LEAK WATCH
Breach Watch
Tracking 475 publicly disclosed data breach and unauthorized access incidents in Japan (131 with confirmed leaks), each with a severity rating. The absence of a badge does not mean no leak occurred — always check each company's official announcement for the latest, accurate information. See how severity is assessed for how severity is assessed.
475 of 475 incidents
| Announced | Occurred | Severity | Company / service | Main impact | Data types | Status | Bookmark☆ |
|---|---|---|---|---|---|---|---|
| 2026.10.21 | 2026.10.17 | SS | リクルート（カーセンサーnet、C-MATCH） 3,709,551 records | Due to unauthorized external access, up to 3,709,551 personal and business records from 『カーセンサーnet』 and 『C-MATCH』 inquiries and dealer registrations may have been leaked. This includes inquiry user information (3,210,421 records) and dealer registration information (483,168 records), containing names, addresses, phone numbers, email addresses, login IDs, and antique dealer license numbers, etc.; login passwords and credit card information are said to be excluded, but some sole proprietors' direct-debit account information may be included. Investigation into the cause and scope is ongoing. | Full nameHome addressPhone numberEmail addressUser / member IDIdentity verification data | Possible leak | |
| 2026.10.21 | 2026.09.09 | S | PingCAPUnlisted 50,000 people | Unauthorized use of credentials by a third party led to data being copied from internal systems, resulting in the leakage of up to approximately 50,000 personal records in Japan, including names, email addresses, phone numbers, and transaction-related information. | Email addressFull namePhone numberPasswordAuth token | Leak confirmed | |
| 2026.10.21 | 2026.09.26 | A | 大阪大学Government / public body 77,851 people | Files that NEC had shared on cloud storage were downloaded by a third party, and it was confirmed that personal data of 77,851 people (alumni, current students, and faculty/staff) — including names, university IDs, and university-issued email addresses — were included. | Full nameUser / member IDEmail address | Leak confirmed | |
| 2026.10.20 | 2026.09.21 | S | 日本電気株式会社東証プライム 6701 Unknown | Unauthorized access from a contractor's device using legitimate accounts encrypted files on the servers, rendering various systems unusable. Also, files in a cloud storage used among stakeholders were leaked, and it was confirmed they contained customers' personal information and system-related information. | Leak confirmed | ||
| 2026.10.20 | Unconfirmed | A | 株式会社日建学院（事前確認講習システム） / （公財）マンション管理センターUnlisted 3,597 people | Personal information of 3,597 attendees of the preliminary confirmation training—names, addresses, phone numbers, email addresses, login IDs, etc.—may have been leaked externally. Credit card and bank account information are reported not to be included. | Email addressUser / member IDPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.10.20 | Unconfirmed | B | 栃木県警（アルカディア利用内部システム）Government / public body 3,900 people | According to 下野新聞, following unauthorized access to アルカディア, personal data for all approximately 3,900 staff registered in the 栃木県警 internal system may have been leaked; whether a leak occurred and the specific items involved are unknown. | Possible leak | ||
| 2026.10.19 | Unconfirmed | S | クリプトン（SONICWIRE・D2R）Unlisted 420,000 records | Confirmed possible unauthorized access to SONICWIRE and D2R, and both services were suspended. SONICWIRE members up to 約42万件 were affected, and hashed passwords and other data may have been viewed or obtained. | Email addressUser / member IDPasswordHome addressFull name | Possible leak | |
| 2026.10.19 | Unconfirmed | S | トラストバンク（ふるさとチョイス）Unlisted↗ チェンジホールディングス 3962 Unknown | ふるさとチョイス detected suspected unauthorized access and has temporarily suspended user-facing services to secure safety and prevent further spread of damage. Whether personal information was leaked is not yet clear. | Possible leak | ||
| 2026.10.19 | Unconfirmed | S | 阪急阪神百貨店（H2O ID等）Unlisted↗ エイチ・ツー・オー リテイリング 8242 1,260,000 records | A portion of personal data for approximately 1.26 million H2O ID records was confirmed leaked. Leaked items include names, addresses, phone numbers, email addresses, etc., and the impact on E-STORES and Remo Order is under investigation. | Email addressUser / member IDCard & payment dataPhone numberHome addressFull nameDate of birth | Partial leak confirmed | |
| 2026.10.19 | Unconfirmed | S | 日本郵政（ゆうID・ゆうゆうポイント）東証プライム 6178・日本郵政 249 accounts | 日本郵政 confirmed unauthorized logins using IDs and passwords leaked externally and announced that member information for 249 accounts may have been viewed; of those, an address book of 83 entries from 1 account may have been illicitly obtained. | Email addressPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.10.19 | Unconfirmed | S | パピレス（Renta!）東証スタンダード 3641・パピレス Unknown | パピレス has detected a possible unauthorized access to the Renta! server and has suspended the service; the restart date is undecided. Whether data was leaked has not been specified at the time of the announcement. | Possible leak | ||
| 2026.10.19 | 2026.10.15 | S | ジグザグ（WorldShopping）東証グロース 340A・ジグザグ 301 people | ジグザグ has confirmed that unauthorized access to WorldShopping led to the exposure of information of 301 overseas customers. Card information and passwords are reported not to be included. | Email addressPhone numberHome addressFull name | Leak confirmed | |
| 2026.10.19 | Unconfirmed | A | and US（Studio問い合わせフォーム）Unlisted 1,024 records | and US announced that, following unauthorized access to Studio, 1,024 inquiry records from its corporate and recruitment site (including corporate contact information) may have been leaked, and has taken the inquiry page offline. | Possible leak | ||
| 2026.10.19 | Unconfirmed | A | 青森市（公民連携ポータルサイト）Government / public body 11 records | 青森市 disclosed that information for 11 proposals submitted to the public–private partnership portal site may have been leaked due to unauthorized access to Studio, and has changed the submission method from the portal to direct submissions to the responsible department until safety can be confirmed. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.10.19 | Unconfirmed | A | 石川県教育委員会（県立学校7校サイト）Government / public body 138 people | Personal data for 138 individuals was accessible on the websites of seven 石川県 schools; the blind school’s 110 records included names, grades, attendance status, and guardian names. The relevant files were deleted. | Full nameDate of birth | Possible leak | |
| 2026.10.19 | 2026.10.14 | A | JETRO（Webサイト）Government / public body 743 records | Unauthorized access to part of JETRO's website resulted in the confirmed leakage of 743 personal information records, including company names and contact persons' email addresses; notifications to the affected companies have been completed. | Email address | Leak confirmed | |
| 2026.10.19 | Unconfirmed | A | LIXIL（L-ポケット）東証プライム 5938・LIXIL 3,379 people | A leak of personal information of 3,379 registered members was confirmed in LIXIL's business support app "L-ポケット". Because it includes 375 employees and former employees, there is a risk that those members' names and other data were exposed externally. | Email addressUser / member IDPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.10.19 | Unconfirmed | A | 長崎市（長崎満喫!アウェイ遠征応援キャンペーン）Government / public body 19 people | According to news reports, 長崎市's campaign site may have leaked 22 inquiries and personal data for 19 people (names, email addresses, and inquiry contents); the city removed the inquiry form and has notified the affected individuals. | Email addressFull name | Possible leak | |
| 2026.10.19 | 2026.10.19 | A | ニフティ（回線申込・受付管理システム） 542,513 records | It was disclosed that up to 542,513 personal information records may have been leaked due to unauthorized access to the line application/acceptance management system, potentially affecting users who applied for optical lines outside the company's website since 2019. The data is said to include names, addresses, member IDs, phone numbers, and email addresses, and it is stated that the system does not hold bank account or credit card information; the actual scope of the leak is under investigation. | Email addressUser / member IDPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.10.19 | Unconfirmed | A | 志摩市民病院（問い合わせフォーム）Government / public body 8 records | 志摩市民病院 has disclosed that, following unauthorized access to Studio, names, email addresses, and inquiry contents from 8 inquiry-form submissions may have been leaked, and they say there is no impact on clinical services or electronic medical records. | Email addressFull name | Possible leak | |
| 2026.10.19 | 2026.10.17 | A | ソフトバンク（My SoftBank等）東証プライム 9434・ソフトバンク Unknown | Following attempted unauthorized access to some web member sites such as My SoftBank, we suspended the web versions of My SoftBank, My Y!mobile, and My Menu. The app versions remain available. | Possible leak | ||
| 2026.10.19 | Unconfirmed | B | 秋田県（あきたデジタルアカデミー）Government / public body 164 people | 秋田魁新報 reports that information for 164 applicants to あきたデジタルアカデミー may have been leaked following unauthorized access to the Studio they used. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.10.19 | Unconfirmed | B | 広島県府中市（道の駅びんご府中サイト）Government / public body 123 records | 府中市 has announced that due to unauthorized access to Studio used at 道の駅びんご府中, there is a possibility of information leakage affecting 123 uses of the inquiry form; whether leakage occurred and its scope are under investigation, and no leak has been confirmed at this time. | Email addressPasswordFull name | Possible leak | |
| 2026.10.19 | Unconfirmed | B | 福岡コンベンションセンター（問い合わせ・予約フォーム）Government / public body 1,185 records | 福岡コンベンションセンター announced that due to unauthorized access to Studio, input data for 288 facility use inquiries, 1,185 lost-and-found inquiries, and 766 disabled parking space reservations may have been exposed. No actual leakage has been confirmed. | Email addressPhone numberFull name | Possible leak | |
| 2026.10.19 | Unconfirmed | B | 岐阜県（GIFU新事業共創チャレンジ）Government / public body 2 records | Gifu Prefecture announced that unauthorized access to Studio may have resulted in the leakage of 2 inquiry records related to event attendance. Separately managed participation application information is not affected. | Email addressFull name | Possible leak | |
| 2026.10.19 | 2026.10.07 | B | 株式会社八十二長野銀行東証プライム 8359・八十二長野銀行 672 records | A staff email account was unlawfully accessed, and some email contents may have been viewed by third parties; information for 34 individuals, 627 corporations, and 11 other organizations, totaling 672 records, may be affected. No leakage of account numbers or PINs has been confirmed. | Email addressPhone numberFull name | Possible leak | |
| 2026.10.19 | 2026.10.18 | B | リンクステーション（GETTIIS会員情報）Unlisted Unknown | リンクステーション has confirmed that GETTIIS member information was leaked following unauthorized access to Gettii-Lite, and announced it includes contact details, hashed passwords, and parts of encrypted card information. The scope of the leak is under investigation. | Email addressUser / member IDPasswordCard & payment dataPhone numberHome addressFull nameDate of birth | Partial leak confirmed | |
| 2026.10.19 | Unconfirmed | B | メディアリンク（Studio問い合わせフォーム）Unlisted 901 records | It was announced that, following unauthorized access to メディアリンク's Studio, a total of 901 inquiry records submitted via the contact forms of four services may have been leaked. The count includes duplicate submissions. | Email addressPhone numberFull name | Possible leak | |
| 2026.10.19 | Unconfirmed | B | 見附市（ハピネスみつけ）Government / public body 13 records | 見附市 has announced that inquiries on its migration/settlement site may have resulted in the leak of information for 13 individuals and 57 companies due to unauthorized access to Studio. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.10.19 | Unconfirmed | B | 長岡市（移住体験ツアー特設サイト）Government / public body 5 records | 長岡市 has announced that five form entries submitted on the special site for the relocation trial tour may have been exposed due to unauthorized access to Studio; no data leak has been confirmed. | Email addressHome addressFull name | Possible leak | |
| 2026.10.19 | Unconfirmed | B | 新潟市（業務効率専門家派遣・在宅テレワーカー育成事業）Government / public body 8 records | 新潟市 announced that due to unauthorized access to the Studio they use, there is a possibility of personal information leakage affecting 8 inquiries for the Business Efficiency Specialist Dispatch Project and 59 inquiries for teleworker training and related programs. | Email addressPhone numberFull name | Possible leak | |
| 2026.10.19 | 2016.03.01 | B | スカイマーク（採用問い合わせフォーム）東証グロース 9204・スカイマーク 488 people | From March 2016 to October 16, 2026, information for 488 recruitment inquiries was externally accessible due to misconfigured access restrictions. No actual viewing, leakage, or secondary damage has been confirmed. | Email addressFull name | Possible leak | |
| 2026.10.19 | 2026.10.13 | B | 東邦HD（エンタッチ） Unknown | There was unauthorized access to the database of an MR support service that uses the web conferencing system provided by エンタッチ, a non-consolidated subsidiary of 東邦ホールディングス; names, affiliated medical institutions, prefectures of healthcare professionals, and possibly MR names and email addresses were disclosed. They report no confirmed disruption to business continuity or data alteration/deletion, and say files or recorded audio/video used by MRs are excluded; the number of affected records is under investigation. | Email addressPhone numberFull nameHome address | Partial leak confirmed | |
| 2026.10.19 | Unconfirmed | B | 徳島県（脇町高校NewsPicks）Government / public body 14 people | 徳島県 disclosed that due to unauthorized access to NewsPicks, school email addresses of current members of 脇町高校 (14 students and 1 teacher) and 48 alumni may have been leaked. At the time of disclosure, the alumni addresses were invalid. | Email addressFull name | Possible leak | |
| 2026.10.19 | Unconfirmed | B | X Mile（問い合わせフォーム）Unlisted Unknown | X Mile has disclosed that names, company names, contact details, and other information submitted via forms on its website may have been exposed due to unauthorized access to Studio. Whether data was actually leaked and the number of affected records are under investigation. | Email addressPhone numberFull name | Possible leak | |
| 2026.10.19 | Unconfirmed | B | ユミルリンク（メール配信システム）東証グロース 4372・ユミルリンク 9,000,000 records | ユミルリンク has confirmed unauthorized access to 5 email-delivery-related systems and data extraction; the extracted information is estimated to total 約900万件, including email addresses. Details are under investigation. | Email addressAuth token | Partial leak confirmed | |
| 2026.10.18 | Unconfirmed | A | 足利市（斎場予約システム）Government / public body 8,800 records | It was announced that unauthorized access to the 足利市 funeral hall reservation system may have exposed information of about 8,800 users and 56 registered funeral service providers, and reservations have been switched to telephone. | Email addressPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.10.18 | 2026.10.17 | B | 日本サッカー協会（JFA Passport）Non-profit corporation Unknown | Unauthorized access to the JFA official app "JFA Passport" has caused some services to be suspended. Impact on user information is under investigation, and the number of affected records has not been disclosed. | Possible leak | ||
| 2026.10.18 | 2026.10.13 | B | 埼玉県警（アルカディア安否確認システム） 13,000 people | 埼玉県警's disaster-status confirmation system had the names and personal email addresses of about 13,000 police officers and staff registered, and they were notified that these may have been leaked externally due to unauthorized access to a contractor’s cloud-based service. No personal information of non-police individuals is said to be registered, and no misuse has been confirmed. | Email addressFull name | Possible leak | |
| 2026.10.17 | Unconfirmed | A | Joshin（社内ネットワーク）東証プライム 8173・Joshin Unknown | Joshin has suspended some services due to unauthorized access to its internal network. Whether personal information was leaked is currently under investigation. | Possible leak | ||
| 2026.10.17 | Unconfirmed | A | セカンドリテイリング（ゲオ・セカンドストリート）Unlisted Unknown | After unauthorized access to internal systems, セカンドリテイリング suspended apps and web services such as ゲオ・セカンドストリート from 10月17日21時. Whether any information was leaked and the number of records, if any, have not been disclosed. | Possible leak | ||
| 2026.10.17 | 2026.09.30 | B | 東北電力フロンティア（イベント問い合わせフォーム）Unlisted↗ 東北電力 9506 182 records | Following unauthorized access to Studio, inquiry information from five event-related sites totaling 182 records may have been leaked externally. Electricity/optical line contract information and actual participant information are excluded, and actual exfiltration has not been confirmed. | Email addressPhone numberFull name | Possible leak | |
| 2026.10.16 | 2026.05.21 | SS | Eストアー(ショップサーブ)Unlisted↗ BASE 4477 23,356,000 people | For the EC site building service “ショップサーブ”, personal data for about 2,336万人分 (対象7,858店) — including names, addresses, and phone numbers of purchasers and shop operators — was leaked; of those, about 210万人分 also included cardholder name, part of the card number, and expiration date (10月16日最終報). | Email addressUser / member IDPasswordAuth tokenCard & payment dataPhone numberHome addressFull name | Leak confirmed | |
| 2026.10.16 | Unconfirmed | S | Astemo（データ共有クラウド）Unlisted 350 people | Through a contractor's account compromise, business contact information for about 350 people (employees, suppliers, partner company affiliates, etc.) was leaked from Astemo's cloud. No customer contacts or consumer personal information are included. | Email addressPhone numberFull name | Leak confirmed | |
| 2026.10.16 | Unconfirmed | S | 市立岸和田市民病院（患者書類）Government / public body 1 people | 市立岸和田市民病院 lost medical-related documents, including the admission questionnaire for 1 patient; they are being searched for, and the actual date/time of loss, cause, and any external disclosure have not been confirmed. | Health & medical data | Possible leak | |
| 2026.10.16 | 2026.09.30 | S | Studio（クラウド環境）Unlisted Unknown | There is a risk that account information, created content, form submissions, API keys, etc. for all registered Studio users were leaked, and because the decryption key was also read, whether data was actually obtained and the number of records are undetermined. | Email addressPasswordAuth token | Possible leak | |
| 2026.10.16 | 2026.10.03 | A | ファンケル・アテニア（EC会員情報）Unlisted↗ キリンホールディングス 2503 834,947 records | Member information of ファンケル and アテニア was leaked: ファンケル 393,785 records / 368,184 individuals, アテニア 441,162 records / 417,312 individuals; affected data include names, contact details, and partially hashed secondary passwords, and do not include main passwords or payment information. | Email addressUser / member IDPasswordPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.10.16 | 2026.10.07 | A | 日本経済新聞社(日経)Unlisted 1,830,000 records | Personal information of 約183万件 stored on a cloud service for system development was leaked; records contained one or more of name, email address, address, phone number, or date of birth. | Email addressUser / member IDAuth tokenPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.10.16 | 2026.10.07 | A | 山形県（技能検定合格証書等の誤送付）Government / public body 7 people | 山形県 mistakenly sent skill test certificates and related documents to another supervising organization, publicly disclosing personal information for 7 technical intern trainees including names, dates of birth, technician numbers, and exam grades; documents for one additional person were recovered and no leak occurred for that individual. | User / member IDFull nameDate of birth | Leak confirmed | |
| 2026.10.16 | Unconfirmed | B | デーリー東北新聞社（受注制作Webページ）Unlisted 423 records | A total of 423 pieces of personal information, including names, phone numbers, and email addresses, may have been leaked from a commissioned-production web page. Credit card information is reported not to be included. | Email addressPhone numberFull name | Possible leak | |
