調查中
OM UK reports possible personal-data leak through Beacon CRM breach
Compromised Beacon CRM credentials may have allowed database downloads and possible access to OM UK personal information. Individual impact and counts are not established.
資料外洩事件
依企業、國家、產業、發生年份和攻擊方式查詢事件，了解外洩資料、影響範圍、查證狀態、企業應對及來源。
調查中
Wadomari Town: inadequate redaction of a bullying investigation report may have leaked personal data
Possible data leak: A bullying investigation committee report posted July 23, 2026 had inadequate personal-data protection; noticed Aug 3 and disclosed Aug 4. Posting stopped, corrected and re-posted; individuals notified. No published count/fields.
調查中
Kyoto Prefecture: KYOiku TV favorites flaw may have exposed member names on the open web
Possible data leak: On the contracted on-demand learning site “KYOiku TV”, names and registration dates of members using Favorites were viewable by anyone; some also appeared in search results. Feature/site stopped; disclosed Aug 4.
調查中
Malin + Goetz: payment page code may have captured card data
Unauthorised code on the website checkout/payment page may have captured details entered, including names and payment card information, at times between May 22 and June 10, 2026.
調查中
Possible leak of Chubu Electric corporate email and contact information
Chubu Electric learned of unauthorized access following an external tip on July 29 and disclosed on August 4 that staff-related email and contacts may have been viewed or leaked.
已確認
Innovation: leaked GitHub credentials from a dev config exposed data on 62,689 customers
GitHub credentials in a development config were obtained and used to access repositories. Customer data stored during analysis/development was exfiltrated. Confirmed-notice count corrected to 62,689 people.
已確認
Toshiba Tec ShopCraft: admin credentials in a procedure doc exposed 382,123 other merchants’ customers
A procedure document for one merchant wrongly included admin credentials that could view other merchants’ customer data from March 26 to June 23, 2026. That merchant said it did not view the data. Not exposed to the open internet. Disclosed Aug 3.
調查中
Kaigetsukan: intrusion may have leaked guest names and contact details
Group lodging facilities were intruded from the evening of July 29 through the morning of July 30, 2026; possible external leakage of guest names/contacts disclosed Aug 3. Stay details and card numbers stated not leaked. No headcount.
調查中
Miyamoto Munashi: takeout-site intrusion may have leaked orderer personal data
Takeout ordering site intruded on July 29, 2026; possible exposure of Mar–Jul 2026 orderers’ name, kana, phone, email and order details (including guest/cancel); disclosed Aug 3. Payments held by external processor.
已確認
Fukuoka Prefecture: Kitakyushu HS trial-enrollment site exposed 293 other applicants’ data
On the Kitakyushu HS trial-enrollment site, a confirm button exposed other applicants’ data. From July 3–24, 2026, 293 applicants’ names (kana) and questions were viewable; a junior high reported it; disclosed Aug 3.
已確認
Corporate Travel Service: network intrusion reached systems containing personal data
An unauthorised actor accessed the network environment; on July 2, 2026 the company found that systems accessed between December 3 and 11, 2025 contained personal information.
調查中
Kodansha: phishing-led mailbox takeover may have stolen up to 3,812 contacts
Possible data leak: On July 27, 2026 an employee entered credentials on a partner-spoofing phishing page. On July 30 attackers logged into the work mailbox, stole contacts and phished 553 of them impersonating the employee; disclosed Aug 3.
已確認
Fukuoka Prefecture: Chikugo agriculture office mis-emailed file on 300 new-farmer applicants
On July 13, 2026 Chikugo agriculture-forestry office staff emailed 11 municipalities/farm groups a survey and wrongly attached a file with 300 applicants’ names, ages, subsidy amounts, etc.; deletion confirmed; disclosed Aug 3.
已確認
Estore ShopServe: data of about 23.36 million buyers and members leaked via vulnerability
From May 21 to August 1, 2026, attackers exploited an application vulnerability on ShopServe servers and sent database contents out. Estore detected and blocked it on August 1 and announced it that day.
已確認
EPARK Relax & Esthe PeakManager: about 22.18 million salon customer records leaked
EPARK Relax & Esthe announced on July 31 an intrusion into its PeakManager booking platform. Its September 24 second report confirmed the customer database was transferred out and then deleted (since restored).
調查中
Central Consultant: corporate-site intrusion may have left inquiry/recruitment data viewable
Possible data leak: Corporate site was intruded via a vulnerability from July 18–30, 2026; investigation found inquiry/recruitment-form DB contents were viewable/obtainable by third parties; first notice July 31. No published count.
調查中
Possible leak affecting 44,399 Sakura Mobile Travel Plan customers
Og detected unauthorized access on July 27 and announced on July 31 that information of 44,399 Travel Plan customers may have been viewed or leaked.
已確認
JIHS: lost cardiac-exam HDD left data on 83,007 patients unaccounted for
An HDD removed for disposal from a cardiac exam device and stored in a locked warehouse was found missing on April 16, 2026 and remains unfound. It held exam data from Dec 1998–Dec 2023. Disclosed July 31. No confirmed external leak or misuse.
調查中
Hacobu: lost MOVO Berth tablets may have allowed viewing of up to 50,384 driver records
Possible data leak: Some customer-loaned tablets returned to Hacobu were later lost in internal handling. Depending on return state, a third party might have logged into the service and viewed driver name/phone/email/company entered at booking. No confirmed external exfiltration.
已確認
Shin-Sapporo Howakai Hospital: old EHR PC HDD not destroyed and sold via auction, leaking patient data
After a ~Sep 2023 EHR refresh, old PCs were sent to a waste contractor for physical HDD destruction, but drives were not destroyed, were built into other parts and sold online. Sensitive patient name/DOB/clinical data had leaked; disclosed July 30, 2026.