NEWS

Security News

Every article is summarized from official announcements and trusted reporting. AI-assisted drafts are checked against sources by the editorial team and reviewed by our editor-in-chief before publication. Refer to the original sources for definitive details.

36 of 36 articles

NEWPrevention & measuresOctober 22, 2026PHP Foundation
Two critical PHP RCEs allow unauthenticated remote code execution — immediate updates urged for widely used PHP
The PHP development team released an emergency security update on 2026-10-21 fixing two remote code execution (RCE) vulnerabilities in PHP core (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). Patches are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. With roughly 70% of websites using PHP according to W3Techs, the impact is potentially broad; CVE numbers and PoC code were leaked before the release, and the US CISA has issued an alert demanding immediate patching.
NEWBreach & unauthorized accessOctober 22, 2026LegalAgent AI Legal Lab
List of Domestic Data Breaches and Unauthorized Access Incidents (as of October 22, 2026)
LegalAgent AI Legal Lab publishes incidents of data breaches, unauthorized access, and service outages disclosed by domestic companies and organizations based on official announcements. As of October 22, 2026, 159 incidents are listed, with 72 confirmed breaches. Excluding image metadata in the aggregation, confirmed breaches total about 146,726,509 records and potential exposures about 89,826,540. Since mid-October, numerous large incidents and follow-up disclosures from companies such as Recruit, トラストバンク, GMO Internet, NEC, and ユミルリンク have been reported.
NEWCompany response & follow-upsOctober 21, 2026AI Heartland
Deadlines and First-Notice Format for Data Breaches: Quick Report in 3–5 Days, Final Report in 30 Days (60 for Malicious Intent)
Under the Personal Information Protection Commission (PPC) rules, the clock for breach reporting starts on the day an organization becomes aware, with a quick report required promptly (guideline: 3–5 days) and a final report due within 30 days — or 60 days if there is a risk of malicious intent. Reportable situations fall into four categories: sensitive personal information, risk of financial harm, risk of malicious intent, and incidents affecting more than 1,000 individuals; each category includes situations where there is only a risk, so investigation should begin without waiting for certainty. In practice, the first notice should assume numbers may increase and use a four-part template covering known facts, unconfirmed items, actions users should take, and the timing of the next update. Organizations should prepare contact trees, decision checklists/ledgers, and PPC report templates in advance. The article also notes the PPC advisory (2026-10-07) and the promulgation of the amended Personal Information Protection Law (2026-07-17), clarifying that the piece is not legal advice and urging confirmation with legal teams or PPC materials/contact for case-specific decisions.
NEWCompany response & follow-upsOctober 21, 2026Skill Business Lab
When Should Companies Disclose? Actual Practices and Guidance for Announcing Cyber Incidents
Based on MBSD's analysis of roughly 500 domestic disclosure cases (about 800 disclosure documents including follow-ups), about half of first reports were issued within 5 days of occurrence or discovery, and about 80% within 30 days; the median was 5.6 days and the mean 27.1 days. The article separates the purposes of public disclosure, customer notifications, administrative reporting, and sharing with specialized agencies, and it outlines items to include in initial reports and how the number and content of disclosures typically differ. It argues that disclosure should not be judged by speed alone but by what recipients can reasonably determine from the information provided.
NEWCompany response & follow-upsOctober 21, 2026Cacco（かっこ株式会社）
What to Do When a Data Breach from Unauthorized Access Occurs: Immediate Steps and Preventing Recurrence
Since around September 2026, incidents of unauthorized access targeting companies and resulting personal data leaks have been occurring in succession. The article outlines five initial steps upon discovery of a breach—system isolation, evidence preservation, establishing facts, consulting relevant authorities, and reporting on the company website—and recommends post-incident measures such as setting up a response office, assessing the full extent of damage, and implementing recurrence-prevention measures. It also highlights specific controls and recommends using fraud-detection services; the vendor’s O-PLUX claims real-time screening and more than 120,000 domestic site deployments.
NEWBreach & unauthorized accessOctober 21, 2026Zenn (kumaik)
Comparison of 71 Domestic Incidents Announced in Sept–Oct 2026
A review comparing 71 incidents announced in late September to October 2026 for which the official announcement texts by the announcers themselves were obtained. Of the 71, 34 were initially reported with unknown causes ("under investigation"), and 37 included stated causes; among those, 14 appeared to stem from contractors or related companies. By classification, 58 incidents involved leakages (including suspected leaks), 7 involved service outages or encryption, and 6 involved misdelivery or similar issues.