| 2026.10.16 | Unconfirmed | B | フラー（コーポレート・高専キャラバン問い合わせ）東証グロース 387A・フラー 5,948 records | Inquiry data from Studio-created sites may have been leaked: Japanese version 5,948 records, English version 20 records, 高専キャラバン 61 records. These are data record counts and may not correspond to number of individuals, and actual acquisition is unconfirmed. | Email addressFull name | Possible leak | |
| 2026.10.16 | Unconfirmed | B | 広島県府中市（移住応援サイトふふふちゅう）Government / public body 31 records | 府中市 announced that due to unauthorized access to Studio used by the relocation support site "ふふふちゅう", there is a possibility that information from 31 uses of the inquiry form may have been leaked. Whether data was leaked and the extent are under investigation, and no confirmed data exfiltration has been found at this time. | Email addressPasswordPhone numberHome addressFull name | Possible leak | |
| 2026.10.16 | Unconfirmed | B | 広島電鉄（発車オーライネット利用者）東証スタンダード 9033・広島電鉄 Unknown | 広島電鉄 has announced that some reservation information was leaked externally following unauthorized access to 発車オーライネット, and that user information for purchases made at company-run and consigned store counters is also included. The scope of affected data is under investigation. | User / member IDPhone numberFull name | Partial leak confirmed | |
| 2026.10.16 | Unconfirmed | B | 北陸鉄道（発車オーライネット利用者）Unlisted 998 records | 北陸鉄道 has disclosed that, following unauthorized access to 発車オーライネット, reservation information for 998件・660人分 may have been partially leaked; affected data include reservation names in katakana, phone numbers, and reserved bus information. The counts of records and individuals are still being finalized. | User / member IDPhone numberFull name | Possible leak | |
| 2026.10.16 | Unconfirmed | B | 諫早市（道の駅251いいもりじゃがーロード）Government / public body Unknown | Personal information such as names and contact details submitted via the 道の駅 site’s Studio inquiry form may have been leaked. The city is urging caution against suspicious contacts, but the number of cases has not been disclosed. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.10.16 | Unconfirmed | B | 糸魚川市（移住・ワーケーションの問い合わせ）Government / public body 82 records | Inquiry records from a relocation/workation site — 82 inquiries (23 and 59) — may have been leaked. The number is under investigation and unconfirmed, and an actual leak has not been verified. | Email addressPhone numberFull name | Possible leak | |
| 2026.10.16 | Unconfirmed | B | 岩井コスモ証券（委託先トレードワークス）Unlisted↗ 岩井コスモホールディングス 8707 4,611 people | Due to unauthorized access to a subcontractor, personal data including names and email addresses of 4,611 online trading users of 岩井コスモ証券 were leaked. No secondary damage had been confirmed at the time of disclosure. | Email addressFull name | Leak confirmed | |
| 2026.10.16 | Unconfirmed | B | 広交観光（発車オーライネット利用者）Unlisted 92 records | 広交観光 has disclosed that, following unauthorized access to 発車オーライネット, reservation information for 92 bookings (equivalent to 64 individuals) for its services may have been leaked; the affected data items are the reservation name in katakana and telephone numbers. | Phone numberFull name | Possible leak | |
| 2026.10.16 | Unconfirmed | B | LUUP（Webサイトの旧フォーム）Unlisted 21,368 records | Possibly 21,368 submission records from the old web form were leaked. This count includes multiple submissions; LUUP app registration data and the current form are not affected, and actual data retrieval is unconfirmed. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.10.16 | Unconfirmed | B | ラクスル（サービス案内サイトのフォーム）Unlisted 6,412 records | There is a possibility that 6,412 form submission records from the guide site on Studio were leaked. Member, order, and payment information are not affected, and actual acquisition has not been confirmed. | Email addressPhone numberFull name | Possible leak | |
| 2026.10.16 | Unconfirmed | B | 静岡新聞社（掲載・SBS学苑フォーム）Unlisted 3,000 records | Up to 3,000 Studio listing applications, 2 instructor dispatch requests, and 35 instructor entries may have been leaked. No public announcement to the general public was made, and no misuse has been confirmed. | Email addressPhone numberFull name | Possible leak | |
| 2026.10.16 | Unconfirmed | B | 和歌山県（外国人材雇用サポートデスク）Government / public body 417 people | Unauthorized access to Studio may have exposed support-desk form data for 417 businesses and 1,749 users of the form for foreign personnel; these counts are not combined. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.10.15 | 2026.10.02 | SS | バーガーキング・ジャパン(公式アプリ)Unlisted 11,180,000 records | Due to unauthorized access by a third party to the system managing official app member information, about 約1,118万件 of member data (member ID, email address, name, date of birth, telephone number, prefecture, gender and other personally identifiable information) were leaked externally. The company does not hold credit card numbers and no leakage of them has been confirmed, and leakage of login passwords has not been confirmed at this time; detailed intrusion routes and some of the leaked items are under investigation and may be updated. | Email addressUser / member IDFull namePhone numberDate of birthHome address | Leak confirmed | |
| 2026.10.15 | 2026.10.09 | SS | ソースネクスト 22,519,960 records | The company announced that 22,519,960 member records were leaked due to unauthorized access to the system that manages member information. The leaked data is said to include email addresses, passwords, names, addresses, phone numbers, dates of birth, company names, etc.; all passwords have been invalidated and must be reset. Credit card information is excluded because it does not exist in the affected system. | Email addressUser / member IDPasswordPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.10.15 | Unconfirmed | S | ACCESS（台湾子会社のCROS）東証プライム 4813・ACCESS 155,280 records | Unauthorized access to CROS provided by ACCESS's Taiwan subsidiary resulted in the leakage of customer IDs 155,280 and order IDs 231,998, etc. Card information was partially confirmed (1,305 accounts after deduplication, of which 4 accounts include security codes). | Email addressUser / member IDAuth tokenCard & payment dataPhone numberHome addressFull name | Leak confirmed | |
| 2026.10.15 | Unconfirmed | S | メドレー（アットリンク）東証プライム 4480・メドレー 787 records | It was announced that unauthorized access to the medical institution support system "アットリンク" may have led to leakage of patients' personal information. The maximum number of affected medical institutions is 787, and the data items and number of individuals are under investigation. | Health & medical data | Possible leak | |
| 2026.10.15 | Unconfirmed | S | NTTソルマーレ（コミックシーモア）Unlisted↗ NTT 9432 Unknown | A data leak at コミックシーモア has been confirmed; affected data include email addresses, hashed passwords, birthdates, gender, and nicknames, with the number of records under investigation. Card information is not held in the affected system and was not leaked. | Email addressPasswordDate of birth | Leak confirmed | |
| 2026.10.15 | 2026.10.10 | A | ビューティガレージ（ECサイト(2026年10月)）東証プライム 3180・ビューティガレージ 775,725 accounts | A leak of 775,725 customers' records from ビューティガレージ and アイラッシュガレージ was confirmed; affected data include names, phone numbers, email addresses, password hashes, and hashes of password reset questions and answers. | Email addressPasswordPhone numberFull name | Leak confirmed | |
| 2026.10.15 | 2026.09.16 | B | 工房（発車オーライネット）Unlisted 8,341 records | Traces of leakage from 発車オーライネット's integration API server of reservation names in katakana, phone numbers, and reserved bus information have been confirmed; up to 8,341 records may be affected and final confirmation is pending. Card details, addresses, emails, etc. are not stored. | Phone numberFull name | Possible leak | |
| 2026.10.15 | Unconfirmed | B | 伊万里・有田消防本部（NET119緊急通報システム）Government / public body 15 people | According to サガテレビ's report, 伊万里・有田消防本部 disclosed that information of 15 registered users may have been leaked following unauthorized access to アルカディア's NET119 emergency call system. The service is reported to be continuing. | Email addressPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.10.15 | Unconfirmed | B | 和歌山県立21校（ライデン・スクール）Government / public body 10,006 people | Due to unauthorized access to アルカディア, personal data for approximately 約1万6千 registrants of contact emails for 県立21校 — including names, email addresses, current school names, grade levels, etc. — may have been leaked. | Email addressFull name | Possible leak | |
| 2026.10.14 | Unconfirmed | S | 大崎地域広域行政事務組合消防本部（NET119・119RAIDEN）Government / public body 45 people | Unauthorized access to a contractor may have resulted in the leakage of personal data for 45 people from NET119 and 80 people from 119RAIDEN; for NET119 this includes names, addresses, disability status, blood type, etc. | Phone numberHome addressFull nameHealth & medical data | Possible leak | |
| 2026.10.14 | Unconfirmed | A | アエナ（ECアプリ）Unlisted 817,215 people | The company announced that unauthorized viewing occurred on the EC app’s member My Page, and up to 817,215 people’s names, addresses, and card last-4 digits may have been viewed. Full card numbers etc. are excluded. | Email addressCard & payment dataPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.10.14 | Unconfirmed | A | 一宮市（アルカディア提供のメール配信・Net119等）Government / public body Unknown | 一宮市 announced that due to unauthorized access to アルカディア, registration information for multiple services including email distribution, staff safety confirmations, and Net119 may have been exposed, and some new registrations were suspended; specific confirmed leaks follow the main text. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.10.14 | Unconfirmed | A | イズミ（ゆめオンライン・ゆめデリバリー）東証プライム 8273・イズミ 400,000 records | Following an attack on IDCFクラウド used by a contractor, up to 約40万件 of names and email addresses may have been affected. The information was encrypted, and no actual leakage or unauthorized use has been confirmed. | Email addressFull name | Possible leak | |
| 2026.10.14 | Unconfirmed | A | マツダ（CLUB MAZDA COMMUNITY）東証プライム 7261・マツダ 4,103 people | It was disclosed that data for up to 4,103 members and operational staff of CLUB MAZDA COMMUNITY — including email addresses and purchase/usage history — may have been viewed or obtained. The incident is attributed to unauthorized access to the vendor Commune. | Email addressUser / member IDHome address | Possible leak | |
| 2026.10.14 | 2026.10.05 | A | MIXI（コトポータル）東証プライム 2121・MIXI 750 people | Profiles and related data of 750 コトポータル members may have been viewed or obtained, of which 749 included email addresses. There is no evidence that this incident affected コトダマン main accounts or payment information. | Email addressUser / member ID | Possible leak | |
| 2026.10.14 | 2026.10.13 | C | 神奈川県消防保安課（事業者へのメール誤送信）Government / public body 55 records | An email sent by 神奈川県消防保安課 to 55 liquefied petroleum gas sales operators was sent without using BCC, allowing recipients to view each other’s email addresses. No actual third-party misuse is reported. | Email address | Leak confirmed | |
| 2026.10.13 | 2026.10.05 | SS | ライドオンエクスプレス（『銀のさら・釜寅・すし上等』公式サイト・公式アプリ） 6,500,000 records | The server storing registration information for the official website and official app was subject to unauthorized access, possibly resulting in leakage of up to approximately 6.5 million records. Leaked items may include names, addresses, phone numbers, email addresses, dates of birth, password hash values, etc., and part of the service (orders from the official website/app) was suspended while customer notifications and investigation/reporting are underway. | Email addressUser / member IDPasswordPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.10.13 | Unconfirmed | A | 綾瀬市（安全・安心メール）Government / public body 11,053 people | 綾瀬市 has announced that due to unauthorized access to the 安全・安心メール system, the information of 11,053 registered users may have been leaked. | Email addressHome addressFull name | Possible leak | |
| 2026.10.13 | Unconfirmed | A | Fivot（IDARE）Unlisted 129,659 people | The company announced that unauthorized access to IDARE resulted in the leakage of information of 129,659 people, including former members. Account balances and transaction histories were also affected, but passwords and full card numbers are reported not to have been leaked. | Email addressUser / member IDCard & payment dataIdentity verification dataPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.10.13 | Unconfirmed | A | 福井市（防災気象情報メール）Government / public body Unknown | 福井市 announced that registered email addresses may have been leaked due to unauthorized access to the disaster/weather information email system, and suspended distribution from 11:00 on the same day. | Email address | Possible leak | |
| 2026.10.13 | 2026.10.13 | A | ゴルフダイジェスト・オンライン（GDO）Unlisted 1,789 records | At GDO, a leak of 1,789 records containing names and corporate email addresses of employees, former employees, and contractors was confirmed, and separately 55 member records may have been queried externally, of which 4 include personal information. | Email addressPhone numberHome addressFull nameDate of birth | Partial leak confirmed | |
| 2026.10.13 | Unconfirmed | A | 函館市（ANSINメール）Government / public body Unknown | It was announced that delivery of ANSINメール has been emergency suspended since 2026年10月13日11時, and the restoration time is undecided. Whether any information was leaked is not stated. | Email address | Possible leak | |
| 2026.10.13 | Unconfirmed | A | 斑鳩町（防災情報メール・ハザードン）Government / public body Unknown | Due to unauthorized access to アルカディア, 斑鳩町 has suspended distribution of disaster information emails and the disaster app “ハザードン” from 2026年10月13日11時. Whether any information was leaked is unknown. | Email address | Possible leak | |
| 2026.10.13 | Unconfirmed | A | 南房総市（安全安心メール）Government / public body Unknown | Due to unauthorized access to the system operator, 南房総市 has emergency-suspended 安全安心メール from 2026-10-13 11:00. There is no indication of information leakage. | Email address | Possible leak | |
| 2026.10.13 | Unconfirmed | A | 箕面市（防災情報配信サービス）Government / public body Unknown | Due to unauthorized access to アルカディア, 箕面市 has suspended distribution via its citizen safety email and the disaster app 「ハザードン」 from 11:00 on 2026-10-13. Whether any information was leaked is not stated. | Email address | Possible leak | |
| 2026.10.13 | Unconfirmed | A | 見附市（緊急情報メール）Government / public body Unknown | Disabled the manual distribution function for emergency information emails. This was done in response to unauthorized access to operator company アルカディア; whether any data was leaked is under investigation. | Email address | Possible leak | |
| 2026.10.13 | Unconfirmed | A | 入善町（緊急情報メール）Government / public body Unknown | 入善町 has announced it suspended emergency information emails from 2026年10月13日11時 and has also halted distribution of disaster and weather information to its linked homepage and LINE; there is no mention of information leakage. | Email address | Possible leak | |
| 2026.10.13 | Unconfirmed | A | 大分県（県民安全・安心メール）Government / public body Unknown | New registrations, changes, and cancellations for 県が運用する県民安全・安心メール were suspended. No information leakage has been announced, and the suspension was taken in response to suspected unauthorized access. | Email address | Possible leak | |
| 2026.10.13 | Unconfirmed | A | 岡山市（災害時一斉情報配信サービス）Government / public body Unknown | Due to unauthorized access to the operator of the disaster-time mass information distribution service, 岡山市 announced that personal information may have been leaked. Some functions, such as disaster-prevention emails, are suspended. | Email addressUser / member IDPhone numberFull name | Possible leak | |
| 2026.10.13 | Unconfirmed | A | 楽天モバイル（my 楽天モバイルの支払い証明書）Unlisted↗ 楽天グループ 4755 Unknown | It was announced that, due to a special operation, third parties' payment certificates (name, address, phone number, data usage, charges, etc.) could have been viewed. Actual viewing has not been confirmed. The fix was implemented on 2026年6月20日. | Phone numberHome addressFull name | Possible leak | |
| 2026.10.13 | Unconfirmed | A | 下関市（防災メール）Government / public body Unknown | Due to unauthorized access to the contracted system company, 下関市’s disaster-prevention email distribution has been emergency suspended from 2026年10月13日11時. Whether any information was leaked has not been specified. | Email address | Possible leak | |
| 2026.10.13 | Unconfirmed | A | 宍粟市（しーたん通信の情報配信）Government / public body Unknown | Broadcasting on the スピーキャン delivery service used by neighborhood association heads was halted. 宍粟市 has announced a partial suspension of functions and there is said to be a possibility of information leakage. | Possible leak | ||
| 2026.10.13 | Unconfirmed | A | 高岡市（防災情報配信）Government / public body Unknown | 高岡市 has announced that, due to unauthorized access to its information distribution service, part of the disaster information distribution function has been suspended since 11:00 on 2026-10-13. It does not state whether any data leakage occurred. | Possible leak | ||
| 2026.10.13 | Unconfirmed | A | 横須賀市（防災・防犯情報配信）Government / public body Unknown | Due to unauthorized access to an information distribution service, 横須賀市 announced that registered user information may have been leaked and has suspended multiple services such as disaster prevention information emails. | Email addressPhone numberFull name | Possible leak | |
| 2026.10.13 | Unconfirmed | B | アルカディア(SpeeCAN RAIDEN / NET119)Unlisted 3,136,000 records | Municipal disaster email distribution and the emergency reporting app for the hearing- and speech-impaired "NET119" were suspended, and there is a possibility that up to 約313万6千件 email addresses were leaked. Detailed information for about 約1.3万件 NET119 registrants, including names, dates of birth, and addresses, was affected. | Email addressPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.10.13 | Unconfirmed | B | 日本郵便（JP Business Tool Box）Unlisted↗ 日本郵政 6178 4,807 records | Due to a defect in 法人向けJP Business Tool Box for corporate users, sender information on shipping labels was viewable by other users. Up to 4,807 records were affected, and no evidence of download or use has been found. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.10.13 | Unconfirmed | B | JR東海（JR東海MARKET・いいもの探訪）東証プライム 9022・東海旅客鉄道 15,000 records | Regarding approximately 15,000 email distribution records for JR東海MARKET and いいもの探訪, the contractor's investigation reported that "no fact of personal information leakage was confirmed," and this was announced. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.10.13 | Unconfirmed | B | JR九州フードサービス（トイポアプリ）Unlisted 26,900 people | The company announced that unauthorized access to トイポアプリ may have exposed customer information for about 26,900 people (user IDs, phone numbers, etc.). | Email addressUser / member IDPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.10.13 | Unconfirmed | B | 栗山町（防災情報メール）Government / public body Unknown | 栗山町 has announced that contact data may have been leaked due to unauthorized access to the disaster information email system. No specific number of records is given. | Email address | Possible leak | |
| 2026.10.13 | Unconfirmed | B | 美馬市（防災行政発信システム）Government / public body 328 people | It was announced that due to unauthorized access to a contractor, the names, telephone numbers, fax numbers, and email addresses of 328 registrants of the call/FAX/email distribution service may have been leaked. | Email addressPhone numberFull name | Possible leak | |
| 2026.10.13 | Unconfirmed | B | 東郷町（地域安心メール・高齢者捜索メール）Government / public body Unknown | It was announced that registered names and email addresses may have been leaked from 地域安心メール and ひとり歩き高齢者捜索メール. Whether a leak actually occurred is not specified. | Email addressFull name | Possible leak | |
| 2026.10.13 | Unconfirmed | B | 東海市（災害時情報配信システム）Government / public body 1,210 records | It was announced that unauthorized access to the system for emergency mobilization of staff may have led to the leakage of 1210 registered records. Specific details of the leak are under investigation. | Email addressPhone numberFull name | Possible leak | |
| 2026.10.13 | Unconfirmed | C | 島田市（島田市防災メール）Government / public body Unknown | 島田市 announced that unauthorized access was confirmed at the email delivery service's management company, and registered email addresses may have been leaked. | Email address | Possible leak | |
