Public disclosures

Japan breach tracker

I keep a row for each organization that has published a notice about a cyber incident in Japan. The figures on this page are counts and sums of that sheet.

For the supplier view of the same disclosures, see the vendor breach map of Japan supply chain cyberattacks.

How the counts work

Incident count is the number of rows. Organizations affected is the number of disclosing organizations, one per row. A vendor notice can name a larger set of companies. When it does, that stated count is shown on the vendor chart and is not added on top of the row count.

Records affected add the numeric headline figure on rows marked Yes in the dedupe column. Rows marked No are left out, because that column says those records are already counted on a vendor row. Blank figures are left out. They are not treated as zero. Last updated is the latest disclosure date written in the sheet.

Saved copy of the Incidents sheet, captured 16 October 2026. Source spreadsheet (opens in a new tab)

At a glance

145

Incidents

Rows in the sheet

145

Organizations affected

Disclosing organizations, one per row

141,598,617

Records affected

Headline figures from 80 rows marked Yes

15 October 2026

Last updated

Latest disclosure date

Charts

Disclosures by week

Week starting Monday, from the sheet's disclosure week column.

  • 1 31 Aug
  • 6 7 Sep
  • 9 14 Sep
  • 7 21 Sep
  • 30 28 Sep
  • 60 5 Oct
  • 32 12 Oct

By sector

Industry group from the sheet.

  • Government / public sector 23
  • IT / internet / SaaS 17
  • Corporate community sites 14
  • Retail / e-commerce 14
  • Transport / logistics 14
  • Manufacturing / construction / utilities 13
  • Media / entertainment 12
  • Education / research 10
  • Finance / insurance 8
  • Travel / hospitality / leisure 8
  • Restaurant / food service 6
  • Healthcare / pharma 5
  • Other 1

By attack type

Normalized attack type from the sheet.

  • Unauthorized access (method undisclosed) 99
  • Account / email compromise 16
  • Ransomware 15
  • Vulnerability / API / app-flaw exploit 12
  • BEC / payment fraud 1
  • Malware (contractor PC) 1
  • Outage (vendor incident) 1

Vendor hubs

Bar length uses a stated organization count when the sheet gives one. Otherwise it counts tracked rows in that vendor chain. IDC Frontier states 495 companies and local governments affected. Scala Communications states up to 5 client companies. 25 rows name a vendor outside these hubs and stay in the table.

  • IDC Frontier

    495 companies and local governments affected

    10 rows in this sheet. 6,505,000 records in the deduped total.

  • Arcadia

    12 tracked rows

    3,136,000 records in the deduped total.

  • Commune

    7 tracked rows

    307,000 records in the deduped total.

  • Scala Communications

    up to 5 client companies

    4 rows in this sheet. 713,126 records in the deduped total.

  • ApplyNow

    3 tracked rows

    7,192 records in the deduped total.

  • Temairazu

    2 tracked rows

    4,450,000 records in the deduped total.

  • Sakura Internet

    1 tracked rows

    No deduped record figure for this hub.

Latest

  1. 15 October 2026

    Burger King Japan (BK Japan / ビーケー・ジャパン)

    ~11.18M

    Unauthorized access (method undisclosed) · Restaurant / food service

  2. 15 October 2026

    Medley (メドレー) - @link

    Not disclosed

    Unauthorized access (method undisclosed) · Healthcare / pharma

  3. 15 October 2026

    SourceNext (ソースネクスト)

    22,519,960

    Vulnerability / API / app-flaw exploit · IT / internet / SaaS

  4. 14 October 2026

    Aena (アエナ)

    Up to 817,215

    Unauthorized access (method undisclosed) · Retail / e-commerce

  5. 14 October 2026

    Hakuhodo DY ONE

    ~1,940

    Unauthorized access (method undisclosed) · Corporate community sites

  6. 14 October 2026

    Izumi (イズミ, ゆめタウン)

