/refund bank details; (3) bus booking completion pages viewable without login Aug 3–Oct 1 (~12,000 bookings scraped). No card numbers or passport images held. First disclosure Oct 8.
Disclosed Oct 8, 2026. Linked to the Sep 30 intrusion into Sagawa’s parcel-inquiry service; shipper/recipient name, address and phone for Fuji official-store buyers in the prior 100 days (incl. subscriptions) may be in scope. Whether Fuji customers are actually included still under confirmation. Cards/passwords out of scope per Sagawa. No headcount. Sagawa root not yet registered (official body unread).
Intrusion via an unrecognized legacy PMS account leaked name/phone/email/nationality/stay/property/rate data for 7,919 web-booked guests (Apr 8–Sep 14, 2026) at 8 properties. No address/card/passport. Disclosed Oct 7.
Suspicious access from early Oct 5, 2026. Personal data in 195 accounts (88 members / 107 staff etc.) may have been viewed; disclosed Oct 7. No payment data held.
Information in the network may have been accessed or downloaded without authorisation around June 19, 2026.
Toda detected unauthorised access to its supplier-payment system on October 5 and found traces of data leakage between October 1 and 5.
HIS announced on its website on October 7, 2026, after completing its review, that unauthorised access to the file server of Thailand subsidiary H.I.S. TOURS may have exfiltrated data.
Possible data leak: On Oct 6, 2026 illicit mail was sent from the Shibusawa MIX admin system. About 2,200 applicant names/emails were viewed; 3 had further details viewed; some registration data altered. Exfiltration/misuse not confirmed. Disclosed Oct 7.