| 2026.10.13 | Unconfirmed | C | スカパーJSAT（スカパー!メンバーズ）東証プライム 9412・スカパーJSAT Unknown | They disclosed that member email addresses used for some スカパー！メンバーズ promotional emails may have been leaked. The number of affected records was not disclosed. | Email address | Possible leak | |
| 2026.10.12 | Unconfirmed | S | あっぷらぼ（メールサービス）Unlisted Unknown | The mail server's administrative password was compromised, and some email addresses and encrypted password data may have been accessed; users have been asked to change their passwords. The number of affected records has not been disclosed. | Email addressPassword | Possible leak | |
| 2026.10.11 | Unconfirmed | C | 渋谷未来デザイン（渋谷未来デザイン COMMUNITY）Non-profit corporation 495 people | It was announced that due to unauthorized use of a Commune administrator account, the email addresses, nicknames, account names, and other information of 495 registered members may have been accessed. | Email addressUser / member ID | Possible leak | |
| 2026.10.10 | 2026.10.02 | SSS | アドベンチャー（スカイチケット）Unlisted 14,640,000 records | At アドベンチャー, operator of the travel site 「スカイチケット」, approximately 約1,464万件 of registered information was leaked due to multiple unauthorized accesses; of these, 約413万件 included members' login passwords (including hashed storage), account information and about 約1.2万件 of bus reservation data were also viewed in part, and credit card information and passport images were not stored and no leakage of them has been confirmed. | Full nameDate of birthEmail addressPhone numberHome addressUser / member IDPasswordIdentity verification data | Leak confirmed | |
| 2026.10.10 | Unconfirmed | A | 山もみじの宿 八芳園（宿泊予約情報）Unlisted Unknown | As a result of intrusion into TEMAIRAZU, names, contact information, stay dates, charges, etc. for reservations meeting the conditions may have been viewed or obtained. | Email addressPhone numberFull name | Possible leak | |
| 2026.10.09 | 2026.10.05 | SS | コミューン（Commune・Commune for Work）Unlisted 307,000 people | Unauthorized access impersonating an administrator resulted in leakage of an estimated 30.7万人 of member information, confirmed data overwrites, and unauthorized password changes for 144 people. Multiple communities were affected. | Email addressUser / member ID | Leak confirmed | |
| 2026.10.09 | 2026.10.04 | S | ブックオフグループ(ブックオフコーポレーション)東証プライム 9278・ブックオフグループホールディングス 6,383,279 people | Due to unauthorized access to the membership management system, personal data for 6,383,279 individuals (6,427,735 membership records), including names, dates of birth, addresses, phone numbers, email addresses, and password hashes, including approximately 210,000 former members, were transmitted externally (confirmed in the second report on October 13). | Email addressUser / member IDPasswordPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.10.09 | Unconfirmed | S | ちとせグループ（ちとせアカデミー）Unlisted 843 people | Unauthorized use of one administrator account was confirmed. Up to 843 people’s names, emails, profiles, etc. may have been leaked, and the acquisition of member passwords has been denied. | Email addressUser / member IDFull name | Possible leak | |
| 2026.10.09 | 2026.08.01 | S | 神奈川県警（使用済み運転免許証）Government / public body 30 records | In August 2026, a police officer improperly took about 30 used driver's licenses and, after drinking, temporarily lost the bag at a station; no leakage to or misuse by third parties has been confirmed. | Identity verification data | Possible leak | |
| 2026.10.09 | Unconfirmed | A | バンダイナムコエクスペリエンス（湾岸ミッドナイト アーケードポータル）Unlisted↗ バンダイナムコホールディングス 7832 Unknown | Due to an intrusion into Commune, there is a risk of leakage of emails, profiles, and other information; the portal remains under emergency maintenance and the reopening date is undecided. | Email addressUser / member ID | Possible leak | |
| 2026.10.09 | Unconfirmed | A | カルビー（絶品部「やめられない、とまらない」課）東証プライム 2229・カルビー Unknown | Unauthorized access to Commune confirmed to have viewed and obtained fan-site members' email addresses, display names, profiles, etc.; service suspended with reopening date undecided. | Email addressUser / member ID | Leak confirmed | |
| 2026.10.09 | Unconfirmed | A | ココナラ（スキルマーケット）東証グロース 4176・ココナラ Unknown | Due to unauthorized access, leakage of 449 resume files and 1,845 files such as CVs/work history for some members was confirmed. These are file counts, not numbers of individuals. | Leak confirmed | ||
| 2026.10.09 | Unconfirmed | A | ダイドードリンコ（dydoいっしょにラボ）Unlisted↗ ダイドーグループホールディングス 2590 Unknown | Following an intrusion into vendor Commune, the fan site was taken offline. The vendor's investigation reported no damage to the site and no leakage of member information. | Possible leak | ||
| 2026.10.09 | 2026.10.07 | A | ファイバーゲート（クラウド利用サービス）東証スタンダード 9450・ファイバーゲート Unknown | Due to an attack on IDCF, some functions such as Wi‑Fi authentication, email, and administrative sites were suspended. There was no impact on Internet connectivity, and data leakage has not been confirmed. | Email addressUser / member ID | Partial leak confirmed | |
| 2026.10.09 | Unconfirmed | A | 日本ICTテレコムユーザー協会（eラーニング）Non-profit corporation Unknown | An attack on IDCF caused failures in sending notification emails to course participants. Learning activities were not affected, and it is being investigated whether names and email addresses provided at registration were leaked. | Email addressFull name | Possible leak | |
| 2026.10.09 | Unconfirmed | A | 日本能率協会マネジメントセンター（時間〈とき〉ラボ）Unlisted 2,950 people | Announced a leak of member information for 2,950 people, including display names, emails, full names, addresses, phone numbers, etc., and suspended the community. They do not hold payment information. | Email addressUser / member IDPhone numberHome addressFull name | Leak confirmed | |
| 2026.10.09 | Unconfirmed | A | ビューカード（VIEW’s NET）Unlisted↗ 東日本旅客鉄道 9020 4,030,000 records | Due to unauthorized access to an external email distribution service, up to approximately 4,030,000 VIEW’s NET members' email addresses may have been viewed or obtained. Names, addresses, phone numbers, and card numbers were not affected. | Email address | Possible leak | |
| 2026.10.09 | Unconfirmed | A | 高知県（高知の知）Government / public body 358 people | Confirmed viewing and retrieval of some member information. Emails, profiles, etc. of all 358 people may have been leaked, and the tourism fan site has been suspended. | Email addressUser / member ID | Partial leak confirmed | |
| 2026.10.09 | Unconfirmed | A | 湖池屋（湖池屋GOGO!ランド）東証スタンダード 2226・湖池屋 1,800 accounts | Announced that up to 1,800 emails, profiles, and other items were leaked. The community was suspended and data restoration was carried out, while some operational logs are expected to be excluded from restoration. | Email addressUser / member ID | Leak confirmed | |
| 2026.10.09 | Unconfirmed | A | LINEヤフー（DS.LAB）東証プライム 4689・LINEヤフー 1,750 people | At DS.LAB, names, emails, profiles, etc. of 1,750 people may have been viewed or obtained, and the affected community has been suspended. | Email addressUser / member IDFull name | Possible leak | |
| 2026.10.09 | Unconfirmed | A | LIXIL（すまいひろば・猫壁ひろば）東証プライム 5938・LIXIL Unknown | Due to unauthorized access to a contractor's system, emails, member names, profiles, etc. of すまいひろば and 猫壁ひろば may have been exposed, and both services have been suspended. | Email addressUser / member ID | Possible leak | |
| 2026.10.09 | Unconfirmed | A | 日本酒類販売（東京酒粋）Unlisted Unknown | The provider's investigation found no confirmation of data leakage to external parties (per 東京酒粋), and the newsletter will be resumed sequentially after safety is confirmed. | Possible leak | ||
| 2026.10.09 | Unconfirmed | A | 大阪市旭区（生活保護法医療券）Government / public body 1 people | In Asahi Ward, Osaka City, a Public Assistance Act medical voucher was mistakenly issued, and the personal information of 1 person may have been disclosed to a third party. | Health & medical data | Leak confirmed | |
| 2026.10.09 | Unconfirmed | A | 大阪市教育委員会（就学援助審査通知）Government / public body 1 people | A student school assistance review notification was sent in error, and the personal information of 1 person was disclosed externally. | Leak confirmed | ||
| 2026.10.09 | Unconfirmed | A | 大阪市財政局（特別徴収税額通知）Government / public body 1 people | A special-collection tax amount notice for personal municipal tax was mis-sent, and one person’s personal information was disclosed externally. | Leak confirmed | ||
| 2026.10.09 | Unconfirmed | A | 大阪市天王寺区（調査報酬明細）Government / public body 1 people | A remuneration statement for 経済センサス活動調査 was mis-sent, resulting in one person's personal information being disclosed externally. | Leak confirmed | ||
| 2026.10.09 | Unconfirmed | A | Sansan（Sansan User Forum）東証プライム 4443・Sansan 8,687 people | Confirmed leakage of emails, profiles, etc. of 1,325 members. In addition, profiles, etc. of another group of 8,687 members are at risk of leakage, and the community has been suspended. | Email addressUser / member ID | Possible leak | |
| 2026.10.09 | 2026.10.07 | A | シックス・アパート（Movable Typeクラウド版）Unlisted Unknown | An IDCF outage affected 31 servers of Movable Typeクラウド版; data were restored from backups and migrated to another cloud. Some functions remain suspended. | User / member ID | Possible leak | |
| 2026.10.09 | Unconfirmed | A | スズキ（スズキヴィレッジ）東証プライム 7269・スズキ 3,000 people | Approximately 3,000 people’s email addresses, nicknames, attributes, and owned car names, etc. were at risk of being viewed or obtained, and the official four-wheeled community has been suspended. | Email addressUser / member ID | Possible leak | |
| 2026.10.09 | Unconfirmed | A | ZENB JAPAN（ZENB GARDEN）Unlisted 949 people | Confirmed data leakage of 897 members; up to 949 persons may be affected, including email addresses, profiles, etc. The community has been suspended and is kept separate from the e-commerce site. | Email addressUser / member ID | Partial leak confirmed | |
| 2026.10.09 | Unconfirmed | B | 越後天然ガス（両毛システムズ利用）Unlisted 1,000 records | It was announced that a ransomware attack on 両毛システムズ may have led to the leak of approximately 1,000 customer records of 越後天然ガス. | User / member IDCard & payment dataHome addressFull name | Possible leak | |
| 2026.10.09 | Unconfirmed | B | エネコム（社内ネットワーク）Unlisted↗ 中国電力 9504 Unknown | Evidence of unauthorized access to the internal network and exfiltration of electronic files was confirmed. They are currently investigating whether customer information may be included and have announced there is no impact on service provision. | Possible leak | ||
| 2026.10.09 | Unconfirmed | B | JR東日本（えきねっと・大人の休日倶楽部）東証プライム 9020・東日本旅客鉄道 Unknown | An external email delivery service reported and it was announced that personal information of えきねっと・大人の休日倶楽部会員 was judged not to have been leaked. However, there was business impact such as partial suspension of member email distribution. | Email address | Possible leak | |
| 2026.10.09 | Unconfirmed | B | 森永乳業（マウントカフェ部）東証プライム 2264・森永乳業 291 people | It was announced that the email addresses, display names, profiles, etc. of 291 people may have been viewed or obtained, and leakage to third parties has not been confirmed. | Email addressUser / member ID | Possible leak | |
| 2026.10.09 | Unconfirmed | B | 大阪市中央区（母子健康手帳の写し）Government / public body 2 people | A copy of the Maternal and Child Health Handbook was mistakenly handed over, resulting in personal information of 2 people being disclosed externally. | Health & medical data | Leak confirmed | |
| 2026.10.09 | Unconfirmed | B | 大阪市保育所（おたより帳）Government / public body 1 people | A daycare's communication notebook was mistakenly handed out, resulting in the personal information of 1 person being disclosed externally. | Leak confirmed | ||
| 2026.10.09 | Unconfirmed | B | 大阪市デジタル統括室（メール）Government / public body 3 people | A notification email related to 大阪スーパーシティ was sent in error, causing 3 email addresses to be displayed among recipients. | Email address | Leak confirmed | |
| 2026.10.09 | Unconfirmed | B | 大阪市東淀川区（入学申請書）Government / public body 3 people | An admissions application was sent in error, and the personal information of 3 individuals was disclosed externally. | Leak confirmed | ||
| 2026.10.09 | Unconfirmed | B | 大阪市生野区（資格喪失届）Government / public body 3 people | A qualification loss notification was sent in error, resulting in the personal information of 3 people being disclosed externally. | Leak confirmed | ||
| 2026.10.09 | Unconfirmed | B | 大阪市北区（住民票）Government / public body 2 people | Due to misassignment of マイナンバー etc., the resident record was written incorrectly and information for two people was mistakenly issued. | Identity verification data | Leak confirmed | |
| 2026.10.09 | Unconfirmed | B | 大阪市住之江区（介護保険証）Government / public body 1 people | A long-term care insurance insured person's certificate was sent in error, and the personal information of 1 person was disclosed externally. | Leak confirmed | ||
| 2026.10.09 | Unconfirmed | B | リゾートトラスト（会員・ホテル予約者）東証プライム 4681・リゾートトラスト 26,000 records | Unauthorized access to the website; confirmed information leakage of group members 約2.6万件 and カハラホテル横浜 reservation holders 約3.6万件. Usage history, medical, payment information, emails, etc. are excluded. | Email addressCard & payment dataHealth & medical data | Leak confirmed | |
| 2026.10.09 | 2026.10.06 | B | ヤマハ（ヤマハネットワークエンジニア会）東証プライム 7951・ヤマハ 1,600 people | About 1,600 people’s email addresses, display names, self-introductions, affiliated groups, etc. were disclosed, according to the announcement. Intrusion into ヤマハ’s own systems has not been confirmed. | Email addressUser / member ID | Leak confirmed | |
| 2026.10.08 | 2026.06.18 | S | アマナ（社内ネットワーク）Unlisted Unknown | Unauthorized VPN logins using employee accounts and communications to internal servers were observed; no personal information leakage has been confirmed, but missing logs mean such leakage cannot be ruled out. | User / member ID | Possible leak | |
| 2026.10.08 | Unconfirmed | S | 第一興商（ビッグエコー等）東証プライム 7458・第一興商 8,631,000 records | They announced that due to infection of a contractor terminal, approximately 約863.1万件 customer records and 従業員約9.3万件 employee records, totaling 計約872.4万件, may have been exposed. Names, dates of birth, and contact information were affected; customer passwords were not included. | Email addressPhone numberFull nameDate of birth | Possible leak | |
| 2026.10.08 | Unconfirmed | S | ハイホー（BiZiMo・光ギガ等）Unlisted 38,509 records | There was an incident in which third parties used information obtained by phone calls, etc., to impersonate users and log into マイページ; the affected total has been disclosed as 38,509 contracts. | Email addressPhone numberHome addressFull name | Partial leak confirmed | |
| 2026.10.08 | 2026.09.12 | S | ローソン（ローソンID・アプリ予約）Unlisted↗ KDDI 9433 2,155,345 accounts | A leak was confirmed of ローソンID personal data including names and emails totaling 215万5,345件, and 26 app reservation records. The reservation feature was suspended and required an app update to use, and it was fully resumed on 10月19日. | Email addressCard & payment dataPhone numberHome addressFull name | Leak confirmed | |
| 2026.10.08 | 2026.10.06 | A | 青森県（青森びいき）Government / public body 2,950 people | Unauthorized access to Commune confirmed to have viewed some member information. Up to 2,950 people may be affected; item-by-item ranges are under investigation so details are unconfirmed, and the service is suspended. | Email addressUser / member IDFull name | Leak confirmed | |
| 2026.10.08 | 2026.10.07 | A | サイバー大学（履修登録・授業料手続き）Non-profit corporation Unknown | An IDCF outage disrupted course registration, tuition payments, and syllabus viewing, but Cloud Campus operated normally. No personal information leakage has been confirmed. | User / member ID | Partial leak confirmed | |
| 2026.10.08 | 2026.10.07 | A | NTTドコモ（あんしんフィルター for docomo）Unlisted Unknown | A failure at the contracted data center made website blocking and parental settings unavailable for all users. Android's standard-strength and time-of-day filters remained available. | Possible leak | ||
| 2026.10.08 | Unconfirmed | A | フューチャーショップ（future Scenario Cast・futureCartRecovery）Unlisted↗ コマースOneホールディングス 4496 Unknown | An attack on IDCF halted email delivery for two services; delivery was resumed in a different environment on October 9. Investigation is ongoing into whether names, recipient emails, etc. were leaked, and the EC main system is reported to be unaffected. | Email addressUser / member IDFull nameDate of birth | Possible leak | |
| 2026.10.08 | 2026.04.07 | A | アズマ（hitmart）Unlisted Unknown | It was announced that a malicious program was introduced from another site on the same server as hitmart, potentially exposing member information and order history; encrypted passwords and card information are said not to be included. | Email addressPasswordPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.10.08 | Unconfirmed | A | ユーザベース（NewsPicks）Unlisted 362,000 records | It was reported that unauthorized access to an administrative tool may have exposed up to メール最大32.3万件 of email addresses and up to カード情報の一部最大36.2万件 of partial card information, among other data; items overlap and the totals are not a count of individuals. | Email addressCard & payment dataPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.10.08 | Unconfirmed | A | ウイングアーク1st（nest Portal）東証プライム 4432・ウイングアーク1st 1,200 people | Unauthorized use of Commune's administrator account may have allowed viewing or exfiltration of company names, job titles, personal names, contact details, etc., for an estimated 1,200 people, and nest Portal has been suspended. | Email addressHome addressFull name | Possible leak | |
| 2026.10.08 | Unconfirmed | B | 株式会社ジュンUnlisted Unknown | A cyberattack occurred in the IDCフロンティア cloud environment used by a contractor, so ジュン announced it would suspend email newsletter distribution. Whether any data was leaked or the scope of impact is unknown. | Email address | Possible leak | |
| 2026.10.08 | 2026.10.07 | B | 大阪歴史博物館（ボランティア連絡）Government / public body 4 people | Email addresses of four volunteers (for one of whom the name was also included) were sent in CC instead of BCC and exposed; deletion has been requested from the recipients. | Email addressFull name | Leak confirmed | |
| 2026.10.08 | 2026.10.06 | B | VALX（VALX FUNコミュニティ）Unlisted 2,950 people | Due to unauthorized access impersonating an administrator of Commune, the email addresses, member names, profiles, etc. of 2,950 members may have been viewed or obtained. Information in the メンバーズストア is not affected. | Email addressUser / member ID | Possible leak | |
| 2026.10.07 | 2026.10.07 | SS | IDCフロンティア（IDCFクラウド）Unlisted↗ IDホールディングス 4709 48 records | Unauthorized queries of registration information for 48 companies were confirmed on the cloud portal; service disruptions affected 495 companies and municipalities, but it was judged that there was no data leak from virtual servers and no traces of external removal were found. | Email addressUser / member IDPassword | Possible leak | |
| 2026.10.07 | Unconfirmed | S | 日水物流(ニッスイグループ)Unlisted↗ ニッスイ 1332 Unknown | Due to unauthorized access to a contractor, shipments were suspended and a partial resumption was announced from October 9. It was confirmed that the affected servers did not contain group-managed personal or customer information. | User / member ID | Possible leak | |
| 2026.10.07 | Unconfirmed | S | セレス（ポイントインカム）東証プライム 3696・セレス 195 records | Unauthorized access to ポイントインカム was announced, with the possibility that personal information of 88 members and 107 employees/etc., a total of 195 records, was viewed. | Possible leak | ||
| 2026.10.07 | Unconfirmed | A | エイチ・アイ・エス(HIS タイ現地法人)Unlisted↗ エイチ・アイ・エス 9603 627 people | Unauthorized access to the Thai local subsidiary's file server may have exposed passport numbers, expiration dates, alphabetic names, etc., of up to 627 customers who traveled to Thailand; passport images were confirmed leaked in some cases. | Identity verification dataFull nameDate of birthHealth & medical data | Partial leak confirmed | |
| 2026.10.07 | Unconfirmed | A | ホテリエ（Grand Inn Canalsideなど8施設）Unlisted 7,919 people | Unauthorized access via an account of the former operator was confirmed, resulting in the exposure of names, contact details, and reservation information for 7,919 individuals across 8 facilities. Addresses, card information, and passport information were not affected. | Email addressPhone numberFull name | Leak confirmed | |