    Up to ~400,000

    Ransomware · Retail / e-commerce

Incidents

145 of 145 shown

Disclosed incidents from the sheet
Organization Disclosed Sector Attack type Records Sources
Burger King Japan (BK Japan / ビーケー・ジャパン) 15 October 2026 Restaurant / food service Unauthorized access (method undisclosed) ~11.18M
Details for Burger King Japan (BK Japan / ビーケー・ジャパン)
System
Official app member management system
Industry
Restaurant (fast food)
Attack window
2026-10-02 to 2026-10-07
Discovered
13 October 2026
Third party
Unknown
Vendor
Unknown
Vendor link
Unknown
Data exposed
Member ID, email, registration type, prefecture, gender, birthdate, name (kanji/kana), phone, mobile order flag, email verified flag. No card data stored; no password leak confirmed
Status
Investigating with outside specialists; reported to PPC; no secondary damage confirmed (TV Asahi)
Notes
High (official notice). INFERENCE ONLY, not linked to breach: site uses bizMOB Xross 4.0 framework (Mobile C&C, Seoul); privacy policy allows transfer to unnamed third party in South Korea
Medley (メドレー) - @link 15 October 2026 Healthcare / pharma Unauthorized access (method undisclosed) Not disclosed
Details for Medley (メドレー) - @link
System
@link app, web reservation and peripheral services
Industry
Healthcare IT (OB/GYN system)
Attack window
Unknown
Discovered
11 October 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Patient info possibly
Status
Service suspended from Oct 15 00:00 JST; hospitals affected
Notes
High
Attacker claims
Not reported in sources
SourceNext (ソースネクスト) 15 October 2026 IT / internet / SaaS Vulnerability / API / app-flaw exploit 22,519,960
Details for SourceNext (ソースネクスト)
System
Member information management system (member info retrieval API)
Industry
Software
Attack window
From 2026-10-09 ~10:00 JST; contained 2026-10-13 13:36
Discovered
13 October 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Email, PASSWORD, name (+kana), address, gender, phone, fax, birthdate, company/title/dept, system IDs. No card data
Status
Contained; investigating
Notes
High (official notice). Passwords included - credential-stuffing risk
Aena (アエナ) 14 October 2026 Retail / e-commerce Unauthorized access (method undisclosed) Up to 817,215
Details for Aena (アエナ)
System
E-commerce app member pages
Industry
Retail (discount cosmetics/food)
Attack window
Unknown
Discovered
13 October 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Name, address, birthdate, phone, card last 4 digits, cardholder name
Status
E-commerce site access blocked; no misuse confirmed
Notes
Medium-High (single news source)
Hakuhodo DY ONE 14 October 2026 Corporate community sites Unauthorized access (method undisclosed) ~1,940
Details for Hakuhodo DY ONE
System
Freelancer community DIGIFUL BASE
Industry
Various (community site)
Attack window
~2026-10-05/06
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Commune
Vendor link
Confirmed
Data exposed
Email, member info
Status
Unknown
Notes
Downstream of Commune
Attacker claims
Not reported in sources
Izumi (イズミ, ゆめタウン) 14 October 2026 Retail / e-commerce Ransomware Up to ~400,000
Details for Izumi (イズミ, ゆめタウン)
System
Online shopping/delivery members - mail magazine contractor on IDCF cloud
Industry
Retail
Attack window
2026-10-07
Discovered
Unknown
Third party
Yes (via third party)
Vendor
IDC Frontier (via mail magazine contractor)
Vendor link
Confirmed
Data exposed
Name, email. No address/phone/card
Status
Unknown
Notes
High
Attacker claims
Not reported in sources
MIXI 14 October 2026 Corporate community sites Unauthorized access (method undisclosed) 750
Details for MIXI
System
Kotodaman official community
Industry
Various (community site)
Attack window
~2026-10-05/06
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Commune
Vendor link
Confirmed
Data exposed
Email, member info
Status
Unknown
Notes
Downstream of Commune
Attacker claims
Not reported in sources
Arcadia (アルカディア, Minoh, Osaka) 13 October 2026 Government / public sector Unauthorized access (method undisclosed) Up to ~3,136,000 emails, ~105,000 phones, ~15,000 fax numbers (+ contact names & stored message bodies); separate fire system ~120K