NEWPrevention & measuresOctober 21, 2026独立行政法人情報処理推進機構（IPA）
IPA's Unified Information Security Portal and Latest Alerts (October 2026)
The Information-technology Promotion Agency (IPA) information security portal publishes emergency and advisory security information for products such as Microsoft and provides a unified point of contact, including the opening of a special consultation desk for unauthorized access on 2026-10-16. It lists alerts and JVN vulnerability disclosures in mid-October 2026 (for example, multiple entries on 2026-10-19–20) and guides users to the latest vulnerability information and available support services.
NEWPrevention & measuresOctober 21, 2026日本パソコンインストラクター養成協会 (jpita.biz)
Four Ways to Check for Your Own Personal Data Breach and What to Watch For
This article presents four methods ordinary users can use to check whether their personal information has been leaked: notifications or disclosures from companies, the breach-checking site Have I Been Pwned, Google and Apple password-check features, and reviewing statements and login histories. Government reports show 19,417 breach reports in FY2025 (17,139 from private companies), and HIBP contains records for 1,042 sites and about 17.8 billion breached accounts. The article notes that a failure to find a breach does not prove no breach occurred, so it recommends using multiple methods regularly and warns about scams that pose as breach checks.
NEWPrevention & measuresOctober 21, 2026国家サイバー統括室（NCO）公式サイト
National Cybersecurity Office Updates Site with Advisories and Materials
The National Cybersecurity Office (NCO) continues to post warnings about impersonation calls and suspicious emails on its official site, and in October 2026 published a joint endorsement of an international advisory on companies supporting China government-linked attack groups, an alert on responses to unauthorized access incidents, a press release on the enforcement of the Cyber Response Capacity Enhancement Act, and other notices. The site also provides a notice about a URL change and publishes cybersecurity materials such as the Cybersecurity Handbook (Ver.3.0).
NEWPrevention & measuresOctober 21, 2026警察庁
National Police Agency Issues Advisory Following Unauthorized Access-Related Leaks
The National Police Agency, in response to incidents involving unauthorized access and information leaks, has compiled and published links to advisories and guidance from relevant ministries and agencies. The links include response policies and alerts from bodies such as the Personal Information Protection Commission, the Ministry of Internal Affairs and Communications, the Ministry of Economy, Trade and Industry, and the Financial Services Agency. The advisory calls on users and organizations to be vigilant about data leaks and to review their countermeasures.
NEWCompany response & follow-upsOctober 21, 2026mad MEDIA (mad2007.co.jp)
Checklist for Service Suspension Decisions and Conditions for Restarting When Unauthorized Access Is Suspected
When unauthorized access is suspected, functions that could lead to further damage or whose safety cannot be confirmed should be suspended, and restart timing should be determined by conditions rather than dates. This guideline-style summary recommends stopping services when cause or scope is unclear, as seen in October 2026 when コミックシーモア and ふるさとチョイス halted services before causes and impacts were known and later confirmed millions of records of personal data leakage. Suspension is classified into four levels (full suspension and three graduated functional suspensions), and restarting is recommended in stages from low-impact functions to login, payments, and new registrations as each condition is satisfied.
NEWCompany response & follow-upsOctober 21, 2026ＫＫパートナーズ（お知らせページ）
Personal Information Protection Commission Issues Advisory on Large-Scale Data Breaches
The Personal Information Protection Commission published an advisory titled "Responses Based on Large-Scale Leakage Incidents (Advisory)" dated October 7, 2026, and also released an explanatory video; the press release is available as a PDF (1581KB) with an addendum on October 9, 2026, aimed at guiding company and organizational responses.
NEWBreach & unauthorized accessOctober 21, 2026satimo.org
Yamato Transport Confirms About 5.26 Million Records Taken in Breach of クロネコ代金後払い Service
Yamato Holdings said in its fourth report on October 16, 2026 that an investigation confirmed some user information was illicitly taken after a September 28, 2026 unauthorized access to the クロネコ代金後払いサービス. Approximately 5.26 million user records (about 490,000 of which included email addresses), about 50,000 delivery records, and about 4,100 merchant records were taken; credit card and password information were not included. Yamato says individuals affected will be contacted individually and that no inquiry page has been provided.