| 2026.10.07 | Unconfirmed | A | ポピンズ（予約・スタッフ手配システム）東証スタンダード 7358・ポピンズ Unknown | After the IDCF outage they rebuilt the system in a different environment and began partial internal use, and announced a phased resumption for users. They state that alternative measures mean there is no major impact on service delivery. | User / member ID | Possible leak | |
| 2026.10.07 | Unconfirmed | A | 埼玉県（渋沢MIX）Government / public body 2,200 people | A list containing names, emails, etc. of approximately 2,200 people was accessed without authorization, and detailed information for 3 of them was also accessed. Alteration of registration data and unauthorized email sending have also been confirmed. | Email addressFull name | Possible leak | |
| 2026.10.07 | 2026.10.02 | A | 損保ジャパン（SMILING ROAD）Unlisted↗ SOMPOホールディングス 8630 60,000 records | Contact details, workplaces, driver IDs, driving alerts, etc. for a total of approximately 60,000 inquiries handled by the contractor may have been exposed. Account, card, and My Number card information are not affected. | Email addressUser / member IDPhone numberHome addressFull name | Possible leak | |
| 2026.10.07 | 2026.10.01 | B | 戸田建設（支払い管理システム等）東証プライム 1860・戸田建設 4,778 people | Up to 7,200 client emails and up to 6,000 transaction records, and personal data of 4,778 employees including names, addresses, contact details, and affiliations have been confirmed leaked. Operational information leakage and impacts on clients are a concern. | Email addressPhone numberHome addressFull name | Leak confirmed | |
| 2026.10.07 | 2026.10.07 | C | CLASS EARTH株式会社Unlisted 69 records | An email misdelivery to co-creation volunteer applicants exposed 69 email addresses to other recipients. No postal addresses or phone numbers were included. | Email address | Leak confirmed | |
| 2026.10.06 | 2026.01.29 | SS | 楽天ドライブUnlisted↗ 楽天グループ 4755 15,382 accounts | Confirmed that stored photos, documents, etc. for 15,382 accounts were obtained and viewed. For a separate category of 313 accounts, encrypted passwords and similar data were also affected. | User / member IDPassword | Leak confirmed | |
| 2026.10.06 | 2026.10.02 | S | アクティブ（通販サイト）Unlisted 54,916 records | Up to 54,916 customer and order records may have been leaked, including store name, address, email, and order information; card data, bank account information, and login passwords were not included. | Email addressPhone numberHome address | Possible leak | |
| 2026.10.06 | 2026.06.26 | S | エバーグリーン・マーケティング（メール）Unlisted 763 records | Unauthorized login to an employee's email account occurred, and account and billing information—including addresses and personal names—of 237 business partners (e.g., agencies) and 763 corporate customers may have been viewed. | Email addressCard & payment dataHome addressFull name | Possible leak | |
| 2026.10.06 | Unconfirmed | S | MrMaxUnlisted↗ MrMaxHD 8203 1,735,154 people | A leak affecting up to approximately 1.74 million people’s names, email addresses, phone numbers, and membership IDs was confirmed. Passwords, addresses, and purchase history are reported not to be affected. | Email addressUser / member IDPhone numberFull name | Possible leak | |
| 2026.10.06 | Unconfirmed | S | 楽天会員データ販売主張Unlisted 1,000,000 records | A third party claims to be selling member data including names and addresses totaling 約1億100万件, but the authenticity, count, and source are unverified and no leak has been confirmed. | Home addressFull name | Possible leak | |
| 2026.10.06 | Unconfirmed | S | 山口大学（教職員メール）Government / public body 1 accounts | Acquisition of contacts was confirmed: 967 contacts are believed to have been exposed, 463 addresses received suspicious emails, and credentials were stolen from one staff member's account. No additional personal data leakage has been confirmed at this time. | Email addressUser / member IDPasswordFull name | Leak confirmed | |
| 2026.10.06 | Unconfirmed | A | 旭化成セラピューティクス（Pharma DIGITAL）Unlisted↗ 旭化成 3407 514,000 people | Names, workplaces, occupations, etc., of healthcare professionals are affected; up to approximately 51.4万人 of work-attribute data and, in a category that includes email addresses, up to approximately 4.4万人 may be affected. Patient medical information is not included. | Email addressHome addressFull name | Possible leak | |
| 2026.10.06 | 2026.10.02 | A | シチズン時計（問い合わせ管理）東証プライム 7762・シチズン時計 100,000 people | Personal data of about 100,000 people — names, addresses, email addresses, and inquiry details — and account or card information entered in message bodies may have been exposed. Whether a leak occurred is currently under investigation. | Email addressCard & payment dataPhone numberHome addressFull name | Possible leak | |
| 2026.10.06 | Unconfirmed | A | 関西国際大学（eポートフォリオ）Non-profit corporation Unknown | It has been confirmed that text information such as students' experiences and reflections was leaked. Those affected appear to be students enrolled up to March 2023, and links to names or student numbers and the number of affected individuals are under investigation. | Full name | Leak confirmed | |
| 2026.10.06 | 2026.09.17 | A | 長崎市（特別徴収税額変更通知の誤送付）Government / public body 1 people | A notice of change in special collection tax amount was mistakenly sent to another business, resulting in one person's address, name, tax amount, etc. being disclosed externally. | Home addressFull name | Leak confirmed | |
| 2026.10.06 | 2026.10.03 | B | GMOリサーチ&AI(アンケートサイト「infoQ」)Unlisted↗ GMOプロダクトプラットフォーム 3695 948,498 records | Up to 948,498 member records (name, email, etc.) from the survey monitor site "infoQ" were leaked, and 611 instances totaling 約286万9,500円分 of points were fraudulently exchanged for Amazon gift codes (points will be fully reimbursed). | Email addressUser / member IDPasswordPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.10.06 | Unconfirmed | B | 霧島市（子ども医療資格者証）Government / public body Unknown | Due to misdelivery of qualification certificates, students' names, addresses, and dates of birth and guardians' names and addresses were exposed; after contacting the recipient who had opened them, they were retrieved the same day. | Home addressFull nameDate of birth | Leak confirmed | |
| 2026.10.06 | 2026.09.18 | B | 長崎市（イベント招待文の誤送付）Government / public body 1 people | An informational letter for a welfare commissioner was mistakenly placed on top of an envelope addressed to another welfare commissioner and enclosed, resulting in one person's name and address being disclosed externally. | Home addressFull name | Leak confirmed | |
| 2026.10.06 | 2026.06.12 | B | 長崎市（施設利用許可証等の誤送付）Government / public body 1 people | A facility use permit and related documents were mistakenly sent to another organization, resulting in the name and contact details of one person (the group's representative/person in charge) being disclosed externally. | Full name | Leak confirmed | |
| 2026.10.06 | 2026.07.02 | B | 長崎市（集団健診予約者名簿の残置）Government / public body 69 people | A contractor left the appointment list at the venue after mass health screenings, leaving names, dates of birth, addresses, etc. of 69 people accessible to third parties. | Home addressFull nameDate of birth | Possible leak | |
| 2026.10.06 | 2026.07.01 | B | 長崎市（資源回収奨励金書類の紛失）Government / public body 1 people | Lost the submitted documents for the resource material collective collection activity incentive grant, leaving one person's name, address, and phone number unaccounted for. | Phone numberHome addressFull name | Possible leak | |
| 2026.10.06 | 2026.06.03 | B | 長崎市（創業支援同意書の誤送信）Government / public body 1 people | When sending a template consent form for startup support, a consent form that mistakenly included the address and name of one third party was sent by email. | Email addressHome addressFull name | Leak confirmed | |
| 2026.10.06 | 2026.05.18 | B | 長崎市（特別徴収税額決定通知の誤送付）Government / public body 1 people | A notice of determined special withholding tax amount (including address, name, etc.) was mistakenly sent to a different business with the same name, resulting in one person's personal information being disclosed externally. | Home addressFull name | Leak confirmed | |
| 2026.10.06 | 2026.09.06 | B | ナカバヤシ（ApplyNow）東証スタンダード 7987・ナカバヤシ 1,826 records | It has been confirmed that the names, addresses, email addresses, telephone numbers, dates of birth, sex, and occupations of 1,826 new graduate applicants were leaked. Video data is excluded. | Email addressPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.10.06 | Unconfirmed | B | 気象キャスターネットワークUnlisted 15,959 records | Up to 15,959 records of names, email addresses, etc. may have been exposed; some may include addresses and telephone numbers. The affected data were obtained through membership registration, event applications, and inquiries. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.10.06 | 2026.05.29 | C | 長崎市（屋外広告物申請書の誤送付）Government / public body 1 people | When sending a notice about the outdoor advertising permit renewal to another corporation, a different corporation's application was mistakenly enclosed, and the name of one person was disclosed externally. | Full name | Leak confirmed | |
| 2026.10.06 | 2026.07.30 | C | 長崎市（リサイクル推進員書類の誤送付）Government / public body 6 people | Appointment letters and ID cards for recycling promotion officers were mistakenly swapped between two neighborhood associations, causing the names of 6 people to be disclosed externally. | Full name | Leak confirmed | |
| 2026.10.06 | 2026.10.04 | C | nimocaUnlisted↗ 西日本鉄道 9031 521 records | Confirmed leakage of 521 card numbers, dates of birth, and email addresses; no leakage of usage history or names has been confirmed. | Email addressDate of birth | Leak confirmed | |
| 2026.10.05 | 2026.10.02 | SS | 焼肉きんぐ東証プライム 3097・物語コーポレーション 10,788,963 records | Due to unauthorized access to the membership management system, 10,788,963 members' records were exfiltrated. Leaked data includes membership number, name, email address, and phone number, while login passwords, dates of birth, and payment information are reported not to have been leaked. | Email addressUser / member IDPhone numberFull name | Leak confirmed | |
| 2026.10.05 | 2026.10.02 | S | 大阪公立大学Government / public body Unknown | Determined to be a ransomware attack, which halted academic affairs, human resources, payroll and other systems. Whether personal data was leaked is currently under investigation. | Possible leak | ||
| 2026.10.05 | Unconfirmed | S | ホワイトエッセンス（予約・基幹システム）Unlisted 1,050,000 accounts | Confirmed leakage of registration data for approximately 1,050,000 accounts, containing all or part of items such as name, contact information, date of birth, login ID, and encrypted password. There is a risk of misuse. | Email addressUser / member IDPasswordPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.10.05 | Unconfirmed | A | 大起水産Unlisted 175,000 people | Approximately 175,000 individuals' names, addresses, dates of birth, and other information may have been exposed, posing a risk of identity theft and fraudulent use. | Home addressFull nameDate of birth | Possible leak | |
| 2026.10.05 | 2026.10.02 | A | 大和証券Unlisted↗ 大和証券グループ本社 8601 220,000 records | Unauthorized access to the server handling outsourced inquiry management may have exposed personal data of about 110,000 individuals, including names, email addresses, and securities account numbers (approximately 220,000 records including inquiry information). No fraudulent transactions have been confirmed. | Email addressUser / member IDCard & payment dataFull name | Possible leak | |
| 2026.10.05 | 2026.05.12 | A | i-plug（OfferBox）東証グロース 4177・i‐plug 314,000 people | Names and email addresses of up to 31.4万人 individuals were accessible to companies using OfferBox. | Email addressFull name | Possible leak | |
| 2026.10.04 | Unconfirmed | S | 日本経済新聞社Unlisted 1,646 people | Unauthorized access to Google Workspace may have exposed names, email addresses, etc. for 1,646 people; in a separate Microsoft 365 compromise, some email bodies may also have been affected. | Email addressFull name | Possible leak | |
| 2026.10.04 | 2026.09.30 | B | 日経BPUnlisted 26 records | Due to unauthorized access to an employee's email account, the personal names and email addresses of 26 correspondents may have been exposed. Affected recipients have been contacted individually. | Email addressAuth tokenFull name | Possible leak | |
| 2026.10.03 | 2026.09.27 | A | アバハウスインターナショナルUnlisted Unknown | Registered information such as names and addresses and order histories may have been exposed, and fake refund notification emails matching order details have also been reported. | Home addressFull name | Possible leak | |
| 2026.10.03 | Unconfirmed | C | スタディサプリUnlisted↗ リクルートホールディングス 6098 3,687 records | For 3,687 email addresses, a third party may have been able to verify whether they were registered with スタディサプリ. No data leak has been confirmed at this time, but there is concern about registration identification. | Email address | Possible leak | |
| 2026.10.02 | Unconfirmed | S | 日本エネルギー経済研究所Non-profit corporation 13 records | Confirmed leakage of 13 passport records. There is a risk that 759 emails were also leaked; among those, several are reported to include 5 items such as account holder names and account numbers. | Email addressCard & payment dataIdentity verification dataPhone numberFull name | Partial leak confirmed | |
| 2026.10.02 | 2026.09.14 | S | 講談社BECK（旧ビーシーのメール）Unlisted 1 records | Continuous unauthorized access to one 旧ビーシー employee email account and traces of email data acquisition were confirmed, and it was reported that 50 spam emails were sent from that account. | User / member IDPassword | Possible leak | |
| 2026.10.02 | Unconfirmed | A | 第一ライフグループ・第一生命（人事）Unlisted↗ 第一ライフグループ 8750 120,000 people | It has been announced that the names, addresses, job titles, supervisors' names, etc., of approximately 120,000 current and former employees may have been exposed. | Home addressFull name | Possible leak | |
| 2026.10.02 | Unconfirmed | A | 池上通信機東証スタンダード 6771・池上通信機 Unknown | Unauthorized access halted major internal systems; isolating the accounting server delayed closing and review procedures and led to postponement of the earnings announcement. The scope of externally posted information is under investigation. | Possible leak | ||
| 2026.10.02 | Unconfirmed | A | ムーンスターUnlisted Unknown | Names, addresses, contact details, and order history may have been exposed. Card information and passwords are excluded. | Home addressFull name | Possible leak | |
| 2026.10.02 | 2026.09.25 | A | サミーネットワークス（777CON-PASS）Unlisted↗ セガサミーホールディングス 6460 Unknown | Telephone numbers, dates of birth, and photos, along with activity areas derived from location data, may be at risk of being leaked. | Phone numberDate of birth | Possible leak | |
| 2026.10.02 | Unconfirmed | B | 沖縄県立芸術大学Government / public body 207 people | Due to an erroneously sent email announcing a commemorative concert, the email addresses and some names of 207 applicants were displayed to other recipients. | Email addressFull name | Leak confirmed | |
| 2026.10.02 | Unconfirmed | B | 株式会社ワンダーテーブルUnlisted Unknown | They announced that unauthorized access to ApplyNow resulted in some personal information managed for recruitment operations outsourced by ワンダーテーブル being leaked. The number of affected individuals has not been disclosed. | Email addressPhone numberHome addressFull nameDate of birth | Partial leak confirmed | |
| 2026.10.02 | 2026.09.09 | C | 独立行政法人石油天然ガス・金属鉱物資源機構（JOGMEC）Government / public body 8,500 records | Due to unauthorized external access, approximately 1,100 staff email addresses and about 7,400 non-organization email addresses, a total of about 8,500 email addresses, may have been leaked. | Email address | Possible leak | |
| 2026.10.01 | Unconfirmed | S | 日本原子力研究開発機構（研究支援サイト）Government / public body 175 people | Personal identification documents and health examination results for 175 people were leaked, and it is reported that personal numbers are included for 6 of them. The leak creates a risk of identifying individuals and of fraudulent use. | Identity verification dataHealth & medical data | Leak confirmed | |
| 2026.10.01 | 2026.09.28 | S | チケットプラス（チケプラ）Unlisted 107 people | An issue occurred on チケプラ where information of users other than the account holder was displayed; the company reported that up to 107 users’ information may have been displayed and up to 322 users may have been shown others’ information. | Email addressUser / member IDCard & payment dataPhone numberHome addressFull name | Possible leak | |
| 2026.10.01 | Unconfirmed | A | アフラック（よりそうネット）Unlisted Unknown | The policyholder website 「よりそうネット」 was subjected to unauthorized access by a third party, and some customers' personal information was confirmed to have been leaked. No fraudulent use has been confirmed at this time, but service outages and restrictions on certain procedures occurred. | Home addressPhone numberFull name | Leak confirmed | |
| 2026.10.01 | 2026.09.14 | A | らしんばんUnlisted Unknown | Identity document numbers, bank transfer details, purchase/order information, etc. may have been exposed, posing a risk of impersonation and fraudulent use. | Email addressCard & payment dataIdentity verification dataFull nameDate of birth | Possible leak | |
| 2026.10.01 | Unconfirmed | A | 佐川急便（お荷物問い合わせ）Unlisted↗ SGホールディングス 9143 Unknown | There is a risk that parcel senders' and recipients' names, addresses, and phone numbers may have been exposed. スマートクラブ会員 may also have had email addresses and member IDs affected. | Email addressUser / member IDPhone numberHome addressFull name | Possible leak | |
| 2026.10.01 | Unconfirmed | B | キャピタル・ゼンリン株式会社Unlisted Unknown | Unauthorized access to 手間いらず may have exposed some reservation information, and multiple suspicious emails impersonating reservation confirmations have been reported. | Email address | Possible leak | |
| 2026.10.01 | Unconfirmed | B | 株式会社長寿荘Unlisted Unknown | There is a possibility that reservation information for 「手間いらず」 users was leaked, and suspicious messages have been observed among some reservation holders. The number of affected people and incidents is unknown. | Possible leak | ||
| 2026.10.01 | Unconfirmed | B | 玉峰館（FJリゾートマネジメント）Unlisted Unknown | The provider reported that due to unauthorized access to the external reservation management system TEMAIRAZU, some guest information of 玉峰館 may have been viewed and obtained. The number of affected records by facility is not specified. | Possible leak | ||
| 2026.10.01 | 2026.09.25 | B | ローソン（メールサーバー）Unlisted↗ KDDI 9433 700,000 records | The mail server was abused, and an estimated 700,000 suspicious English-language emails were sent. Information leakage, data-center intrusion/tampering, and malware infection were not confirmed at the time of disclosure. | Email address | Possible leak | |
| 2026.09.30 | Unconfirmed | S | ジー・プラン（Gポイント）Unlisted 70,000 accounts | Due to unauthorized access, Gポイント-related services were suspended, and up to approximately 70,000 member identifiers are believed to have been exposed. Service resumption timing is undecided. | User / member ID | Possible leak | |
| 2026.09.30 | Unconfirmed | S | セイコーマートアプリUnlisted 574,647 people | Information of 574,647 members was improperly accessed, including names, addresses, dates of birth, emails, etc., but passwords are reported not to have been leaked. | Email addressPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.09.30 | 2026.08.16 | A | VOISINGUnlisted Unknown | A combination of addresses, dates of birth, purchase histories, and favorite talent information has been confirmed leaked; passwords and card information are excluded. | Home addressDate of birth | Leak confirmed | |
| 2026.09.30 | Unconfirmed | B | 名張近鉄ガス株式会社Unlisted↗ 近鉄グループホールディングス 9041 6,800 records | Approximately 6,800 LP gas customer records managed by 名張近鉄ガス are reported to include names, addresses, and billing-related IDs; two of the records may include phone numbers. No account or card information is included. | User / member IDPhone numberHome addressFull name | Possible leak | |
| 2026.09.30 | 2026.09.07 | B | 吉野家・はなまる（ApplyNow）東証プライム 9861・吉野家ホールディングス 418 accounts | It has been confirmed that attribute data of 5,366 applicants and encrypted passwords for 418 recruiter accounts were leaked. Interview videos were excluded. | Email addressPasswordHome addressFull nameDate of birth | Leak confirmed | |