Details for Arcadia (アルカディア, Minoh, Osaka)
System
Bulk notification service "SpeeCAN RAIDEN" (and school service "Raiden School"); plus separate disaster system for fire staff/volunteer fire corps
Industry
IT services (disaster alert email for local governments)
Attack window
Suspicious behaviour seen 2026-10-11 16:30 JST; entry path patched ~03:00 Oct 12; path identified Oct 13
Discovered
11 October 2026
Third party
Vendor itself
Downstream victims
111 local governments etc. affected (MIC, Oct 14 17:00); SpeeCAN RAIDEN reportedly used by ~700 municipalities (Digital Agency data via ITmedia). See individual municipality rows
Data exposed
Email, phone, names (some), staff names/affiliations
Status
Mail services suspended; phishing impersonating card companies already sent to leaked Yokosuka addresses
Notes
High
Ayase City (綾瀬市) 13 October 2026 Government / public sector Unauthorized access (method undisclosed) ~11,000
Details for Ayase City (綾瀬市)
System
Disaster/safety alert email service (outsourced)
Industry
Local government
Attack window
2026-10-11
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Arcadia
Vendor link
Confirmed
Data exposed
Email, district
Status
Service suspended (where reported)
Notes
Downstream of Arcadia incident
Attacker claims
Not reported in sources
DCM Holdings - Mybo 13 October 2026 Retail / e-commerce Unauthorized access (method undisclosed) 419 (under review)
Details for DCM Holdings - Mybo
System
Member service 'Mybo'
Industry
Retail (home centers)
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Member number, point balance, email
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Fivot - IDARE 13 October 2026 Finance / insurance Unauthorized access (method undisclosed) 129,659
Details for Fivot - IDARE
System
IDARE service
Industry
Fintech (cashless)
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Email, address, card info etc.
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Gin no Sara (Rides On Express HD / ライドオンエクスプレス) 13 October 2026 Restaurant / food service Ransomware Up to ~6.5M
Details for Gin no Sara (Rides On Express HD / ライドオンエクスプレス)
System
Official sites/apps of Gin no Sara, Kamatora, Sushi Joto
Industry
Restaurant (sushi delivery)
Attack window
From 2026-10-05; outage from 2026-10-07
Discovered
5 October 2026
Third party
Yes (via third party)
Vendor
Unnamed contractor
Vendor link
Confirmed
Data exposed
Name, address, phone, email, family/delivery recipient names. No card data held (漏洩ナビ also lists password, DOB, purchase history)
Status
3 brands' sites and apps down
Notes
Medium-High (single news source)
Golf Digest Online (GDO) 13 October 2026 Retail / e-commerce Unauthorized access (method undisclosed) No PII leak confirmed
Details for Golf Digest Online (GDO)
System
Systems (coupons, delivery)
Industry
E-commerce / golf
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Unknown
Status
Investigating
Notes
Single secondary source
Attacker claims
Not reported in sources
Hadano City (秦野市) 13 October 2026 Government / public sector Unauthorized access (method undisclosed) Unknown
Details for Hadano City (秦野市)
System
Disaster/safety alert email service (outsourced)
Industry
Local government
Attack window
2026-10-11
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Arcadia (implied)
Vendor link
Suspected
Data exposed
Unknown
Status
Service suspended (where reported)
Notes
TV Asahi: 'similar service' affected; Downstream of Arcadia incident
Attacker claims
Not reported in sources
JR Central (JR東海) 13 October 2026 Transport / logistics Ransomware ~15,000
Details for JR Central (JR東海)
System
JR東海MARKET, いいもの探訪 e-commerce
Industry
Rail / e-commerce
Attack window
2026-10-07
Discovered
Unknown
Third party
Yes (via third party)
Vendor
IDC Frontier
Vendor link
Confirmed
Data exposed
Name, address, phone, email, purchase history. No card/password
Status
Unknown
Notes
High
Attacker claims
Not reported in sources
JR Kyushu Food Service (JR九州フードサービス) 13 October 2026 Restaurant / food service Unauthorized access (method undisclosed) ~26,900
Details for JR Kyushu Food Service (JR九州フードサービス)
System
Customer-management app (provider)
Industry
Restaurant
Attack window