Trends & discussionOctober 20, 2026innovaTopia
"What an Apology Email Teaches": 58 Cyber Terms and How Incidents Unfold
Starting from the wording of apology notices such as "possible personal data leakage due to unauthorized access," this article explains, in 58 terms, where incidents originate, entry points, in-company movements, leaked data, and the sequence up to public disclosure. It sequentially covers vulnerabilities (CVE/CVSS/zero-day), entry points like VPNs and credentials, double-extortion ransomware, and the importance of logs and forensics, and notes that in the first half of 2026 VPN devices accounted for about 50% of ransomware entry routes.
Breach & unauthorized accessOctober 20, 2026Studio.Design
Studio Discloses Unauthorized Access, Potential Customer Data Exposure
Design and build service Studio confirmed unauthorized access to its cloud environment between 2026-09-30 and 2026-10-01, and announced that customer information, project data, and API keys may have been exposed. The vulnerability was fixed on 2026-10-14, and all users were forcibly logged out at 02:30 on 2026-10-14. The company is now reviewing the number of impacted records and conducting a root cause investigation with external specialists.
Breach & unauthorized accessOctober 19, 2026日本経済新聞（Nikkei）
Repeated Unauthorized Accesses: List of Companies Disclosing Personal Data Leaks (Updated As Needed)
Nikkei has compiled a date-ordered list of companies and organizations that have disclosed possible personal data leaks due to unauthorized access or system failures identified since September 2026. The list includes many cases such as Yamato Transport, SOURCENEXT, Lawson, タイムズカー, and a BASE subsidiary, with estimated leak volumes ranging from several hundred to tens of millions of records. The article summarizes information at the time of disclosure and is updated as new details emerge.
Breach & unauthorized accessOctober 19, 2026トレノケート（Trainocate）ブログ
Repeated Unauthorized Access and Data Leaks: Companies Must Check These Fundamental Holes First
Since September 2026, a series of personal data breaches caused by unauthorized access have occurred domestically, prompting the government and related agencies to issue alerts and inspection requests between October 7 and 15. Attacks have primarily exploited known vulnerabilities, misconfigurations and authentication flaws, and techniques leveraging API analysis (such as the A2B attacks highlighted by NICT). The National Police Agency's sensors recorded 13,687 suspicious access attempts per day per IP for vulnerability scanning and similar activity in the first half of 2026, a 50.7% year-on-year increase. Agencies are urging companies to first reaffirm basic protections and to establish abnormality detection and rapid response capabilities.
Prevention & measuresOctober 18, 2026しってとくラボ（はてなブログ）
How to Check and Respond When You Suspect a Personal Data Leak: 7 Immediate Actions
If you suspect a personal data leak due to a company notification, input on a fake site, or suspicious login alerts, first clarify “what,” “where,” and whether any actual harm has occurred. Based on official information as of 2026-10-18, the article outlines seven initial actions: verifying the notice, identifying the leaked data, changing passwords and enabling multi-factor authentication, checking financial accounts, inspecting accounts and devices for anomalies, preserving evidence and seeking appropriate consultation, and remaining alert for further misuse or secondary damage. It warns that leaks involving financial or authentication data or account takeovers require prompt contact with financial institutions or service operators.
Breach & unauthorized accessOctober 16, 2026Eストアー公式お知らせ(最終報)
E‑Store Issues Final Report on ShopServe Breach — About 23.36 Million Affected, ~2.1 Million Include Partial Card Data
On October 16, Eストアー published a final report on the information leak in the e‑commerce building service "ショップサーブ." The affected individuals total about 23,360,000 (across 7,858 stores), of whom about 2,100,000 had cardholder name, partial card number, and expiration date exposed. The unauthorized access occurred from May 21 to August 1, 2026, and data was exfiltrated from the database after an application vulnerability was exploited.
Company response & follow-upsOctober 16, 2026株式会社カタリス
What Management Must Decide First in an Information-Leak Emergency
Kataris整理 provides guidance on when and how companies should decide on disclosure, support, compensation, and resumption of operations when an information leak occurs. Although the Personal Information Protection Law requires reporting to the commission and notifying affected individuals, it does not prescribe the scope or timing of compensation and user support, leaving those judgments to companies. Comparing several past large domestic incidents, the article proposes setting deadlines for explanation updates, timing for reconsidering unresolved decisions, and reporting destinations during peacetime.
Prevention & measuresOctober 16, 2026Impress Watch（INTERNET Watch）
What Individuals Can Do Now as Data Breaches Mount
This article, published on 2026-10-16, explains the steps individuals should take amid a wave of corporate data breaches. It recommends using long, hard-to-guess unique passwords per service, leveraging password managers, enabling two-factor authentication or passkeys, deleting unused accounts, and checking credit card notifications and 3D Secure settings. It also outlines initial checks to perform after receiving a breach notice and warns about phishing attempts tied to such notices.