| 2026.09.29 | 2026.09.28 | S | ヤマト運輸(クロネコ代金後払いサービス) 5,310,000 records | User information from クロネコ代金後払いサービス was leaked. The affected subset covers some usage since 2018年10月以降, with about 531万件 impacted including names, addresses, phone numbers and order details, of which about 49万件 reportedly included email addresses; about 5万件 of recipient information and about 4,100件 of merchant information were also included. The company stated that credit card information and passwords were not included, and no fraudulent use has been confirmed to date; the unauthorized access was discovered in 9月末 and the service was temporarily suspended and later partially resumed on some dates. | Email addressPhone numberHome addressFull name | Leak confirmed | |
| 2026.09.29 | 2026.09.11 | A | 株式会社イープラス（イープラス／スマチケ）Unlisted↗ リクルートホールディングス 6098 1,463 records | Information of 1,463 applicants for refunds of electronic tickets “スマチケ” was leaked; it includes names, email addresses, bank transfer account information, addresses, etc., posing risks of financial loss and identity fraud. | Email addressCard & payment dataHome addressFull name | Leak confirmed | |
| 2026.09.29 | Unconfirmed | A | 日本郵便（郵便局アプリ）Unlisted↗ 日本郵政 6178 19 people | It has been confirmed that data for 19 people — 69 items of member information, address books, shipping label information, etc. — were illicitly obtained. The specific items affected (such as family status) vary depending on the registered information. | Email addressPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.09.29 | Unconfirmed | A | ユニリタ（社内文書管理システム）東証スタンダード 3800・ユニリタ Unknown | ユニリタ has announced it confirmed its corporate information is included in data that attackers claim to have stolen and published. It says it will identify the leaked files and contact affected individuals individually. | Auth token | Leak confirmed | |
| 2026.09.29 | Unconfirmed | B | 株式会社ホロニックUnlisted Unknown | Following reports of unauthorized access to TEMAIRAZU used by operated facilities, it was announced that accommodation reservation information may have been viewed or obtained. The number of affected records per facility is not provided. | Possible leak | ||
| 2026.09.29 | Unconfirmed | B | 株式会社リゾート花湯の森Unlisted Unknown | It was announced that unauthorized access to the reservation management service "手間いらず" may have led to leakage of reservation information for リゾート花湯の森. The specific number of records is not stated. | Possible leak | ||
| 2026.09.29 | 2026.09.01 | C | TOPPAN（損保ジャパン）東証プライム 7911・TOPPANホールディングス 177,426 people | Kana names and policy numbers, etc. for 177,426 individuals (possible duplicates) were mistakenly sent to one other non-life insurer, but complete deletion by the recipient has been confirmed. Email addresses, postal addresses, bank account information, etc. were not included. | Email addressCard & payment dataHome addressFull name | Leak confirmed | |
| 2026.09.28 | Unconfirmed | S | 手間いらず（宿泊予約管理システム）東証スタンダード 2477・手間いらず 4,450,000 people | Up to approximately 445万人 of accommodation reservation information in the reservation management system may have been viewed or obtained. Card information is said not to be held. Whether data was exfiltrated is not confirmed within the scope of publicly available materials. | Email addressPhone numberFull name | Possible leak | |
| 2026.09.28 | Unconfirmed | A | 大東ガス株式会社Unlisted 124,000 records | It was announced that files left on the contractor's internal network were illegally accessed, and approximately 124,000 customer records may have been exposed. | User / member IDPhone numberHome addressFull name | Possible leak | |
| 2026.09.28 | 2026.09.09 | A | 集英社（HAPPY PLUS COMMUNITY）Unlisted 2,835 people | Confirmed leakage of the addresses, family status, photos, SNS information, and email contents of 2,835 people. These are personal data and pose risks such as impersonation and privacy infringement. | Home address | Leak confirmed | |
| 2026.09.27 | Unconfirmed | B | スターツ出版（OZmall）東証スタンダード 7849・スターツ出版 442,779 people | Up to 442,779 email addresses may have been exposed, with some records including names and prefectures. A confirmed data leak has not been reported. | Email addressFull name | Possible leak | |
| 2026.09.27 | Unconfirmed | B | 東京メトロ（メトポ）東証プライム 9023・東京地下鉄 59,000 records | Approximately 59,000 email addresses for which delivery had been stopped may have been viewed or obtained. The affected server is reported to contain no member information other than email addresses. | Email address | Possible leak | |
| 2026.09.26 | Unconfirmed | A | ニッポンレンタカーアプリ（ニッポンレンタカーサービス株式会社）Unlisted↗ トヨタ自動車 7203 41 people | Unauthorized access to the ニッポンレンタカー app may have exposed 41 members' information (names, phone numbers, email addresses, login IDs, usage history, reservation information). For members who registered driver's license information or the last four digits of credit card numbers and cardholder names, those may also have been viewed. | Email addressUser / member IDCard & payment dataIdentity verification dataPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.09.26 | 2026.09.26 | B | 京王電鉄株式会社東証プライム 9008・京王電鉄 Unknown | A ransomware attack has disrupted business systems at some group companies. Train operations are reported to be unaffected at this time, and no data leakage has been confirmed, but an investigation is ongoing. | Possible leak | ||
| 2026.09.25 | 2026.09.25 | SS | タイムズカー(タイムズモビリティ) 6,600,000 accounts | About 6.6 million accounts, including withdrawn users, were affected; disclosed data include names, addresses, dates of birth, phone numbers, email addresses, driver’s license information and other personal data, passwords stored in a non-recoverable format, linked service IDs, etc. Of these, about 1.6 million accounts reportedly had images of identity verification documents such as driver’s licenses leaked. Credit card information is said not to be included. | Full nameHome addressDate of birthPhone numberEmail addressIdentity verification dataPasswordAuth tokenUser / member ID | Leak confirmed | |
| 2026.09.25 | Unconfirmed | S | ファインズ（予約システム）東証グロース 5125・ファインズ 1,540,000 records | Unauthorized access to the reservation system may affect 約154万件 of reservation records (names, phone numbers, email addresses, etc.). | Email addressPhone numberFull name | Possible leak | |
| 2026.09.25 | Unconfirmed | A | スマレジ（スマレジEC）東証グロース 4431・スマレジ Unknown | Unauthorized access occurred to four company environments of スマレジEC, and customer and order information as well as administrator information may have been viewed or obtained; the number of affected individuals has not been disclosed. | Email addressUser / member IDPasswordAuth tokenPhone numberHome addressFull name | Possible leak | |
| 2026.09.25 | Unconfirmed | B | 井筒まい泉株式会社Unlisted Unknown | They announced that unauthorized access to the recruitment management platform resulted in applicant information being leaked externally via a contractor. The specific data items and number of people affected are not stated. | Leak confirmed | ||
| 2026.09.25 | Unconfirmed | B | 日本郵便（国際郵便物の調査請求Web受付）Unlisted↗ 日本郵政 6178 600 records | Approximately 600 registration records were potentially viewable by a third party due to unauthorized access to the web submission for international mail investigation requests; actual viewing or misuse has not been confirmed. Spam was also sent from a service email account. | Email addressUser / member IDPhone numberHome addressFull name | Possible leak | |
| 2026.09.25 | Unconfirmed | B | キューサイ株式会社Unlisted 484 people | It was announced that a breach of a storage/delivery contractor led to the leak of the names, addresses, and phone numbers of 484 customers. | Phone numberHome addressFull name | Leak confirmed | |
| 2026.09.25 | Unconfirmed | B | LEGOLAND Japan（ホテル予約）Unlisted 1,557 records | It was announced that, following unauthorized access to Amadeus systems, 1,557 LEGOLAND Japan hotel reservations may have been affected. | Email addressPhone numberFull name | Possible leak | |
| 2026.09.24 | Unconfirmed | S | EPARKリラク&エステ（PeakManager）Unlisted 22,180,000 records | A customer information database of approximately 2,218万 records was transferred externally (the number of individuals affected has not been disclosed). It includes names, contact details, dates of birth, etc., and the remarks field may contain health information and other sensitive data. | Email addressPhone numberHome addressFull nameDate of birthHealth & medical data | Leak confirmed | |
| 2026.09.24 | 2026.09.10 | B | 大阪市立美術館Government / public body 30 people | It was confirmed that an email was mistakenly sent in a state where 30 course participants could mutually view each other’s names and email addresses. | Email addressFull name | Leak confirmed | |
| 2026.09.18 | 2026.07.13 | SS | ニチレイグループ東証プライム 2871・ニチレイ Unknown | The July 13 cyberattack disrupted warehouse inbound/outbound operations and shipments of frozen foods, and leakage of information on delivery recipients, client contacts, employees, etc. was confirmed. | Email addressFull name | Leak confirmed | |
| 2026.09.18 | Unconfirmed | S | JGC Digital（Azas・Suloop）Unlisted↗ 日揮ホールディングス 1963 60,000 accounts | Unauthorized access to a BI tool; confirmed acquisition of Azas 約4万 accounts' names etc. and Suloop 約2万 accounts' emails etc., totaling 計約6万 accounts. | Email addressFull nameDate of birthHealth & medical data | Leak confirmed | |
| 2026.09.18 | 2026.07.16 | S | ランドハウジング（内見予約システム）Unlisted Unknown | Accounts registered in another company's property viewing reservation system were illicitly used to make multiple viewing reservations. Because key information may have been leaked, locks were replaced for all affected properties. | User / member ID | Possible leak | |
| 2026.09.18 | Unconfirmed | B | 大気社（マレーシアグループ会社）Unlisted↗ 大氣社 1979 1 accounts | At a Malaysian group company, one employee's email account was misused and suspicious emails were sent. The scope of the impact is under investigation. | Email addressUser / member ID | Possible leak | |
| 2026.09.17 | Unconfirmed | B | ちばぎん商店株式会社Unlisted Unknown | The corporate website was illegally accessed and tampered with, potentially affecting information for approximately 192 individuals, approximately 722 corporations, and approximately 7,670 email-only recipients. Account information is included for about 31 of these. | Email addressUser / member IDCard & payment dataPhone numberHome addressFull name | Possible leak | |
| 2026.09.17 | Unconfirmed | B | 株式会社南日本情報処理センターUnlisted Unknown | The company announced that unauthorized access to the website led to defacement of some pages and that restoration was performed. The number of affected information records has not been disclosed. | Possible leak | ||
| 2026.09.16 | 2026.09.11 | SS | Helpfeel（Gyazo） 23,620,000 records | Approximately 23,620,000 user records (anonymous ~18,010,000; registered with email ~5,620,000) and image metadata totaling about 490,000,000 + 2,400,000 + deleted ~174,000,000 were leaked, potentially including email addresses, password hashes, session IDs and other authentication data, as well as OCR text from images, geolocation, IPs and other metadata. About 23,620,000 user records from services including Gyazo were exposed, containing password hashes, authentication tokens, image OCR strings, location data, etc.; compensation, damages, and recovery costs were not disclosed. | Email addressFull namePasswordUser / member IDAuth tokenHome address | Leak confirmed | |
| 2026.09.16 | 2017.11.01 | B | GMOトラスト・ログイン（クラウドストレージ）Unlisted↗ GMOグローバルサイン・ホールディングス 3788 37,747 people | Since November 2017, files containing information for 2,007 companies and 37,747 individuals (provisional) were obtained by third parties due to a configuration error. Most records were email addresses; some included billing recipient names, addresses, phone numbers, etc. | Email addressPhone numberHome addressFull name | Leak confirmed | |
| 2026.09.16 | 2026.09.14 | B | 株式会社スコア・ジャパンUnlisted Unknown | The website was maliciously altered, causing redirects from search results to unrelated sites, but no data leakage has been confirmed. | Possible leak | ||
| 2026.09.16 | 2026.09.02 | C | アイスタイル（@cosme）東証プライム 3660・アイスタイル 10,997 people | Email addresses, delivery settings, user IDs, etc. for 10,997 people were accessible via an internal-sharing URL and were deleted about 20 minutes later; names and similar information were not included. | Email addressUser / member ID | Possible leak | |
| 2026.09.15 | 2026.09.02 | S | あいの風とやま鉄道株式会社Unlisted 1,409 people | Unauthorized access to the reservation site resulted in cancellations and registrations outside normal procedures, and it has been reported that 1,409 reservations may have been affected. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.09.15 | Unconfirmed | S | ムラウチドットコムUnlisted 7,710,000 records | Customer data for 771万件超 were leaked, mainly names, addresses, and phone numbers. Email addresses, dates of birth, and gender were partially included, while passwords and card information were excluded. | Email addressPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.09.15 | 2026.08.31 | A | LEAN BODYUnlisted 440,000 accounts | Data from 約44万アカウント, including email addresses and encrypted passwords, were leaked; the company announced that height, weight, exercise purpose, purchase information, and the last four digits of cards were also affected. | Email addressUser / member IDPasswordCard & payment dataFull nameDate of birthHealth & medical data | Leak confirmed | |
| 2026.09.15 | 2026.08.09 | B | 大阪市Government / public body 106 people | Through 大阪市’s recorded interview system, personal data of 106 applicants—such as names, email addresses, and phone numbers—may have been exposed. The report does not state that a leak has been confirmed. | Email addressPhone numberFull name | Possible leak | |
| 2026.09.15 | Unconfirmed | B | ロート製薬（顧客対応情報）東証プライム 4527・ロート製薬 Unknown | Possible unauthorized access to the mail-order customer support system has been reported; the scope and the contents of any data leakage are currently under investigation. | Partial leak confirmed | ||
| 2026.09.14 | 2021.07.01 | A | 生命保険協会（契約照会）Non-profit corporation 27,407 people | It was reported that the names, addresses, dates of birth, and contact details of 27,407 people were viewable. Insurance contract details and death certificates were excluded. | Email addressPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.09.11 | Unconfirmed | S | 株式会社ハルメク東証グロース 7119・ハルメクホールディングス 1 people | Unauthorized access occurred to the HALMEK up admin panel, and it was disclosed that one employee's ID and password were stolen. | User / member IDPassword | Possible leak | |
| 2026.09.11 | 2026.05.25 | B | デジタル庁Government / public body 246,000 people | Approximately 189,000 government employees and about 57,000 private-sector-related individuals — a total of approximately 246,000 people — may have had names, email addresses, phone numbers, and addresses leaked. No misuse has been confirmed at this time. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.09.10 | 2026.09.04 | SS | Healing Paper（Unni）Unlisted 219,665 people | Unauthorized access to the consultation-history query API of cosmetic medical service 「Unni」 was reported, affecting 219,665 people worldwide; of these, 約4.8万名 were Japanese users, and records may include items such as desired surgery/procedure information. | Email addressUser / member IDCard & payment dataPhone numberFull nameDate of birthHealth & medical data | Leak confirmed | |
| 2026.09.10 | Unconfirmed | S | 扶桑電通東証スタンダード 7505・扶桑電通 26,489 records | Due to unauthorized use of cloud storage credentials, names, addresses, and phone numbers of 26,489 customers, etc. may have been exposed. Payment-related information is excluded. | Phone numberHome addressFull name | Possible leak | |
| 2026.09.10 | Unconfirmed | S | さくらインターネット 1,360,000 accounts | Data for 約136万アカウント including member and contract information and some initial server passwords and VPS administrator initial passwords may have been viewed or obtained. It was also announced that names and email addresses of third-party organizations storing data on さくらのレンタルサーバ (e.g., 一般社団法人セーファーインターネット協会) and contents of reports/inquiries may have been viewed or obtained by third parties; no misuse or secondary damage of these third-party-held data has been confirmed to date. | Email addressUser / member IDPasswordPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.09.09 | 2026.09.07 | S | 大阪市立小学校（成長・肥満度曲線）Government / public body 18 people | A document containing names, dates of birth, growth curves, etc. for 18 students in one class was misdistributed, but all copies have been collected. | Full nameDate of birth | Leak confirmed | |
| 2026.09.09 | 2026.08.31 | B | 鴨川市（ふるさと納税アンケート）Government / public body 218 people | Due to a misconfiguration of a commissioned questionnaire, the names, addresses, and phone numbers of 218 respondents were viewable by other respondents (a follow-up corrected that email was not affected). | Phone numberHome addressFull name | Possible leak | |
| 2026.09.08 | 2026.07.07 | S | 長崎市（マイナンバーカード特急発行書類の紛失）Government / public body 4 people | Documents related to expedited issuance applications for My Number Card were lost, and documents for 4 people are unaccounted for. No Individual Number (my number) was recorded. | Card & payment data | Leak confirmed | |
| 2026.09.08 | Unconfirmed | A | ファイブフォックスUnlisted Unknown | It has been reported that customer names, addresses, dates of birth, etc., along with employee personnel information and some account information may have been exposed. Whether data was actually leaked and the number of affected records have not been specified. | Home addressFull nameDate of birth | Possible leak | |
| 2026.09.08 | 2026.09.02 | B | 京都サンガF.C.Unlisted 15,612 people | Due to an erroneous transmission to a business partner, fan club member information for 15,612 people (name, address, date of birth, etc.) was sent; the recipient confirmed deletion on the same day. | Home addressFull nameDate of birth | Leak confirmed | |
| 2026.09.08 | Unconfirmed | B | REVISIO株式会社Unlisted 1 records | Malware infection was confirmed on one employee device; the device was isolated and related accounts were suspended. No external remote login or server intrusion has been confirmed, but a risk of data leakage has been indicated. | Email addressPhone numberFull name | Possible leak | |
| 2026.09.08 | 2026.04.27 | B | 立教大学Non-profit corporation 1 people | Six email accounts (four students and two alumni) were misused, and a total of 17,668 spam emails were confirmed sent; some of the spam contained information on one faculty member. | Email addressFull name | Leak confirmed | |
| 2026.09.08 | 2026.09.07 | C | 大阪市総合生涯学習センター（メール）Government / public body 168 people | A contact email for the lifelong learning program was mis-sent with the email addresses of 168 recipients visible to other recipients, and although a deletion request was made, completion confirmation has not been published. | Email address | Leak confirmed | |
| 2026.09.07 | 2026.08.27 | A | コープやまぐち（LINEミニアプリ）Non-profit corporation 212,712 accounts | A LINE mini app database was unlawfully accessed, and information on 212,712 registered cooperative members (including cardholders) may have been exposed. | Card & payment data | Possible leak | |
| 2026.09.07 | Unconfirmed | B | 東京科学大学（情報基盤）Government / public body Unknown | There was unauthorized access to the information infrastructure, and names, addresses, email addresses, etc., of students and faculty/staff, including those from pre-merger universities, are suspected to have been leaked. The number of affected records is not stated. | Email addressHome addressFull name | Possible leak | |
| 2026.09.03 | Unconfirmed | B | 名鉄協商株式会社Unlisted↗ 名古屋鉄道 9048 Unknown | They disclosed that customer information may have been leaked due to unauthorized access. After discovering the incident on June 23, investigations confirmed attacks on multiple servers and they reported that affected parties were notified sequentially. | Possible leak | ||
| 2026.09.02 | 2026.08.23 | S | カインドオル（ECサイト）Unlisted 136,464 people | Data of 136,464 customers confirmed leaked, of which 109,311 include address information. Customer passwords and card information are not affected. | Email addressUser / member IDPasswordPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.09.02 | 2025.01.09 | S | 西武鉄道（52席の至福）Unlisted↗ 西武ホールディングス 9024 500 people | Approximately 500 people's names, contact details, and reservation-related information became externally viewable; of these, about 30 included considerations such as allergies and wheelchair use. It has been confirmed that the data were in a viewable state. | Email addressUser / member IDFull nameHealth & medical data | Possible leak | |