Unknown
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed app provider
Vendor link
Confirmed
Data exposed
Name, email, address, phone, DOB, member ID
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Kamitonda Town (上富田町) 13 October 2026 Government / public sector Unauthorized access (method undisclosed) Unknown
Details for Kamitonda Town (上富田町)
System
Disaster/safety alert email service (outsourced)
Industry
Local government
Attack window
2026-10-11
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Arcadia (SpeeCAN RAIDEN)
Vendor link
Confirmed
Data exposed
Name, email
Status
Service suspended (where reported)
Notes
Downstream of Arcadia incident
Attacker claims
Not reported in sources
Kitahiroshima City (北広島市) 13 October 2026 Government / public sector Unauthorized access (method undisclosed) 7
Details for Kitahiroshima City (北広島市)
System
Disaster/safety alert email service (outsourced)
Industry
Local government
Attack window
2026-10-11
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Arcadia
Vendor link
Confirmed
Data exposed
Name, address, phone, DOB
Status
Service suspended (where reported)
Notes
Downstream of Arcadia incident
Attacker claims
Not reported in sources
Kyotango City (京丹後市) 13 October 2026 Government / public sector Unauthorized access (method undisclosed) Unknown
Details for Kyotango City (京丹後市)
System
Disaster/safety alert email service (outsourced)
Industry
Local government
Attack window
2026-10-11
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Arcadia
Vendor link
Confirmed
Data exposed
Name, email, phone, infant DOB, staff info
Status
Service suspended (where reported)
Notes
Downstream of Arcadia incident
Attacker claims
Not reported in sources
Maebashi City (前橋市) 13 October 2026 Government / public sector Unauthorized access (method undisclosed) Unknown
Details for Maebashi City (前橋市)
System
Disaster/safety alert email service (outsourced)
Industry
Local government
Attack window
2026-10-11
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Arcadia
Vendor link
Confirmed
Data exposed
Name, email, phone, staff info
Status
Service suspended (where reported)
Notes
Downstream of Arcadia incident
Attacker claims
Not reported in sources
Mima City (美馬市) 13 October 2026 Government / public sector Unauthorized access (method undisclosed) 328 registrants
Details for Mima City (美馬市)
System
Disaster/safety alert email service (outsourced)
Industry
Local government
Attack window
2026-10-11
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed vendor
Vendor link
Unknown
Data exposed
Name, email, phone
Status
Service suspended (where reported)
Notes
Downstream of Arcadia incident
Attacker claims
Not reported in sources
NEXT STAGE 13 October 2026 Manufacturing / construction / utilities Vulnerability / API / app-flaw exploit Up to ~40,000
Details for NEXT STAGE
System
Internal BI tool
Industry
Construction services
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Partner & certified auditor name, address, phone, email
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Oita Prefecture (大分県) 13 October 2026 Government / public sector Unauthorized access (method undisclosed) 27,667 emails + 10,269 staff records
Details for Oita Prefecture (大分県)
System
Disaster/safety alert email service (outsourced)
Industry
Local government
Attack window
2026-10-11
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Arcadia
Vendor link
Confirmed
Data exposed
Email; staff names/affiliations
Status
Service suspended (where reported)
Notes
New registration/access suspended; Downstream of Arcadia incident
Attacker claims
Not reported in sources
Okayama City (岡山市) 13 October 2026 Government / public sector Unauthorized access (method undisclosed) ~4,500 emails (+other counts)
Details for Okayama City (岡山市)
System
Disaster/safety alert email service (outsourced)
Industry
Local government
Attack window
2026-10-11
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed disaster info vendor
Vendor link
Unknown
Data exposed
Name, email, phone, staff info
Status
Service suspended (where reported)
Notes
Vendor not named in summary; Downstream of Arcadia incident
Attacker claims
Not reported in sources
