オリックス生命（業務委託先スカラコミュニケーションズのFAQシステム「i-ask」）Data breach / unauthorized access incident
- Occurred on
- October 2, 2026
- Announced on
- October 8, 2026
- Severity
- AFinancial and HR records — information that easily translates into monetary damage.
- Scale
- 26,500 records
- Main impact
- Due to unauthorized access to the admin site of the FAQ system “i-ask” operated by subcontractor スカラコミュニケーションズ, it was disclosed that about 26,500 records (total counts including multiple inquiries by the same customer) of names, dates of birth, addresses, phone numbers, email addresses, policy numbers, inquiry contents, and medical information reported by customers may have been exposed. My Number and credit card numbers were not affected. The incident was detected by a monitoring alert on the morning of October 3 and was blocked and isolated the same day; individual notifications to potentially affected customers and an investigation by external specialists are underway.
- Information involved
- Full nameDate of birthHome addressPhone numberEmail addressUser / member IDHealth & medical data
- Cause / key point
- Unauthorized login by a third party to the outsourced FAQ system “i-ask” admin site and installation of malicious software (2026-10-02 20:30 approx. to 2026-10-03 08:00 approx.); password changes and isolation were implemented.About Abuse of credentials
- Industry
- Finance & insurance
- Listing / capital
- UnlistedParent company (listed holding company): オリックスホールディングス(TSE Prime 8591)
The incident entity, オリックス生命保険株式会社, is unlisted and is under オリックスホールディングス (TSE Prime・8591).
- Last updated
- October 29, 2026
Stock price reaction to the disclosureオリックスホールディングス・親会社(上場持株会社) / 東証プライム 8591
Stock information is reference data based on Yahoo Finance and may be delayed. This site does not solicit or advise investment and does not guarantee the accuracy or completeness of this information. We accept no liability for any investment decision based on it.
Where to go for this information
The steps themselves are on the protection guide. These links match the kinds of data in this incident, plus support contacts.
Ask AI about this incident
Opens an AI chat with this page's URL already in the prompt. Treat the answer as a starting point — always verify with the official sources listed above.
Is this incident worth paying attention to?
Written & reviewed
Reviewed byYutaro SasaoFounder & CEO, MediaLeap Inc.
CEO of MediaLeap Inc. Working on both sides of web advertising and web media since 2013; founded the company in May 2025.
Review scope: cross-checking against primary sources (official and government announcements), verifying claims stay within the facts, and checking source attribution。Last reviewed:
Written by:Leak Watch editorial team (AI-assisted drafts verified against sources by the editorial team) · Reviewer profile · Request a correction
Related incidents
Browse the database →Incidents sharing the same company, service, attack method or industry (grouped automatically from the disclosures).
Incidents related to "クレジットカード"
Incidents where the damage spread through the same service or system.
- Aアドベンチャー（スカイチケット）2026.10.29 announced・Affected 32,341 records
- SENEOSパワー（ENEOSでんき・でんきサービスのお客さまページ）2026.10.28 announced・Affected 57 people
- S日本航空・日本トランスオーシャン航空（JTA、委託先: アマデウス）2026.10.28 announced・Affected 92,000 records
- Bベネフィット・ワン（会員優待サービス「トクかい」、共同提供: クレディセゾン、業務委託先: フォレステック）2026.10.28 announced・Affected 29,465 people
- SS楽天トラベル2026.10.26 announced・Affected 2,600,000 people
- SS株式会社フューチャーショップ（futureshop）2026.10.23 announced・Affected 3,147,469 records
Incidents related to "プログラム"
Incidents where the damage spread through the same service or system.
- SGMOインターネット（お名前.com デスクトップクラウド）2026.10.21 announced・Affected 26,739 records
- Aデジタルアーツ（クラウドサービス運用環境）2026.10.21 announced・Affected Unknown
- Sリンクステーション（GETTIIS会員情報）2026.10.19 announced・Affected Unknown
- Bユミルリンク（メール配信システムCuenote FC・Cuenote BASE）2026.10.19 announced・Affected 51,628,280 records
- SSEストアー(ショップサーブ)2026.10.16 announced・Affected 23,356,000 people
- Cディップ（アルバイト情報サイト「バイトル」「バイトルNEXT」）2026.10.09 announced・Affected 3,885,771 records
Same attack method
- A日本経済新聞社(日経)2026.10.16 announced・Affected 1,830,000 records
- Sチャーム本店2026.09.01 announced・Affected 370,000 records
- ACAMPFIRE2026.06.02 announced・Affected 225,846 accounts
- Aウエーブ（Webアップロード）2026.04.01 announced・Affected 176,810 records
- Aシチズン時計（問い合わせ管理）2026.10.06 announced・Affected 100,000 people
- Bイノベーション（GitHub）2026.08.07 announced・Affected 62,689 people
Same industry
- Sアフラック生命保険2026.06.30 announced・Affected 4,400,000 people
- SCSアカウンティング株式会社2026.05.15 announced・Affected Unknown
- Sマネーフォワード（GitHub）2026.05.01 announced・Affected 370 records
- Aソニー生命保険2026.10.28 announced・Affected 385,000 records
- AFivot（IDARE）2026.10.13 announced・Affected 129,659 people
- Aビューカード（VIEW’s NET）2026.10.09 announced・Affected 4,030,000 records
Attack method classification: Abuse of credentials(Logging in legitimately with leaked or guessed passwords)
Read the Abuse of credentials guide and national trends →