| 2026.09.01 | 2026.07.01 | S | チャーム本店Unlisted 370,000 records | Approximately 370,000 records confirmed leaked and approximately 20,000 at risk; unauthorized logins to 239 accounts were confirmed. Customer information and password hash values, etc. were affected. | Email addressPasswordHome addressFull name | Partial leak confirmed | |
| 2026.09.01 | Unconfirmed | S | 三井不動産東証プライム 8801・三井不動産 19,000 records | Up to 19,000 records of employees and related personnel and up to 36,000 records of external parties may have had names, email addresses, departments, etc. exposed; disclosure of email bodies, files, passwords, etc. has not been confirmed. | Email addressFull name | Possible leak | |
| 2026.09.01 | Unconfirmed | B | DAIKO NEXT LINK株式会社Unlisted Unknown | They confirmed unauthorized access to an old email account, announced they shut down the old mail server and migrated to a new domain. No number of affected individuals or incidents is stated. | Email addressUser / member ID | Possible leak | |
| 2026.09.01 | Unconfirmed | B | ペーパーロジック（paperlogic）Unlisted Unknown | An unauthorized access to cloud servers prompted an emergency shutdown of systems, but a follow-up announcement stated no traces were found of acquisition or external transmission of customer documents, personal information, or authentication credentials. | Auth token | Possible leak | |
| 2026.09.01 | Unconfirmed | B | 株式会社TRUNKUnlisted 424 records | Unauthorized access to employee email led to some held information being leaked externally, and suspicious emails impersonating employees were sent. The number of potentially affected records is 424. | Email addressHome addressFull name | Partial leak confirmed | |
| 2026.08.31 | 2026.08.17 | B | 安藤ハザマ東証プライム 1719・安藤・間 5,000 records | Approximately 5,000 pieces of business card information were sent to a fraudster posing as a business partner, confirming the leakage of business card information. | Leak confirmed | ||
| 2026.08.30 | Unconfirmed | S | まんだらけ（通販配送情報）東証スタンダード 2652・まんだらけ Unknown | Detected unauthorized access, suspended online store orders and postponed auctions. The online store stopped taking orders through the month following detection, and reopening proceeded as announced. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.08.28 | Unconfirmed | S | イエローハット（WEB作業予約）東証プライム 9882・イエローハット 1,797,124 people | Personal data of 1,797,124 イエローハット members, including names, addresses, dates of birth, member numbers and login IDs, and passwords in an unrecoverable state were leaked. | Email addressUser / member IDPasswordPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.08.28 | Unconfirmed | A | コロナ東証スタンダード 5909・コロナ 35,000 people | It has been reported that up to 3.5万人 of names, addresses, and construction-related documents may have been exposed. A confirmed data leak has not been indicated. | Home addressFull name | Possible leak | |
| 2026.08.28 | Unconfirmed | A | T&K TOKAUnlisted Unknown | Confirmed unauthorized access and ransomware impact; some operations suspended and affected business partners are being contacted individually. Whether information was leaked is unknown. | Possible leak | ||
| 2026.08.27 | Unconfirmed | S | CINRA, Inc.Unlisted 21,508 people | Operator credentials were obtained by exploiting a vulnerability and unauthorized access was confirmed; therefore information of 21,508 CINRA JOB members and former members may have been exposed. Actual viewing or retrieval has not been confirmed in the final report. | Email addressAuth tokenPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.08.27 | 2026.04.01 | A | チューリッヒ保険（Z-Dash）Unlisted 1,668 people | Names, email addresses, and case management numbers for up to 1,668 individuals may be at risk of exposure. The combination of items is under investigation, and no confirmed data leak has been found at this time. | Email addressFull name | Possible leak | |
| 2026.08.24 | 2026.06.17 | S | 株式会社アイネックスUnlisted 32 records | In an investigation of unauthorized access to a cloud service account, 373 email addresses were confirmed leaked. 32 emails are at risk of exposure, and 46 items of personal information contained in those emails were reported. | Email addressUser / member IDPasswordPhone numberFull name | Partial leak confirmed | |
| 2026.08.21 | Unconfirmed | B | 楽天ブックスネットワークUnlisted↗ 楽天グループ 4755 33,000 records | Approximately 33,000 delivery addresses etc. are reported to be at risk of disclosure; financial information is not included and an actual leak has not been confirmed. | Possible leak | ||
| 2026.08.20 | Unconfirmed | A | コタ東証プライム 4923・コタ 55,000 records | In addition to customer and personnel information, there is a risk that about 55,000 records of shareholder information and share holdings were exposed. A confirmed data leak has not been announced. | Possible leak | ||
| 2026.08.20 | Unconfirmed | B | エヌ・イー ケムキャット株式会社Unlisted Unknown | Due to unauthorized use of an employee account, information of employees, temporary staff, on-site contractors, and group company employees was or may have been leaked. No number of affected individuals or incidents is provided. | Email addressPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.08.19 | 2026.02.04 | S | ジェックスUnlisted 77,619 records | Servers were affected by ransomware; after recovery, 77,619 customer inquiry records and 1,360 records containing only names were temporarily viewable, but no external leak has been confirmed. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.08.18 | Unconfirmed | S | 株式会社ヴェレダ・ジャパンUnlisted Unknown | A system breach from unauthorized access occurred, and the official online shop has been temporarily suspended due to concerns about partial leakage of personal information (new orders and recurring shipments suspended). | Possible leak | ||
| 2026.08.18 | Unconfirmed | B | ウェブライフ（OEMホームページ作成サービス）Unlisted Unknown | They disclosed unauthorized access to the customer management system of OEM向けホームページ作成サービス and say email addresses may have been leaked. No number of affected records is provided. | Email address | Possible leak | |
| 2026.08.17 | Unconfirmed | A | 加賀ソルネット（アカデミコナビ）Unlisted 166,000 people | It was announced that addresses, affiliated schools, and purchase information for approximately 16.6万人 records were leaked, and a follow-up report denied any password leakage. | Home address | Leak confirmed | |
| 2026.08.17 | Unconfirmed | A | ロジックベインUnlisted 97,338 people | Confirmed exposure of names, affiliations, and emails for 17,559 individuals. Approximately 97,338 individuals are in the scope of potential exposure — including emails and contract-related information — and the confirmed published records are a subset of that number. | Email addressPhone numberHome addressFull name | Partial leak confirmed | |
| 2026.08.17 | 2026.04.30 | B | 教育ソフトウェアUnlisted 4,627 records | A ransomware attack on a dormant server may have exposed the names, affiliated universities, and partial student ID numbers of 4,627 users of the self-assessment system. | User / member IDFull name | Possible leak | |
| 2026.08.17 | Unconfirmed | B | 株式会社GHPUnlisted Unknown | Unauthorized access to the database of クラブチャペルホテルズ was confirmed, and some registration information may have been read. A definitive data breach has not been indicated. | Email addressPhone numberFull name | Possible leak | |
| 2026.08.15 | 2026.08.12 | B | 株式会社両毛システムズ東証スタンダード 9691・両毛システムズ Unknown | Unauthorized use of VPN accounts allowed intrusion into the internal network, potentially exposing information of business partners, customers, and employees. The number and types of personal data are currently under review. | User / member ID | Possible leak | |
| 2026.08.13 | Unconfirmed | B | 赤武エンジニアリング株式会社Unlisted Unknown | Announced system disruption due to a ransomware infection. The number of affected records is not listed in published materials, and whether data was leaked is not specified. | Possible leak | ||
| 2026.08.12 | 2026.08.05 | S | ヨネックス公式オンラインショップ東証スタンダード 7906・ヨネックス 1 people | Unauthorized logins were confirmed for 3 accounts; in one case, name, address, purchase history, and other data may have been viewed. | Home addressFull nameDate of birth | Possible leak | |
| 2026.08.10 | Unconfirmed | B | 五大開発株式会社Unlisted Unknown | The いさぼうネット server suffered unauthorized access and member information may have been leaked; after confirming the attack on January 26 they stopped and isolated the server and announced migration to a new environment. | Email addressPasswordPhone numberHome addressFull name | Possible leak | |
| 2026.08.07 | Unconfirmed | B | イノベーション（GitHub）東証スタンダード 3484・イノベーションホールディングス 62,689 people | It was confirmed that the names and email addresses of 62,689 people and some phone numbers were leaked. This information carries risks such as impersonation and spam. | Email addressPhone numberFull name | Leak confirmed | |
| 2026.08.07 | 2026.07.28 | C | 国立研究開発法人科学技術振興機構（JST）Government / public body 18,000 records | Due to unauthorized third‑party access, approximately 18,000 emails stored in the mailboxes of 12 JST役職員 may have been leaked externally, possibly including about 1,400 external email addresses and about 1,000 JST役職員 email addresses. | Email address | Possible leak | |
| 2026.08.07 | Unconfirmed | D | デジタル庁（国家資格システム）Government / public body 150 people | Names and affiliations of 150 people were mistakenly sent to another government ministry/agency; there is no evidence of onward transfer to third parties and deletion has been confirmed. | Full name | Leak confirmed | |
| 2026.08.06 | 2026.07.10 | B | ル・アンジェ株式会社Unlisted Unknown | Due to unauthorized access to BAND, names, dates of birth, contact details, and similar information of some members and employees may have been disclosed. The number of affected individuals and incidents is unknown. | Email addressPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.08.06 | Unconfirmed | B | ナイス株式会社東証スタンダード 8089・ナイス 2,400 records | They detected suspicious activity on managed email addresses and blocked external access by changing passwords and similar measures; the publicly reported impact is about 2,400 records. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.08.05 | Unconfirmed | B | 一般社団法人共同通信社Non-profit corporation 6,000 records | Following external tips, they confirmed the possibility that staff accounts were misused; the disclosed impact is approximately 6,000 cases. | Email addressFull name | Possible leak | |
| 2026.08.05 | Unconfirmed | B | ソディック東証プライム 6143・ソディック Unknown | The company disclosed a potential exposure of employees' and business partners' names and contact information due to unauthorized access via overseas sites, but no significant business impact or evidence of leakage or misuse has been confirmed. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.08.04 | Unconfirmed | A | 中部電力東証プライム 9502・中部電力 74,000 people | They announced that about 74,000 business contacts and about 2,400 email bodies may have been exposed. | Email address | Possible leak | |
| 2026.08.03 | 2026.08.01 | B | 株式会社大仙Unlisted Unknown | Unauthorized external access (malware infection) caused a shutdown of all internal systems, disrupting order and shipping operations. Investigation is ongoing; no data leakage has been confirmed to date, but the scope is under investigation. | Possible leak | ||
| 2026.08.03 | Unconfirmed | B | フラウ・インターナショナルUnlisted Unknown | There is a risk that contact information of inquiry users—such as names, email addresses, and phone numbers—was exposed. | Email addressPhone numberFull name | Possible leak | |
| 2026.08.03 | 2026.07.29 | B | 海月館グループUnlisted Unknown | There was unauthorized access from the night of July 29 into the morning of July 30, and an investigation is underway because there is a risk of information leakage. | Full name | Possible leak | |
| 2026.08.03 | 2026.07.30 | B | 株式会社講談社Unlisted 3,812 records | Unauthorized access to a corporate email account resulted in contact information for up to 3,812 people being stolen, and spoofed emails were sent to 553 of those email addresses. | Email addressAuth tokenFull name | Leak confirmed | |
| 2026.08.03 | Unconfirmed | B | M&Sフードサービス（宮本むなし）Unlisted 1,030 people | Contact details and ordered items and amounts for 1,030 people may have been exposed. Payment information is reported not to be included. | Card & payment data | Possible leak | |
| 2026.08.03 | Unconfirmed | B | 株式会社満果惣Unlisted Unknown | The disclosure states that, in connection with the unauthorized access incident at ショップサーブ, user information for 満果惣's online shop was confirmed to have leaked, but the store-specific number of records and data items are not provided. | Leak confirmed | ||
| 2026.07.31 | 2026.06.04 | S | 千（はいチーズ!フォト）Unlisted Unknown | 「はいチーズ！フォト」 suffered unauthorized access from the evening of 2026-06-04 to the morning of 2026-06-05, and a leak of personal information related to some orders was confirmed. The photo sales system was suspended from 2026-06-05 at noon and resumed on 2026-06-08 in the morning. | Phone numberHome addressFull name | Leak confirmed | |
| 2026.07.31 | Unconfirmed | A | ALSOKジョイライフ株式会社Unlisted 134 records | Unauthorized access to terminals at a fee-based nursing home occurred and illicit remote control was confirmed; it was announced that information for 134 residents and others may have been viewed. | User / member IDFull nameDate of birth | Possible leak | |
| 2026.07.31 | 2026.06.16 | B | 公益財団法人日本適合性認定協会Non-profit corporation Unknown | The company announced that spam was sent following unauthorized access to staff email accounts; the number of leaked records is not specified. | Email addressUser / member ID | Possible leak | |
| 2026.07.31 | Unconfirmed | B | 公益財団法人東京都中小企業振興公社Government / public body Unknown | The 価格転嫁・賃上げ支援事業サイト experienced unauthorized access, resulting in a partial suspension of site operations. | Possible leak | ||
| 2026.07.28 | 2025.08.01 | A | タカラトミー（デュエマサポートアプリ）東証プライム 7867・タカラトミー 155,000 people | Up to 15.5万人 worth of addresses, dates of birth, contact details, and social media identifiers were viewable linked together, but actual exfiltration has not been confirmed. | User / member IDHome addressDate of birth | Possible leak | |
| 2026.07.28 | Unconfirmed | B | 大阪府（おおさか事業者ポータル）Government / public body 15 records | On the おおさか事業者ポータル, account information for medical institutions different from the applicant became viewable; published impact includes 15 account holder names, 16 viewing institutions, 14 viewed institutions, and 1 inactive institution. | Card & payment dataFull name | Leak confirmed | |
| 2026.07.24 | 2026.05.17 | S | 大川精螺工業株式会社Unlisted Unknown | The company reports it was hit by a ransomware attack and some personal information it holds may have been leaked. Servers and endpoints were reinitialized and business systems restored, but some data was encrypted. | Possible leak | ||
| 2026.07.23 | Unconfirmed | B | 株式会社シーエスエムUnlisted Unknown | Unauthorized third-party access to FortiGate機器 was confirmed; the affected devices were removed and replaced with other firewalls, and the scope of the impact is under investigation. | Possible leak | ||
| 2026.07.23 | 2026.07.15 | B | 株式会社北海道協同組合通信社Unlisted Unknown | It was announced that on the 15th there was unauthorized access to the cloud shared folder of the vendor contracted to rebuild the sales management system, and there is a risk of information leakage via the contractor. | Phone numberHome addressFull name | Possible leak | |
| 2026.07.22 | 2026.04.24 | S | Axcelead Drug Discovery Partners株式会社Unlisted 7,000 records | The incident involved one employee entering credentials in a phishing email; the disclosed impact is approximately 7,000 emails (this is not stated as the number of affected individuals). | Auth token | Possible leak | |
| 2026.07.21 | 2026.04.08 | SS | 精電舎電子工業Unlisted Unknown | Numerous servers and PCs were encrypted, disrupting the internal network. It was reported that after detection, operations such as order processing, production, and shipping were resumed using a temporary system. | Leak confirmed | ||
| 2026.07.21 | Unconfirmed | S | 新エフエイコム(岡谷鋼機グループ)Unlisted Unknown | A disruption occurred due to a network intrusion and ransomware following theft of account credentials, and it was disclosed that information, including some business partners' personal data, may have been viewed or obtained. | User / member IDAuth token | Partial leak confirmed | |
| 2026.07.20 | 2025.11.25 | A | SunoUnlisted 55,282,226 records | A leak has been confirmed and is reported to include 55,282,226 email addresses. Some records contain addresses, purchase information, and card last 4 digits, posing risks such as spam and impersonation. | Email addressCard & payment dataPhone numberHome addressFull name | Leak confirmed | |
| 2026.07.17 | 2025.09.29 | S | アサヒグループホールディングス東証プライム 2502・アサヒグループホールディングス 1,525,000 records | Due to a cyberattack, there was a risk of leakage of 152.5万件 of customer support records and 37.8万件 of vendor-related information, and exfiltration from some PCs was also confirmed. Order intake and shipping were handled manually for 約2か月強. | Email addressHome addressFull nameDate of birth | Partial leak confirmed | |
| 2026.07.17 | Unconfirmed | B | メディア4uUnlisted 22,928 records | 22,928 records potentially constituting personal information were inspected and confirmed to include contact person names, business email addresses, etc. Passwords and message bodies were excluded. | Email addressFull name | Leak confirmed | |
| 2026.07.15 | 2026.07.11 | B | GovTech東京（東京アプリ）Unlisted 1 people | It has been confirmed that one person's name, phone number, and email address were mistakenly sent to another user. | Email addressPhone numberFull name | Leak confirmed | |
| 2026.07.14 | Unconfirmed | B | 株式会社K9ナチュラルジャパンUnlisted 78,763 records | Partial customer information was confirmed leaked due to unauthorized access to a server; the number of leaked customer records announced is 78,763. | Email addressUser / member IDAuth tokenPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.07.13 | 2026.07.11 | A | 日本交通Unlisted Unknown | Telephone dispatch and hire reservations were suspended, and external leakage of some files was confirmed. GOアプリ, pickup points, and street hails remain available, with a partial reopening planned for 10月6日. | Phone number | Leak confirmed | |
| 2026.07.09 | 2026.04.17 | A | 福岡大学（SMART SPI）Non-profit corporation 33,668 people | A contractor's server was breached, and up to 33,668 people's student ID numbers, dates of birth, exam results, etc. may have been leaked (names are among up to 800 registered individuals). | User / member IDFull nameDate of birth | Possible leak | |
| 2026.07.08 | Unconfirmed | S | 九州電力送配電（外部記憶媒体）Unlisted↗ キューデンホールディングス 642A Unknown | An external storage medium containing subscriber information and power usage records in 30-minute intervals is missing; external leakage has not been confirmed. | Possible leak | ||
| 2026.07.06 | 2026.06.24 | S | 日本大学（学生・卒業生メール）Non-profit corporation 9 people | Email accounts of a total of 9 current students and alumni were illicitly used by a third party, and as of July 3, 17,864 suspicious emails had been sent. There is a risk that email contents and personal information were accessed. | User / member IDPassword | Possible leak | |
| 2026.07.06 | 2026.07.04 | S | ワサビ（WASABI SWITCH）Unlisted Unknown | The development database was exfiltrated and deleted, and some production API keys and administrator account information were stolen, so keys were revoked and reissued. It was announced that real customer order data were not included. | User / member IDPasswordAuth token | Possible leak | |
| 2026.07.03 | Unconfirmed | D | ユニマットライフUnlisted 126,947 records | An Excel file sent from a branch office to a client contained a residual customer list (names, addresses, phone numbers, email addresses, employers; 126,947 records). It has been confirmed for all recipients that there was no external forwarding and deletion has been completed. | Email addressPhone numberHome addressFull name | Leak confirmed | |