Saitama City (さいたま市) 13 October 2026 Government / public sector Unauthorized access (method undisclosed) 34,783 emails
Details for Saitama City (さいたま市)
System
Disaster/safety alert email service (outsourced)
Industry
Local government
Attack window
2026-10-11
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Arcadia
Vendor link
Confirmed
Data exposed
Email, phone
Status
Service suspended (where reported)
Notes
Downstream of Arcadia incident
Attacker claims
Not reported in sources
Satsuma Town (さつま町) 13 October 2026 Government / public sector Unauthorized access (method undisclosed) Unknown
Details for Satsuma Town (さつま町)
System
Disaster/safety alert email service (outsourced)
Industry
Local government
Attack window
2026-10-11
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed safety-mail contractor
Vendor link
Unknown
Data exposed
Unknown
Status
Service suspended (where reported)
Notes
Downstream of Arcadia incident
Attacker claims
Not reported in sources
Shimonoseki City (下関市) 13 October 2026 Government / public sector Unauthorized access (method undisclosed) ~15,000 registered emails
Details for Shimonoseki City (下関市)
System
Disaster/safety alert email service (outsourced)
Industry
Local government
Attack window
2026-10-11
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed disaster-mail vendor
Vendor link
Unknown
Data exposed
Email etc.
Status
Service suspended (where reported)
Notes
Vendor not named in sources; Downstream of Arcadia incident
Attacker claims
Not reported in sources
Waki Town (和木町) 13 October 2026 Government / public sector Unauthorized access (method undisclosed) Unknown
Details for Waki Town (和木町)
System
Disaster/safety alert email service (outsourced)
Industry
Local government
Attack window
2026-10-11
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed disaster-mail vendor
Vendor link
Unknown
Data exposed
Email etc.
Status
Service suspended (where reported)
Notes
Downstream of Arcadia incident
Attacker claims
Not reported in sources
Yokosuka City (横須賀市) 13 October 2026 Government / public sector Unauthorized access (method undisclosed) 47,065 disaster-mail registrants (TV Asahi: up to ~60K people)
Details for Yokosuka City (横須賀市)
System
Disaster/safety alert email service (outsourced)
Industry
Local government
Attack window
2026-10-11
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Arcadia
Vendor link
Confirmed
Data exposed
Email, name, phone
Status
Service suspended (where reported)
Notes
Phishing posing as card company already received; Downstream of Arcadia incident
Attacker claims
Not reported in sources
Yoshinogari Town (吉野ヶ里町) 13 October 2026 Government / public sector Unauthorized access (method undisclosed) Unknown
Details for Yoshinogari Town (吉野ヶ里町)
System
Disaster/safety alert email service (outsourced)
Industry
Local government
Attack window
2026-10-11
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Arcadia
Vendor link
Confirmed
Data exposed
Email etc.
Status
Service suspended (where reported)
Notes
Downstream of Arcadia incident
Attacker claims
Not reported in sources
Zama City (座間市) 13 October 2026 Government / public sector Unauthorized access (method undisclosed) ~11,000
Details for Zama City (座間市)
System
Disaster/safety alert email service (outsourced)
Industry
Local government
Attack window
2026-10-11
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Arcadia
Vendor link
Confirmed
Data exposed
Email; staff names
Status
Service suspended (where reported)
Notes
Downstream of Arcadia incident
Attacker claims
Not reported in sources
Yamaha Motor (ヤマハ発動機) 12 October 2026 Corporate community sites Unauthorized access (method undisclosed) ~1,600
Details for Yamaha Motor (ヤマハ発動機)
System
YAMAHA PAS Life community
Industry
Various (community site)
Attack window
~2026-10-05/06
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed platform provider
Vendor link
Unknown
Data exposed
Email, member info
Status
Unknown
Notes
Timing matches Commune - unconfirmed
Attacker claims
Not reported in sources
Bandai Namco Experience 9 October 2026 Media / entertainment Unauthorized access (method undisclosed) Unknown
Details for Bandai Namco Experience
System