Breach & unauthorized accessOctober 16, 2026NHK
Over 1億6500万人分 of Personal Data Potentially Exposed in 2026, Security Firm Says
According to an aggregation by security company Macnica, the number of personal information records that may have been leaked due to unauthorized access in 2026 totals over 1億6500万人分. Macnica's tally highlights ongoing concerns about repeated unauthorized access incidents and information leaks. Related articles provide explanations of background and user measures.
Company response & follow-upsOctober 16, 2026タイムズカー公式発表(第4報)
タイムズカー Revises Rule on Retaining ID Document Images — Will Delete Immediately After Registration Verification
タイムズカー announced on October 16 that, as a fourth update on the personal data leak caused by unauthorized access, it will change its rules for retaining images of identity verification documents such as driver’s licenses. Images will no longer be retained after membership registration has been confirmed and will be deleted immediately; images already held will be deleted by the end of October 2026. The company had previously retained images for seven years after account cancellation.
Company response & follow-upsOctober 15, 2026弁護士山中総合法律事務所（ブログ）
Legal Preparedness for Data Breaches to Protect Corporate Trust
This article organizes the legal and operational framework companies should prepare in peacetime when they identify a risk of leakage, loss, or damage to personal data and other information. It specifies concrete procedures and deadlines for containment, evidence preservation, reporting, and notifying affected individuals (preliminary reports roughly 3–5 days, final reports generally 30 days / 60 days if there is a risk of malicious use), and stresses the importance of contract and vendor management and tabletop exercises. In a disclosed case involving Sourcenext, the number of affected records was stated as 22,519,960.
Trends & discussionOctober 15, 2026HIPAA Journal
Large-Scale U.S. Healthcare Data Breaches Surge in Victim Count — 2026 Statistics
According to a roundup published by HIPAA Journal, U.S. healthcare data breaches have been increasing since 2009, and in 2026 the number of large breaches (affecting 500 or more) reached 772. The report highlights a run of "mega breaches" (over 1 million victims) from 2023 to 2025, including Change Healthcare in 2024 which reportedly affected about 192.7 million people. The article also notes delays in OCR reporting and a backlog of investigations.
Prevention & measuresOctober 14, 2026JPCERT/CC
JPCERT Updates Advisories List, Includes SiteGuard and Multiple Microsoft Vulnerabilities
JPCERT/CC updated its advisories page on 2026-10-14 to publish a list of notifications on multiple vulnerabilities, including an OS command injection in SiteGuard Server Edition (CVE-2026-106931) and Microsoft security updates for October 2026. The list presents vulnerabilities and update histories for various products reported during 2026 in chronological order. The intended audience is personnel responsible for information systems, operations management, and CSIRT activities.
Prevention & measuresOctober 14, 2026Josys（ジョーシス）
The Reality of Supply-Chain Attacks and Six Measures Companies Should Take
Supply-chain attacks compromise companies via partners or software; the 2022 Toyota-related case impacted production equivalent to about 13,000 vehicles, and the SolarWinds incident affected roughly 18,000 organizations. Domestic damage has also expanded, such as the 2024 breach at printing and mailing contractor イセトー that exposed about 1.5 million personal records, and the article proposes countermeasures across three layers—internal, vendor management, and software management—plus six concrete steps IT departments can start implementing immediately.
Breach & unauthorized accessOctober 14, 2026Legalscape
Legal Duties of Companies Amid Repeated Data Leaks via Vendors
In recent years, successive personal data breaches via vendors and smartphone apps—sometimes affecting millions—have occurred. The Personal Information Protection Act requires business operators to implement safety management measures across organizational, human, physical, and technical domains, and imposes supervisory duties on principals to select, contract with, and monitor their vendors. When a breach meets any of four criteria (sensitive information, risk of financial harm, malicious intent, or affecting more than 1,000 individuals), reporting to the Personal Information Protection Commission and, in principle, notifying affected individuals are required;速報 should be provided roughly within 3–5 days and a final report generally within 30 days (60 days if malicious intent is involved).