| 2026.06.30 | Unconfirmed | S | アフラック生命保険Unlisted 4,400,000 people | Approximately 約440万人分 (initially disclosed as 約438万人, corrected on 7月13日) of names, addresses, phone numbers, policy numbers, and coverage details were leaked due to unauthorized access to a subscriber website; of these, about 約22万人分 also included bank account information for premium transfers. | User / member IDCard & payment dataPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.06.30 | Unconfirmed | A | JAさっぽろ（農林中央金庫）Non-profit corporation 3,176 records | 3,176 records containing customer numbers, deposit balances, loan balances, etc. were erroneously provided to JAグループ関係団体 and a contractor, and have been deleted by the recipients. | Leak confirmed | ||
| 2026.06.29 | Unconfirmed | B | 石川コンピュータ・センターUnlisted 2,551 records | There is a risk of leakage for 1,929 emails with attachments and 2,551 attachment files, and the send/receive logs include 14,071 external email addresses. | Email address | Possible leak | |
| 2026.06.26 | 2026.06.24 | A | 宮城県石巻高等学校（採点済み答案）Government / public body 182 people | A teacher mistakenly uploaded PDFs of graded answer sheets to the groupware, and answer sheets for 182 students were viewed. This incident was caused by improper handling of personal information. | Leak confirmed | ||
| 2026.06.24 | 2026.04.27 | A | マルタケUnlisted Unknown | Ransomware disrupted normal operations, and pharmaceutical supply was maintained by alternative means. It was confirmed that information on business partners, shareholders, and officers/employees was exfiltrated and publicly disclosed. | Leak confirmed | ||
| 2026.06.23 | 2026.06.23 | SSS | KDDI(ISP事業者向けメール基盤) 12,231,954 people | Unauthorized access to a shared email platform for ISP operators used by @nifty, BIGLOBE, J:COM, etc., was confirmed to have resulted in the leakage of 12,231,954 email addresses (of which passwords for 7,616,173 were leaked), affecting users across multiple ISPs and prompting notices from each ISP. The July 6 investigation report was the final report. | Email addressUser / member IDPassword | Leak confirmed | |
| 2026.06.22 | Unconfirmed | A | 株式会社ソフツーUnlisted 159,850 records | There was unauthorized access to a verification server for call quality analysis, and index data for searches was deleted. 159,850 phone numbers and call transcriptions, etc., have been reported as affected. | Phone number | Possible leak | |
| 2026.06.19 | 2026.04.20 | S | 2りんかんイエローハットUnlisted↗ イエローハット 9882 3,180,000 people | Personal names, contact information, dates of birth, vehicle information, etc., and app IDs and passwords of approximately 318万人 were leaked. | Email addressUser / member IDPasswordPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.06.19 | Unconfirmed | A | 株式会社ディライトフルUnlisted Unknown | Traces indicative of unauthorized access and information leakage were found on some of the service's servers, and services for affected accounts have been suspended. An investigation into the scope of the impact is underway. | User / member ID | Possible leak | |
| 2026.06.19 | Unconfirmed | B | 株式会社現代仏壇Unlisted Unknown | We identified unauthorized access to the operational network on June 8, and information may have been leaked. We are investigating and implementing measures to prevent recurrence. | Possible leak | ||
| 2026.06.16 | 2021.01.01 | A | コマツ東証プライム 6301・小松製作所 139,000 people | From around 2021, names, work emails, and other data for approximately 13.9万人 were left accessible. Follow-up reports indicate the exposed attributes were mainly work-related and that viewers were reportedly limited to system users. | Email addressFull name | Possible leak | |
| 2026.06.16 | 2026.04.21 | B | ミカサUnlisted 4,298 people | Between 2013-09 and 2016-03, up to 4,298 individuals who purchased from the online shop may have had portions of their personal information—names, addresses, e-mail addresses, phone numbers, dates of birth, etc.—leaked externally. | Email addressPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.06.15 | Unconfirmed | S | 佐嘉平川屋Unlisted Unknown | It was announced that payment information, including card numbers, expiration dates, and security codes, may have been exposed. | Email addressCard & payment dataPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.06.15 | 2026.05.01 | B | アクト・セン株式会社Unlisted Unknown | A server of the work management system was subject to unauthorized access, and encryption damage believed to be from ransomware has been confirmed. The disclosure concerns impacts on current and former employees of four companies; the number of affected individuals is not stated. | Email addressUser / member IDPasswordIdentity verification dataPhone numberFull nameDate of birth | Possible leak | |
| 2026.06.15 | Unconfirmed | B | 株式会社ファクトリージャパングループUnlisted Unknown | Unauthorized third-party access to the servers has been confirmed; the number of affected records has not been disclosed. Investigation is ongoing, and whether any data were leaked is unknown. | Possible leak | ||
| 2026.06.12 | 2026.03.09 | A | 日本テレネットUnlisted 602,000 records | There is a risk of leakage affecting CSS contracted operations 60.2万件, BPO contracted operations 40.4万件, etc.; overlap between categories is unknown and no traces of external transfer have been confirmed. | Email address | Possible leak | |
| 2026.06.12 | Unconfirmed | B | 株式会社D&M東証グロース 189A・D&Mカンパニー 633 records | A fax storage server was infected with ransomware, and it is highly likely that 633 records including customers' and business partners' names, addresses, and phone numbers were leaked. This is a case with a high risk of personal information disclosure. | Phone numberHome addressFull name | Possible leak | |
| 2026.06.10 | Unconfirmed | S | 株式会社Kaizen Tech AgentUnlisted 9,721 records | There is a risk that a former employee removed personal data; the affected records are 9,721件. Confirmation of the removal and an assessment of the impact are required. | Email addressCard & payment dataPhone numberHome addressFull nameDate of birthHealth & medical data | Possible leak | |
| 2026.06.10 | 2026.05.02 | B | CKCネットワーク株式会社、株式会社学参Unlisted 664,000 records | Servers were affected by a ransomware attack; approximately 664,000 inquiry records (of which about 9,900 may include contact details) and about 53,000 member records were stored on the affected servers. No traces of external leakage have been confirmed to date, but a leak cannot be ruled out, and investigation and monitoring are ongoing. | Email addressUser / member IDPhone numberHome addressFull name | Possible leak | |
| 2026.06.05 | 2026.05.26 | S | エン（ミドルの転職）東証プライム 4849・エン 2,503 records | A total of 2,503 unauthorized logins due to list-based attacks were confirmed, and it is possible that member information pages were accessed. There is a risk that member information was viewed. | Possible leak | ||
| 2026.06.04 | Unconfirmed | S | 株式会社ビジュアルアーツUnlisted 6,017 records | Pre-release game data was disclosed without authorization, and theft of cloud authentication credentials was confirmed. The approximate counts published for each affected category are 6,017; 2,626; 1,859; 484; 1,452; 1,007; and 114 (duplicates not checked). | Email addressAuth tokenIdentity verification dataPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.06.04 | 2026.04.17 | B | 日本医業経営コンサルタント協会Non-profit corporation 1,051 records | An email account of the Iwate Prefecture branch was accessed without authorization, affecting information related to 1,051 accounts with which it had previously exchanged communications. Secondary harm such as spam sending is a concern. | Email addressFull name | Partial leak confirmed | |
| 2026.06.04 | Unconfirmed | B | 株式会社食創Unlisted Unknown | Servers were encrypted by ransomware, causing disruption to some operations. Whether any data was leaked is currently under investigation. | Possible leak | ||
| 2026.06.03 | 2026.05.25 | S | 藤田医科大学病院Non-profit corporation 1,365 records | Possibly 1,365 patients' records were leaked externally from an employee's personal PC. The data include sensitive medical information such as names, dates of birth, patient IDs, diagnoses, admission/discharge dates, and test data. | User / member IDFull nameDate of birthHealth & medical data | Possible leak | |
| 2026.06.03 | Unconfirmed | A | 阿波銀行東証プライム 8388・阿波銀行 27,745 records | A total of 27,745 personal information records were leaked, including number of shares held and some deposit/loan transaction information; PINs and similar data were not affected. | Leak confirmed | ||
| 2026.06.02 | 2026.04.02 | A | CAMPFIREUnlisted 225,846 accounts | Approximately 22.6万 users were affected, including some bank account information. One personal information record was confirmed to have been exfiltrated. | Card & payment data | Partial leak confirmed | |
| 2026.05.30 | 2026.05.26 | S | キャリアデザインセンター（女の転職type）東証プライム 2410・キャリアデザインセンター 18,253 people | Unauthorized logins were confirmed on the job-change member page, and 18,253 accounts were misused. Leaked items are under investigation, and there is a risk that member information was viewed. | User / member ID | Possible leak | |
| 2026.05.28 | Unconfirmed | S | ポラリス・ホールディングス株式会社東証スタンダード 3010・ポラリス・ホールディングス Unknown | A Booking.com account was fraudulently used and the payout destination was changed, resulting in 約900万円 being sent to a third party. Transfer loss occurred at 1 hotel, causing financial damage and a risk of further fraudulent transfers. | User / member ID | Possible leak | |
| 2026.05.27 | 2026.04.20 | A | 東京都保健医療局（看護師等修学資金）Government / public body 565 people | The administrative system for the nursing student loan program was configured to allow viewing personal information from other facilities; it was reported that 437 borrowers, 128 joint guarantors, and 4 staff across 3 facilities viewed the screens. | Phone numberHome addressFull name | Partial leak confirmed | |
| 2026.05.27 | Unconfirmed | A | 有限会社山田ボデー工業所Unlisted Unknown | It was announced that read access to the legacy EC database and access to email information were confirmed, but the number of affected individuals/records is not stated in the published materials. | Email addressPasswordPhone numberHome addressFull name | Partial leak confirmed | |
| 2026.05.27 | 2026.05.20 | B | アソビュー株式会社Unlisted 27,163 records | 27,163 reservation records from the reservation management system were leaked externally. Included names, gender, date of birth, phone numbers, addresses, and reservation details; email addresses, passwords, and credit card information were not included. | Email addressAuth tokenCard & payment dataPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.05.25 | Unconfirmed | B | 東京都（東京デジタルアカデミー）Government / public body 2,438 people | It was confirmed that names, emails, and hashed passwords for up to 2,438 people were leaked, and a CSV was illicitly downloaded due to insufficient access restrictions. Two ordinary citizens are included in that total. | Email addressPasswordFull name | Leak confirmed | |
| 2026.05.21 | 2026.02.03 | S | あなぶきハウジンググループUnlisted↗ 穴吹興産 8928 207,773 records | A ransomware attack caused personal information to leak from our group's file servers; ultimately 207,773 personal data records were confirmed leaked. Notifications to affected parties and reports to relevant authorities have been made. | Email addressCard & payment dataIdentity verification dataPhone numberHome addressFull nameDate of birthHealth & medical data | Leak confirmed | |
| 2026.05.20 | 2026.04.02 | A | YCC情報システム（山形市等）Unlisted Unknown | There is a risk that the municipality's residents', tax, and insurance data were leaked. Some are said to include My Number and payroll information, but whether they were actually leaked is not specified. | Identity verification data | Possible leak | |
| 2026.05.18 | 2025.08.14 | S | 三浦工業東証プライム 6005・三浦工業 5,021 records | Internal accounts were stolen and unauthorized access occurred, resulting in encrypted data for 5,021 employees etc., including business contact details and system passwords, being leaked or potentially leaked. | Password | Possible leak | |
| 2026.05.18 | Unconfirmed | S | ユニバーサル ミュージックUnlisted 3,100,000 records | Approximately 約310万件 of names, contact information, and purchase histories were leaked, raising concerns about secondary harms such as identity fraud and spam emails. | Email addressPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.05.15 | 2026.05.05 | S | CSアカウンティング株式会社Unlisted Unknown | There was unauthorized access to the server, and the investigation suggests a system account takeover, but data leakage had not been confirmed at the time of the announcement. | User / member IDPassword | Possible leak | |
| 2026.05.15 | 2026.05.06 | B | アイサンテクノロジー株式会社東証スタンダード 4667・アイサンテクノロジー Unknown | The company’s website was defaced, resulting in redirects to inappropriate external pages. Details such as counts are not disclosed in the public materials. | Possible leak | ||
| 2026.05.14 | Unconfirmed | B | 株式会社日本資産総研Unlisted Unknown | The company announced that systems were encrypted, there is a possibility that customer and related parties' information was leaked, and business operations are affected. The number of affected individuals/records is not listed in the published materials. | Possible leak | ||
| 2026.05.13 | 2026.03.13 | S | メディカ出版Unlisted 641,000 people | Due to an internal unauthorized intrusion using a legitimate account, information of approximately 641,000 people (duplicates possible) may have been exposed; specific data items have not been disclosed. | Auth token | Possible leak | |
| 2026.05.12 | Unconfirmed | S | 東山産業株式会社Unlisted Unknown | A ransomware incident was confirmed; after administrator privileges were obtained the impact spread within the network, and the company announced that data observed externally included its information. Details of the scope of the leak are not described in the public materials. | Phone numberHome addressFull name | Leak confirmed | |
| 2026.05.12 | 2026.05.04 | A | 株式会社オリエンタルダイヤモンドUnlisted Unknown | The company announced that a ransomware attack encrypted files and halted operations; external connections have been restricted while recovery is underway. Whether data was exfiltrated and the extent of any leak are undetermined. | Phone numberHome addressFull name | Possible leak | |
| 2026.05.12 | Unconfirmed | B | 日本・アルカディア・ネットワーク株式会社Unlisted Unknown | Traces of unauthorized access and suspicious files were found on some customer servers we manage, confirming unauthorized access; the number of affected individuals and incidents is not listed in the public materials. | Possible leak | ||
| 2026.05.12 | Unconfirmed | B | 東京鋪装工業株式会社Unlisted Unknown | They have disclosed a ransomware incident and say there is a risk of data leakage, but the number of affected records is not stated in the public materials. | Email addressCard & payment dataHome addressFull nameDate of birth | Possible leak | |
| 2026.05.11 | 2025.10.21 | A | エネサンスグループUnlisted 365,000 records | About 約36.5万件 of customer contact details and other records, along with employee information, were confirmed to have been published by the attacker. | Partial leak confirmed | ||
| 2026.05.11 | 2026.03.26 | B | ホクヨーUnlisted Unknown | A ransomware-related system outage occurred on March 26, but as of May 11 systems have been restored and operations are unaffected. Investigation is ongoing regarding any personal data leakage. | Possible leak | ||
| 2026.05.07 | Unconfirmed | B | 株式会社イーストUnlisted Unknown | Unauthorized access to the internal network was confirmed. The company is investigating with the police and external experts, and at the time of the announcement no data leakage has been confirmed. | Possible leak | ||
| 2026.05.01 | Unconfirmed | S | マネーフォワード（GitHub）東証プライム 3994・マネーフォワード 370 records | A third party reportedly misused GitHub credentials to copy repositories. It states 370 card-related records were affected, but says there is no confirmed intrusion into the production DB or impact to customer financial institution credentials. | Auth tokenCard & payment dataFull name | Possible leak | |
| 2026.05.01 | Unconfirmed | A | 東北大学（サーバー・病院治験NAS）Government / public body Unknown | Unauthorized access occurred to information equipment and a NAS used for hospital clinical trial operations, and patient information may have been leaked. The number of affected records is not listed in the published materials. | Email addressUser / member IDFull nameHealth & medical data | Possible leak | |
| 2026.04.30 | 2026.04.05 | A | いえらぶGROUP（クラウドサービス）Unlisted Unknown | いえらぶGROUP announced that data was leaked from its cloud service; the leak may include contact details, desired property criteria, and parts of communication histories, but the number of affected records is not stated in the released materials. | Email addressPhone numberHome addressFull name | Partial leak confirmed | |
| 2026.04.30 | Unconfirmed | B | トヨタモビリティパーツ（ジェームス）Unlisted↗ トヨタ自動車 7203 Unknown | Unauthorized access to servers was detected, and the investigation disclosed that ジェームス member information may have been leaked; the announced number of affected individuals was not specified. | Email addressUser / member IDPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.04.27 | Unconfirmed | S | 株式会社ボンフォームUnlisted 3,268 people | Due to unauthorized access to the online store, card information may have been leaked; the card data affected is 3,463 records · 3,268 individuals, and 735 people were disclosed to also have had their email, password, and phone included. | Email addressPasswordCard & payment dataPhone numberFull name | Possible leak | |
| 2026.04.27 | Unconfirmed | S | 村田製作所東証プライム 6981・村田製作所 73,000 records | Unauthorized access to the internal information-sharing system resulted in confirmed or potential acquisition of approximately 73,000 employee-related records (including health, personnel, and account information) and contact details for approximately 15,000 external parties. | Email addressCard & payment dataPhone numberHome addressFull nameDate of birthHealth & medical data | Partial leak confirmed | |
| 2026.04.27 | Unconfirmed | S | 東京計器株式会社東証プライム 7721・東京計器 Unknown | An employee's Chatwork account was misused via phishing; it was disabled after discovery, and a May 8 investigation found no confirmed external data leakage. | User / member ID | Possible leak | |
| 2026.04.27 | Unconfirmed | B | アルプスアルパイン株式会社東証プライム 6770・アルプスアルパイン Unknown | The company announced the incident was linked to unauthorized access to a contractor's VPN system and that some of the company's servers were also affected. Public materials do not currently state whether any data was actually exfiltrated or the scope of the impact. | Email addressUser / member IDFull name | Possible leak | |
| 2026.04.24 | Unconfirmed | B | 生活協同組合コープいしかわNon-profit corporation 1,756 records | They announced that ransomware damage to the gift contractor may have leaked 1,756 cooperative member records and 4,264 delivery records. | Phone numberHome addressFull name | Possible leak | |
| 2026.04.24 | Unconfirmed | B | 株式会社キャネットUnlisted 10,981 people | Customers' My Page login information was exposed; the company announced that IDs and passwords may have been leaked for 10,981 users. | User / member IDPassword | Possible leak | |
| 2026.04.21 | Unconfirmed | S | エスペック株式会社東証プライム 6859・エスペック 1 accounts | An employee's email account was accessed without authorization, suspicious emails were sent, and contacts' email addresses and signature information may have been viewed. | Email addressAuth tokenFull name | Possible leak | |
| 2026.04.14 | Unconfirmed | B | イビデン株式会社東証プライム 4062・イビデン Unknown | A website outage occurred; services were provisionally restored by 4月13日22時, but some functions remained restricted. | Possible leak | ||
| 2026.04.10 | Unconfirmed | S | UPSIDER（悪意あるOSS経由の侵害）Unlisted Unknown | Unauthorized access occurred via an open-source software contaminated with a malicious program, and card payments and logins were suspended from April 1 3:40 to 10:49. | User / member ID | Possible leak | |
| 2026.04.09 | Unconfirmed | B | 日本郵船株式会社東証プライム 9101・日本郵船 Unknown | Some data, including personal information, were taken from the ship fuel procurement system; names and contact details of current and former employees and vendor employees may have been affected, but the number of affected individuals has not been disclosed. | Email addressPhone numberFull name | Partial leak confirmed | |