Wangan Midnight Arcade Portal
Industry
Entertainment
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Member info
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Book Off (ブックオフ) 9 October 2026 Retail / e-commerce Unauthorized access (method undisclosed) 6,383,279 members (final per 漏洩ナビ; initial 'up to ~6.43M')
Details for Book Off (ブックオフ)
System
Subsidiary's member management system
Industry
Retail (used goods)
Attack window
2026-10-06
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed subsidiary
Vendor link
Confirmed
Data exposed
Name, birthdate, address, phone, email, member number, hashed passwords (per ITmedia headline). No payment data
Status
No misuse confirmed
Notes
Medium-High (single news source)
Attacker claims
None found (no publication confirmed)
Coconala (ココナラ) 9 October 2026 Retail / e-commerce Unauthorized access (method undisclosed) 449 resumes + 1,845 career documents
Details for Coconala (ココナラ)
System
Coconala Skill Market
Industry
Online marketplace
Attack window
2026-10-08 02:05 & ~13:00 JST
Discovered
8 October 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Resumes / CV documents. No card/passwords
Status
Vulnerability fixed by 21:27 Oct 8; service continuing
Notes
High
Attacker claims
Not reported in sources
Commune (コミューン) 9 October 2026 IT / internet / SaaS Unauthorized access (method undisclosed) ~307,000 members (estimate)
Details for Commune (コミューン)
System
Commune / Commune for Work
Industry
SaaS (community platform)
Attack window
2026-10-05
Discovered
5 October 2026
Third party
Vendor itself
Downstream victims
Aomori Pref (2,950), LINE Yahoo DS.LAB (1,750), Sansan (1,325 / 8,687 possible), Panasonic (~2,000 LUMIX + ~3,000 Hair-sap), MIXI Kotodaman (750), Hakuhodo DY ONE (~1,940)
Data exposed
Email etc.
Status
All communities suspended
Notes
High
Attacker claims
Not reported in sources
Enecom (エネコム) 9 October 2026 IT / internet / SaaS Unauthorized access (method undisclosed) Unknown
Details for Enecom (エネコム)
System
Internal network
Industry
Telecom / IT
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Electronic files
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
JR East (JR東日本) - えきねっと / 大人の休日倶楽部 9 October 2026 Transport / logistics Ransomware Up to ~1.67M (えきねっと) + ~390K (大人の休日倶楽部)
Details for JR East (JR東日本) - えきねっと / 大人の休日倶楽部
System
Email delivery external service on IDCF cloud
Industry
Rail
Attack window
2026-10-07
Discovered
Unknown
Third party
Yes (via third party)
Vendor
IDC Frontier
Vendor link
Confirmed
Data exposed
Email; Otona no Kyujitsu: DOB, card expiry. No names/addresses/card numbers
Status
Unknown
Notes
High
Attacker claims
Not reported in sources
JR Kyushu (九州旅客鉄道) 9 October 2026 Transport / logistics Ransomware Up to ~1.3M emails at risk; later no leak confirmed
Details for JR Kyushu (九州旅客鉄道)
System
JR Kyushu Web members (email)
Industry
Rail
Attack window
2026-10-07
Discovered
Unknown
Third party
Yes (via third party)
Vendor
IDC Frontier
Vendor link
Confirmed
Data exposed
Email
Status
Investigation found no leak
Notes
Medium-High
Attacker claims
Not reported in sources
Kochi Prefecture (高知県) 9 October 2026 Corporate community sites Unauthorized access (method undisclosed) 358 (possible)
Details for Kochi Prefecture (高知県)
System
Tourism fan site 'Kochi no Chi'
Industry
Various (community site)
Attack window
~2026-10-05/06
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed platform
Vendor link
Unknown
Data exposed
Email, member info
Status
Unknown
Notes
Timing matches Commune - unconfirmed
Attacker claims
Not reported in sources
Koikeya (湖池屋) 9 October 2026 Corporate community sites Unauthorized access (method undisclosed) Up to 1,800
Details for Koikeya (湖池屋)
System
Fan site GOGO! Land
Industry
Various (community site)
Attack window
~2026-10-05/06
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed contractor
Vendor link
Unknown
Data exposed
Email, member info
Status
Unknown
Notes
Timing matches Commune - unconfirmed
Attacker claims
Not reported in sources
LINE Yahoo (LINEヤフー) 9 October 2026 Corporate community sites Unauthorized access (method undisclosed) 1,750 (possible)
Details for LINE Yahoo (LINEヤフー)
System