Breach & unauthorized accessOctober 13, 2026ブックオフ公式お詫びとお知らせ
BookOff Confirms External Transmission of Member Data — 6,383,279 People Affected, Including Former Members
Following its initial notice on October 9, ブックオフコーポレーション announced in a second report on October 13 that it confirmed external transmission from its membership management system. The affected data covers 6,383,279 people (6,427,735 membership records), including about 210,000 former members, and includes names, dates of birth, addresses, phone numbers, email addresses, and password hashes. The incident relates to unauthorized access from October 4–6.
Company response & follow-upsOctober 9, 2026cybersecurity-jp.com（引用: 情報処理推進機構）
IPA Urges Companies to Conduct Immediate Inspections and Countermeasures After Series of Unauthorized Accesses
The Information-technology Promotion Agency (IPA) on 2026-10-09 requested that companies and organizations promptly carry out inspections and countermeasures following a series of unauthorized access incidents and information leaks affecting financial institutions, telecom operators and others, urging checks such as identifying externally exposed applications and cloud services, reviewing operation/connection logs and suspicious accounts, and applying outstanding patches, while also recommending measures like multi-factor authentication, account privilege reviews, and data encryption even if no anomalies are found.
Breach & unauthorized accessOctober 8, 2026朝日新聞
Ongoing List of Major Companies Publicly Reporting Personal Data Leaks
Asahi Shimbun has been compiling an ongoing list of major companies, organizations, and services that have disclosed risks of personal data leakage since September 2026. The article treats each company's disclosure date as the reference date and reports that incidents and disclosures have been occurring in succession. The latest update is dated October 21, 2026.
Breach & unauthorized accessOctober 7, 2026SecurityWeek（報道による日経の発表）
Nikkei Says More Than 1.83 Million Records Exposed via Cloud Service
Japanese media giant Nikkei announced that 1,830,000 records were stolen in an unauthorized access to a cloud service used for system development. Of those, about 1,680,000 records did not contain personally identifiable information, 150,000 contained names, addresses, email addresses, phone numbers and dates of birth, and 120,000 contained only email addresses. No credit card information was reported to have been leaked.
Company response & follow-upsOctober 6, 2026SAKURA法律事務所
Latest Corporate Cyber Incident Response: Reporting, Forensics, and Executive Decisions (2026 Edition)
SAKURA法律事務所 published “Corporate Crisis Response to Cyber Attacks and Data Breaches [2026 Edition]” by lead attorney Kenshiro Michishita. The update emphasizes simultaneous execution of containment, evidence preservation, and decision-making during initial response, notes the Personal Information Protection Commission’s guideline of an initial alert in roughly 3–5 days and final reports generally within 30 days (60 days if suspicion of malicious intent), and identifies breaches affecting over 1,000 people as reportable. IPA ranks ransomware as the top organizational threat for 2026, attacks on vendors as second, and AI-related risks third.
Breach & unauthorized accessJuly 6, 2026KDDI ニュースリリース
KDDI ISP Mail Platform Breach Final Report — About 12.23M Email Addresses, ~7.62M Plaintext Passwords
On July 6, KDDI published its final report on an unauthorized access incident targeting an ISP-focused mail platform. The compromise affected approximately 12.23 million email addresses and about 7.62 million passwords; some passwords were stored in plaintext (unencrypted), which KDDI says exacerbated the impact. Users of multiple providers, including @nifty, BIGLOBE, and J:COM, were affected.
Prevention & measuresApril 21, 2026神奈川県（公式サイト）
Kanagawa Prefecture Publishes FY2026 Medical Notices, Including Cybersecurity Measures and Guideline Revisions
Kanagawa Prefecture has published a list of medical-related notices for FY2026, linking to various notifications and materials issued since April 2026. The list includes items such as reports No.85 and No.86 from the Medical Accident Information Collection Project, annexed public documents, and safety-related papers including Proposal No.22 for preventing recurrence of medical accidents. It also highlights revisions and materials on cybersecurity for healthcare, the development of the Medical Information System Safety Management Guideline Ver.7.0, and announcements about medical information security training; materials are provided as PDFs on the prefecture's site.
Trends & discussionJanuary 29, 2026情報処理推進機構（IPA）
IPA Announces 'Top 10 Information Security Threats 2026'
The Information-technology Promotion Agency (IPA) released the "Top 10 Information Security Threats 2026" based on incidents and attacks that occurred in 2025 and votes by an expert selection committee; for organizations, "ransom attacks" ranked first, "attacks targeting supply chains and subcontractors" second, and "cyber risks related to the use of AI"—new to the list—ranked third, while the individual list is presented in Japanese syllabary order and continues to include threats such as "unauthorized logins to online services" and "unauthorized use of credit card information."