| 2026.04.08 | 2026.01.26 | B | エフワンUnlisted 170,000 records | It was determined that about 170,000 personal information records were leaked in a ransomware attack, and the names, employers, etc. of 131 customers of business partners may also be affected. | Full name | Possible leak | |
| 2026.04.08 | Unconfirmed | B | 株式会社システムソフト東証スタンダード 7527・システムソフト Unknown | A ransomware incident occurred at subsidiary マムクリエイト, encrypting internal servers; data exfiltration has not been confirmed. | Possible leak | ||
| 2026.04.07 | 2026.03.31 | B | 株式会社トーホー東証プライム 8142・トーホー 1 people | It was announced that the email account of 1 employee was misused. There is no information on the number of affected records. | Email addressUser / member ID | Possible leak | |
| 2026.04.06 | Unconfirmed | B | リゾナスフェイスクリニック東京Non-profit corporation 369 people | We have confirmed that personal information of 369 patients was unlawfully obtained due to a ransomware attack on a cloud server. | Leak confirmed | ||
| 2026.04.01 | Unconfirmed | A | ウエーブ（Webアップロード）Unlisted 176,810 records | Up to 176,810 names, email addresses, customer IDs, and print submission data and estimate/quotation documents may have been exposed. No traces of external transfer or database access have been confirmed. | Email addressUser / member IDFull name | Possible leak | |
| 2026.03.31 | 2026.01.27 | A | 消費者庁Government / public body 8 people | Erroneously sent the names, dates of birth, Individual Numbers, and salary payment amounts etc. of 8 staff members to another municipality, and carried out invalidation procedures etc. via el-tax. | Identity verification dataFull nameDate of birth | Leak confirmed | |
| 2026.03.31 | Unconfirmed | B | マイナビ（利用クラウド）Unlisted 74,224 records | There is a risk of leakage of names, emails, addresses, etc. for 74,224 general users, 21,609 corporate contacts, and 15,672 employees. Card numbers and My Number (national ID) are reported not to be included. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.03.30 | 2025.02.01 | B | 埼玉大学（特許管理システム KEMPOS / 委託先：株式会社ネットワークス）Government / public body 1,516 people | A server of the patent management system managed by the contractor may have been externally accessible due to unauthorized access, and the names, affiliated organization names, addresses, etc., of a total of 1,516 people — including inventors and representative patent attorneys — may have been affected. | Full nameHome address | Possible leak | |
| 2026.03.27 | 2025.11.27 | S | ゼットン（forty three旧メール）Unlisted 18,553 records | They disclosed that unauthorized access to two old email accounts may have resulted in the exposure of 18,553 customers' information. | Email addressAuth tokenPhone numberHome addressFull nameHealth & medical data | Partial leak confirmed | |
| 2026.03.26 | Unconfirmed | S | 株式会社JEMSUnlisted 223 records | Unauthorized sign-ins to employee email resulted in illicit access from overseas, and 223 phishing emails were sent externally. The number of affected individuals is unknown. | Auth token | Partial leak confirmed | |
| 2026.03.26 | Unconfirmed | S | ザイナス（ジョイフル従業員・求職者等）Unlisted 23,585 people | A server being prepared for transfer was illegally accessed, potentially exposing information of ジョイフル employees, job applicants, etc.; 23,585 individuals were reported affected. | User / member IDCard & payment dataHome addressFull nameDate of birthHealth & medical data | Possible leak | |
| 2026.03.26 | 2026.03.01 | B | 白梅豊岡病院・白梅豊岡ケアホームNon-profit corporation Unknown | They announced that internal hospital systems, including electronic medical records, were infected with ransomware and became inaccessible. The number of affected individuals is not listed in the published materials. | Partial leak confirmed | ||
| 2026.03.24 | Unconfirmed | B | 株式会社サインド東証グロース 4256・サインド Unknown | Unauthorized access to the 美容サロン向けサービス「BeautyMerit」 was detected; after detection on 3月10日 the intrusion route was blocked and the service remains available as normal, but a data leak is indicated as a potential risk. | Email addressPhone numberFull name | Possible leak | |
| 2026.03.23 | 2025.12.18 | S | CAC（Academic Support Navi）東証プライム 4725・CAC Holdings Unknown | Unauthorized access to "Academic Support Navi" caused the service to be suspended for about 3 months; resumption is being carried out sequentially from 2026-03-23. A data leak is indicated as a possibility. | Email addressHome addressFull nameDate of birth | Possible leak | |
| 2026.03.23 | Unconfirmed | B | オーミケンシ株式会社東証スタンダード 3111・オーミケンシ Unknown | Following an investigation into the March 16 system outage, it was disclosed that unauthorized access by a third party was confirmed, but the number of affected records is not stated. | Possible leak | ||
| 2026.03.19 | Unconfirmed | S | 株式会社ホテルプリンセス京都Unlisted Unknown | The company reported that an Expedia administrator account was misused and fake messages asking bookers to enter card information were sent, but the number of affected individuals and incidents has not been disclosed. | Phone numberFull name | Partial leak confirmed | |
| 2026.03.19 | Unconfirmed | B | マツダ（タイ部品倉庫管理）東証プライム 7261・マツダ 692 records | It has been reported that the names, work emails, user IDs, affiliated companies, etc. of 692 employees may have been exposed. Information on general customers is excluded. | Email addressUser / member IDFull name | Possible leak | |
| 2026.03.18 | Unconfirmed | B | 国際武道大学（委託先ネットワーク）Non-profit corporation 120 people | Due to unauthorized access to an IT maintenance contractor, names, contact information, and other data of approximately 120 people who took caregiving experience courses in fiscal 2019 were leaked. | User / member IDPhone numberHome addressFull nameDate of birth | Leak confirmed | |
| 2026.03.18 | 2026.03.17 | C | NHKGovernment / public body 32,940 people | Due to a business email misdelivery, email addresses of 15,199 NHK employees and staff, 9,188 people from related organizations, and 8,553 external contractors, totaling 32,940 people, were visible to other recipients. | Email address | Leak confirmed | |
| 2026.03.16 | Unconfirmed | A | ニッタイ工業（エヌ・トレーディング）Unlisted 3,887 accounts | Unauthorized access to an online shopping site may have exposed names, addresses, dates of birth, purchase histories, etc., of 3,887 members, and the site was closed. | Email addressPasswordPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.03.16 | Unconfirmed | B | 岩谷産業株式会社東証プライム 8088・岩谷産業 Unknown | They announced that unauthorized access to some systems of the company and its group companies was confirmed, but the scope of the impact and the number of affected cases are not stated. | Possible leak | ||
| 2026.03.16 | 2026.01.04 | B | 株式会社ユナイテッドアローズ東証プライム 7606・ユナイテッドアローズ 10,000 people | A former employee removed electronic data, including transaction-partner lists for 約1万人分, from a cloud service. The data included contact information such as names, employers, departments, phone numbers, email addresses, and business office addresses. | Full namePhone numberEmail addressHome address | Leak confirmed | |
| 2026.03.11 | 2026.03.10 | S | 日本スウェージロックFSTUnlisted Unknown | From March 10, phones, email, and FAX were unavailable, halting all operations such as order processing and shipping. They have disclosed being affected by ransomware. | Email addressPhone number | Possible leak | |
| 2026.03.06 | Unconfirmed | A | ホワイトエッセンス（メグリー）Unlisted Unknown | The company disclosed that due to unauthorized access to a job site for dental hygienists, registrants' contact information, employment history, qualifications, and login information may have been exposed, but the number of affected individuals is not specified. | Email addressUser / member IDPasswordPhone numberHome addressFull name | Possible leak | |
| 2026.03.06 | 2025.12.18 | B | 株式会社マリモホールディングスUnlisted 1,360 people | It was announced that employee information was illicitly obtained via phishing that impersonated executives, and approximately 1360 employees were affected. | Email addressUser / member IDFull name | Leak confirmed | |
| 2026.03.06 | Unconfirmed | B | 株式会社OAGコンサルティンググループUnlisted Unknown | Unauthorized access to employees' Chatwork accounts was confirmed, along with messages impersonating employees and the sending of suspicious URLs; the number of affected records has not been disclosed. | User / member ID | Possible leak | |
| 2026.03.04 | 2026.01.23 | B | アドバンテスト東証プライム 6857・アドバンテスト Unknown | It is reported that data including personal information was taken from the server; they say they will notify each affected person of the specific items individually, but the number of people and the scope of items remain undetermined. | Possible leak | ||
| 2026.03.03 | 2024.07.31 | C | 金原出版株式会社Unlisted 160 records | A test file was published in the production environment, making 160 email addresses and nicknames externally viewable, and 7 external accesses have been confirmed. | Email address | Possible leak | |
| 2026.03.02 | Unconfirmed | B | トンボ飲料Unlisted Unknown | They disclosed that supplier bank account information may have been exposed due to a ransomware attack on some servers, but no traces of additional unauthorized access or data leakage have been confirmed. | Card & payment data | Possible leak | |
| 2026.03.02 | Unconfirmed | B | 薬日本堂株式会社（委託先メールサービス）Unlisted Unknown | The company announced that unauthorized access to the spam email filtering service may have allowed a third party to view addresses and contents of quarantined emails, but the number of affected people and incidents has not been disclosed. | Email address | Possible leak | |
| 2026.02.27 | 2026.01.29 | A | 日本医科大学武蔵小杉病院Non-profit corporation 130,000 people | Approximately 130,000 patients' names, addresses and other basic information were publicly exposed. Leakage of medical-record information has not been confirmed and medical services are continuing. | Home addressFull nameDate of birth | Leak confirmed | |
| 2026.02.26 | Unconfirmed | B | 株式会社じほうUnlisted 890 records | An unauthorized login to a specific cloud mail account resulted in phishing emails being sent to entries in the address book; it was disclosed that 890 email addresses were affected. | Email address | Possible leak | |
| 2026.02.20 | Unconfirmed | B | 山藤三陽印刷株式会社Unlisted Unknown | The server was hit by a ransomware attack; whether data was leaked is currently under investigation, and the number of affected individuals/records has not been disclosed. | Possible leak | ||
| 2026.02.19 | 2025.10.01 | S | 美濃工業株式会社Unlisted Unknown | They publicly stated that some servers and endpoints were encrypted in a cyberattack and that personal information of employees and others may have been exposed, but specific confirmation of data leakage or the number of affected records has not been disclosed. | Email addressHome addressFull nameDate of birthHealth & medical data | Possible leak | |
| 2026.02.17 | 2026.01.22 | S | アットホーム（引越し見積もり）Unlisted 408 records | Unauthorized login to the estimate management system was detected, and because contact information for 408 users may have been exposed, the estimate service was temporarily suspended. | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.02.17 | Unconfirmed | B | 独立行政法人 エネルギー・金属鉱物資源機構Government / public body 2,246 people | It was discovered that a former JOGMEC employee had taken the names of 2,246 mining rights holders outside while employed. | Full name | Leak confirmed | |
| 2026.02.13 | Unconfirmed | S | BEENOS株式会社Unlisted↗ LINEヤフー 4689 Unknown | Unauthorized access to セカイモン led to suspension of all services, and information on members, purchasers, employees, and warehouse staff may have been accessed. | Email addressUser / member IDPasswordCard & payment dataPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.02.13 | Unconfirmed | B | 道路工業株式会社Unlisted Unknown | They published the results of an investigation into unauthorized access to a file-sharing server and state there is a risk that business partner information may have been leaked. | Email addressPhone numberFull name | Possible leak | |
| 2026.02.13 | Unconfirmed | B | 株式会社西山製作所Unlisted Unknown | They have disclosed unauthorized access to their internal network, and the details of the impact are under investigation. Whether any information was leaked has not been confirmed. | Possible leak | ||
| 2026.02.12 | Unconfirmed | A | 株式会社ガーラ湯沢Unlisted↗ ガーラ 4777 1,518 people | They confirmed ransomware damage causing a ticket-issuing system outage and say up to 1,518 individuals' information may have been leaked. | Phone numberHome addressFull name | Possible leak | |
| 2026.02.12 | Unconfirmed | B | フィーチャ株式会社東証グロース 4052・フィーチャ Unknown | File encryption on the server was discovered; impacts are under investigation, including potential external disclosure of personal and customer data. | Possible leak | ||
| 2026.02.05 | Unconfirmed | A | アデコ株式会社Unlisted Unknown | It was announced that email accounts for the freelance business were accessed without authorization and emails were sent at random. | Email addressUser / member ID | Possible leak | |
| 2026.01.30 | 2025.12.02 | S | 静岡市Government / public body 3,950 people | Materials containing names, addresses, and phone numbers of 3,950 welfare recipients etc. were leaked; some materials included sensitive information such as My Number and disease names, and personal information of two depot employees was also disclosed. | Full nameHome addressPhone numberUser / member IDHealth & medical data | Leak confirmed | |
| 2026.01.30 | Unconfirmed | B | 株式会社インテグラル東証グロース 5842・インテグラル 5,441 records | A file that forwards data externally was placed on the site, and some sites were temporarily closed. The affected information totals up to 5,441 records (3 sites). | Email addressPhone numberHome addressFull name | Possible leak | |
| 2026.01.29 | 2026.01.06 | A | カンバスUnlisted Unknown | マイページ handling licenses etc. was suspended; temporary tickets were issued manually and it was restored on January 14. There was no impact on the core system. | Possible leak | ||
| 2026.01.28 | Unconfirmed | S | 株式会社山元紙包装社Unlisted 3,973 people | They announced that unauthorized access to パッケージショップJP may have exposed personal data of 3,973 individuals and card information of 1,395 individuals. | Email addressPasswordCard & payment dataPhone numberFull name | Possible leak | |
| 2026.01.27 | 2026.01.13 | S | ソフトバンク（回線認証・メッセージ）東証プライム 9434・ソフトバンク Unknown | A defect in authentication processing caused incidents such as My SoftBank displaying other users' information; disclosed were 2,019 display errors, 2,209 MMS sender replacements, and 2,241 cases of +メッセージ being able to send/receive, among others. | Phone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.01.26 | Unconfirmed | S | インテリックス（ジャストカーテン）東証スタンダード 463A・インテリックスホールディングス 60,663 people | Card information for 10,423 individuals and customer information for 60,663 individuals may have been exposed. The customer information is said to include email addresses and passwords. | Email addressPasswordCard & payment dataPhone numberHome addressFull nameDate of birth | Possible leak | |
| 2026.01.22 | Unconfirmed | A | 株式会社シンシア東証スタンダード 7782・シンシア Unknown | A system outage discovered on January 18 may have involved unauthorized access; the network was isolated, affecting order-receiving and ordering operations, but operations are being resumed sequentially. | Possible leak | ||
| 2026.01.21 | 2025.11.04 | S | 株式会社コバヤシUnlisted 8,149 records | 8,149 personal information records held by our company were illegally obtained and published on an external website; these included names, addresses, dates of birth, contact details of applicants, sole proprietors, employees, etc., and sensitive data such as bank account numbers, passport numbers, and Basic Pension Numbers. | Full nameHome addressDate of birthPhone numberEmail addressUser / member IDIdentity verification data | Leak confirmed | |
| 2026.01.21 | Unconfirmed | S | STNet（専用ネットワーク）Unlisted↗ 四国電力 9507 20,846 people | It has been reported that the names and contact details of 20,846 personnel, and IDs and passwords for customer systems, may have been leaked from a dedicated network. | Email addressUser / member IDPasswordPhone numberFull nameDate of birth | Possible leak | |
| 2026.01.21 | 2025.11.27 | B | 株式会社cocoloniUnlisted Unknown | They reported there was unauthorized access from 2025-11-27 to 2025-12-13, and on 2025-12-13 they became aware of the leakage of email addresses and encrypted passwords. | Email addressPassword | Leak confirmed | |
| 2026.01.19 | Unconfirmed | A | 一般社団法人学校図書館図書整備協会Non-profit corporation Unknown | Since January 7 the 協会 website has been unavailable; they announced a high likelihood of an attack including ransomware, suspended various web functions, and are proceeding with recovery. | Possible leak | ||
| 2026.01.19 | 2025.10.17 | B | JR九州グループUnlisted↗ 九州旅客鉄道 9142 14,638 people | Names, company names, work emails, PC login IDs, etc. of 14,638 current and former employees may have been exposed. | Email addressUser / member IDFull name | Possible leak | |
| 2026.01.14 | Unconfirmed | B | ENEOSグローブエナジー株式会社Unlisted 1,300 records | It was reported that approximately 1,300 customer records may have been leaked at a delivery subcontractor, creating a risk of impersonation and fraudulent use. | Phone numberHome addressFull name | Possible leak | |
| 2026.01.09 | Unconfirmed | B | サカイサイクル（サイクルヒーロー）Unlisted Unknown | They disclosed that member data they held was leaked due to unauthorized access to an external app linked with the POS; the scope is under investigation. | Partial leak confirmed | ||
| 2026.01.08 | 2025.12.02 | S | 東京都立大学（教員のGoogleアカウント）Government / public body 423 records | Published a second report on unauthorized access to a Googleアカウント acquired privately by a faculty member. The disclosed impact is events etc. 180 + entrance exams etc. 249 − duplicates 6 = actual 423 cases. | Email addressUser / member IDAuth tokenPhone numberHome addressFull name | Partial leak confirmed | |
| 2026.01.08 | 2025.12.22 | A | 沖縄県立看護大学（教務支援システム）Government / public body Unknown | The academic affairs support system was encrypted by ransomware and went offline. Leakage of student information has not been confirmed, but it cannot be ruled out. | Possible leak | ||
| 2026.01.08 | Unconfirmed | B | 株式会社スマレジ東証グロース 4431・スマレジ Unknown | In certain third-party apps integrated with スマレジ, it was found that member data held by the app providers was improperly acquired and disclosed; no leak from スマレジ itself has been confirmed. | Possible leak | ||
| 2026.01.07 | 2026.01.07 | A | 興和江守Unlisted Unknown | Ransomware caused delays in order processing and shipping and suspended email use; operations were substituted by phone and fax and were stable as of April 27. No clear signs of external data exfiltration have been confirmed. | Email addressPhone number | Possible leak | |
| 2026.01.06 | Unconfirmed | B | みずほリース株式会社東証プライム 8425・みずほリース 1 records | They announced that on 2025年12月14日 they detected and blocked unauthorized access to part of their systems. The disclosed impact is 投資事業管理サーバー1台. | Possible leak | ||
| 2025.12.24 | Unconfirmed | B | 横須賀学院Non-profit corporation Unknown | It was found that, due to a ransomware attack, some personal information stored on the server (excluding photos and videos) was leaked, and students, parents, and alumni may be subject to secondary harm such as fraudulent contact or bogus billing. | Partial leak confirmed | ||
| 2025.12.23 | 2025.06.23 | SS | 富士フイルムメディカル株式会社Unlisted↗ 富士フイルムホールディングス 4901 590,000 people | Due to unauthorized external access, personal data of 約59万人分 of medical professionals and sales business employees may have been leaked; because it includes names, contact details, birth information, etc., there is a risk of secondary harm such as impersonation or suspicious contact. | Full namePhone numberEmail addressDate of birthHome addressUser / member IDPassword | Possible leak | |
| 2025.11.17 | 2025.10.16 | S | 白山石川医療企業団 公立つるぎ病院Government / public body 19 people | The names and hygiene-care instructions of 19 patients were published in a monthly magazine, and it was reported that the hospitalization fact and the published content may lead to misuse. | Full nameHealth & medical data | Leak confirmed | |
| 2025.10.31 | Unconfirmed | B | アスクル株式会社東証プライム 2678・アスクル Unknown | Due to a ransomware attack, some files on the server were leaked externally; it was reported that these may include corporate and consumer e‑commerce inquiry contact information and supplier information (names, email addresses, phone numbers, etc.). | Email addressPhone numberFull name | Leak confirmed |