DS.LAB
Industry
Various (community site)
Attack window
~2026-10-05/06
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Commune
Vendor link
Confirmed
Data exposed
Email, member info
Status
Unknown
Notes
Downstream of Commune
Attacker claims
Not reported in sources
Panasonic (パナソニック) 9 October 2026 Corporate community sites Unauthorized access (method undisclosed) ~2,000 + ~3,000
Details for Panasonic (パナソニック)
System
LUMIX Community; Hair-sap
Industry
Various (community site)
Attack window
~2026-10-05/06
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Commune
Vendor link
Confirmed
Data exposed
Email, member info
Status
Unknown
Notes
Downstream of Commune
Attacker claims
Not reported in sources
Resorttrust (リゾートトラスト) 9 October 2026 Travel / hospitality / leisure Unauthorized access (method undisclosed) ~26,000 group members + ~36,000 Kahala Yokohama bookings
Details for Resorttrust (リゾートトラスト)
System
Managed websites
Industry
Hospitality
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Member / reservation info
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Sansan 9 October 2026 Corporate community sites Unauthorized access (method undisclosed) 1,325 leaked; 8,687 possible
Details for Sansan
System
Sansan User Forum
Industry
Various (community site)
Attack window
~2026-10-05/06
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Commune
Vendor link
Confirmed
Data exposed
Email, member info
Status
Unknown
Notes
Downstream of Commune
Attacker claims
Not reported in sources
Suzuki (スズキ) 9 October 2026 Corporate community sites Unauthorized access (method undisclosed) ~3,000
Details for Suzuki (スズキ)
System
Suzuki Village community site
Industry
Various (community site)
Attack window
~2026-10-05/06
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed community-site operator
Vendor link
Unknown
Data exposed
Email, member info
Status
Unknown
Notes
Same timing as Commune breach (Oct 5-6) - link not confirmed in sources
Attacker claims
Not reported in sources
View Card (ビューカード) 9 October 2026 Finance / insurance Ransomware ~4.03M emails
Details for View Card (ビューカード)
System
VIEW's NET member site - email delivery external service
Industry
Finance (credit card)
Attack window
2026-10-07
Discovered
Unknown
Third party
Yes (via third party)
Vendor
IDC Frontier
Vendor link
Confirmed
Data exposed
Email only
Status
Unknown
Notes
High
Attacker claims
Not reported in sources
Yamaha Corporation (ヤマハ) 9 October 2026 Corporate community sites Unauthorized access (method undisclosed) ~1,600
Details for Yamaha Corporation (ヤマハ)
System
Yamaha Network Engineers community
Industry
Various (community site)
Attack window
~2026-10-05/06
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed platform provider
Vendor link
Unknown
Data exposed
Email, member info
Status
Unknown
Notes
Timing matches Commune - unconfirmed
Attacker claims
Not reported in sources
ZENB JAPAN 9 October 2026 Corporate community sites Unauthorized access (method undisclosed) 897
Details for ZENB JAPAN
System
ZENB GARDEN community
Industry
Various (community site)
Attack window
~2026-10-05/06
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed external service
Vendor link
Unknown
Data exposed
Email, member info
Status
Unknown
Notes
Timing matches Commune - unconfirmed
Attacker claims
Not reported in sources
Aomori Prefecture (青森県) 8 October 2026 Corporate community sites Unauthorized access (method undisclosed) ~2,950
Details for Aomori Prefecture (青森県)
System
Tourism fan community 'Aomori Biiki'
Industry
Various (community site)
Attack window
~2026-10-05/06
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Commune
Vendor link
Confirmed
Data exposed
Email, member info
Status
Unknown
Notes
Downstream of Commune
Attacker claims
Not reported in sources
Daiichikosho (第一興商) 8 October 2026 Media / entertainment Malware (contractor PC) ~8.72M at risk (~8,631,000 customers + ~93K employees)
Details for Daiichikosho (第一興商)
System
Personal data handled by contractor
Industry
Entertainment (karaoke, Big Echo)
Attack window
Unknown
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed contractor
Vendor link
Confirmed
Data exposed
