已確認
So-net member database breach
Member names, email addresses, phone numbers and other fields were exposed.
資料外洩事件
依企業、國家、產業、發生年份和攻擊方式查詢事件，了解外洩資料、影響範圍、查證狀態、企業應對及來源。
已確認
BANDAI SPIRITS: 346,247 THE GUNDAM BASE MEMBERS email addresses leaked via Ymir Link breach
Bandai Namco Entertainment and BANDAI SPIRITS announced on October 27 that THE GUNDAM BASE MEMBERS email addresses leaked through the breach of Ymir Link, the Bandai Namco ID email contractor.
調查中
Sarku Japan reports possible employee-data exposure
On September 7, 2026, parts of systems became inaccessible in a cybersecurity incident; employment-related personal data may have been affected.
調查中
Rakuten Travel: customer data may have been exposed via intrusions into overseas-hotel and multilingual booking sites
Possible data leak: Rakuten said customer data was targeted by unauthorised access to some overseas-hotel booking pages run by subsidiary Rakuten Travel Xchange (detected September 10) and to the Rakuten Travel multilingual site (detected October 20).
調查中
ValueCommerce: 6,096 unique address-book emails may have been taken via Cuenote FC breach
Possible data leak: ValueCommerce announced on October 26 that address-book data appeared to have been exported from Cuenote FC; a October 30 update reported 6,096 unique emails (7,588 gross).
調查中
Cybozu: newsletter recipient emails may have leaked via Cuenote FC breach
Possible data leak: Cybozu announced that on October 26 Ymir Link said emails and related data in its Cuenote FC environment were likely leaked—after saying on October 20 that Cybozu was out of scope.
已確認
Yakult Honsha: 39,505 personal-data records leaked via website intrusion
Yakult confirmed and announced a website intrusion on October 26, 2026, and in its October 30 second report confirmed personal data of inquiry-form users and others had leaked.
調查中
Mainichi Shimbun: newsletter email addresses may have leaked via Cuenote FC breach
Possible data leak: Mainichi Shimbun announced on October 26 that Ymir Link said some Cuenote FC data used for newsletters was likely taken externally, and stopped delivery that day.
已確認
Navigate360: data copied from system
An unauthorised third party accessed a system and obtained copies of data between November 21, 2025 and March 5, 2026.
調查中
Nomura Securities: i-Port subscriber emails may have leaked via email-contractor breach
Nomura Securities announced on October 23 that Ymir Link, which emails i-Port subscribers, reported on October 22 that unauthorised access may have leaked stored email addresses and related data.
調查中
Lexitas reports possible exposure from misconfigured DepositionNet server
Possible data leak: A server configuration error made OnDemand (DepositionNet) files accessible without authentication since around September 2019; they may contain names with SSNs or driver’s licence numbers.
調查中
BASS Medical Group reports possible PHI access
Personal and/or protected health information may have been accessed or acquired without authorisation.
調查中
Sendai Gender Equal Foundation: newsletter data may have leaked via Blastmail breach
The foundation announced (page updated November 4) that Rakus Light Cloud's Blastmail, used for its "Mail de Ernab" newsletter, may have leaked recipient data after an intrusion notice.
已確認
Capcom: email addresses and IDs of 11,774,247 CAPCOM ID accounts leaked
Capcom found traces of unauthorised access to CAPCOM ID on October 19, 2026 and confirmed a leak of registered data and unauthorised password changes on some accounts.
調查中
DNP honto: newsletter member data may have leaked via Cuenote FC breach
DNP announced on October 21 that Ymir Link, email contractor for its honto bookstore, reported on October 19 that unauthorised access may have leaked honto customer data.
已確認
Osaka University: data of 77,851 people leaked after contractor NEC's shared files were downloaded
Osaka University was told by contractor NEC on October 9 that files containing university personal data had been downloaded by a third party on September 26.
已確認
Dorsata: Metabase flaw allowed database access
A Metabase vulnerability allowed unauthorised access to the database platform from August 10 to 12, 2026; affected data contained patients’ PHI but not SSNs.
已確認
Blastmail breach: all subscriber-account data and some delivery lists taken
Unauthorised access at subsidiary RAKUS Light Cloud’s Blastmail led to removal of all customer-account records including company/contact names, contacts and contract/payment histories; some delivery lists were also leaked.
已確認
Osaka Metropolitan University: related personal data leaked after NEC-subcontractor cyber-attack
In a fifth report on October 21, Osaka Metropolitan University said NEC reported on October 20 that a subcontractor attacked in late September used legitimate accounts to access university systems, and that university-related personal data in NEC cloud storage had leaked.
已確認
NEC: subcontractor cyber-attack caused customer system outages and leak of files including personal data
NEC announced on October 20 that a development/maintenance subcontractor was attacked in late September, stolen credentials were abused, customer environments were accessed and files in a shared cloud storage—including personal data—leaked.