Name, birthdate, email, phone. No passwords
Status
No actual leak or misuse confirmed
Notes
High
FutureShop (フューチャーショップ) 8 October 2026 IT / internet / SaaS Ransomware Unknown
Details for FutureShop (フューチャーショップ)
System
Mail delivery service on IDCF Cloud
Industry
E-commerce platform
Attack window
2026-10-07
Discovered
Unknown
Third party
Yes (via third party)
Vendor
IDC Frontier
Vendor link
Confirmed
Data exposed
Recipient emails etc. stored on affected server
Status
Investigating whether data leaked
Notes
Single secondary source
Attacker claims
Not reported in sources
Hachijuni Nagano Bank (八十二長野銀行) 8 October 2026 Finance / insurance Account / email compromise 35 emails
Details for Hachijuni Nagano Bank (八十二長野銀行)
System
Employee email
Industry
Finance
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Email addresses
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Kodaira City (小平市), Tokyo 8 October 2026 Government / public sector Ransomware Unknown
Details for Kodaira City (小平市), Tokyo
System
City website (maintenance vendor's cloud platform)
Industry
Local government
Attack window
~2026-10-07
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed website maintenance vendor
Vendor link
Confirmed
Data exposed
Inquiry form data (name, email, address, phone) possibly
Status
Website down, no recovery timeline (Oct 10)
Notes
Medium. Cloud platform not named in sources (timing matches IDCF, unconfirmed)
Attacker claims
Not reported in sources
Lawson (ローソン) 8 October 2026 Retail / e-commerce Unauthorized access (method undisclosed) 2,155,345 (Lawson ID) + 26 (Lawson app reservation)
Details for Lawson (ローソン)
System
Lawson ID & Lawson app reservation
Industry
Retail (convenience store)
Attack window
Mid-September 2026
Discovered
7 October 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Name, email, address, phone, partial credit card number
Status
App reservation suspended; notifying affected users
Notes
Medium-High (single news source)
Nissui / Nissui Logistics (日水物流) 8 October 2026 Transport / logistics Ransomware No PII on affected servers
Details for Nissui / Nissui Logistics (日水物流)
System
Logistics system on IDCF cloud
Industry
Food / logistics
Attack window
2026-10-07
Discovered
7 October 2026
Third party
Yes (via third party)
Vendor
IDC Frontier
Vendor link
Confirmed
Data exposed
None
Status
Partial restart Oct 9; full recovery expected week of Oct 19 via new system on another vendor
Notes
High
Attacker claims
Not reported in sources
NTT Docomo - kids web-filtering feature 8 October 2026 IT / internet / SaaS Outage (vendor incident) N/A
Details for NTT Docomo - kids web-filtering feature
System
Children's site-restriction feature
Industry
Telecom
Attack window
2026-10-07~
Discovered
Unknown
Third party
Yes (via third party)
Vendor
IDC Frontier (implied by TV Asahi)
Vendor link
Suspected
Data exposed
None reported
Status
Feature unavailable
Notes
Medium - TV Asahi mentions in context of IDCF impact
Attacker claims
Not reported in sources
ORIX Life Insurance (オリックス生命) 8 October 2026 Finance / insurance Unauthorized access (method undisclosed) ~26,500
Details for ORIX Life Insurance (オリックス生命)
System
Inquiry management (outsourced)
Industry
Insurance
Attack window
Unknown
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed inquiry-management contractor
Vendor link
Confirmed
Data exposed
Name, address, policy number; health/medical info possibly
Status
Unknown
Notes
Single secondary source. Contractor not named; may be Scala (unconfirmed)
Attacker claims
Not reported in sources
Rakko (ラッコ) 8 October 2026 IT / internet / SaaS Vulnerability / API / app-flaw exploit 100
Details for Rakko (ラッコ)
System
Payment service production API
Industry
IT (SEO tools)
Attack window
Unknown (first report Aug 2026)
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Personal info
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Skyticket (Adventure / アドベンチャー) 8 October 2026 Travel / hospitality / leisure Unauthorized access (method undisclosed) ~14.64M customer records (~4.13M incl. login passwords); 17,780 via business mgmt system; ~12,000 bus reservations
Details for Skyticket (Adventure / アドベンチャー)
System
skyticket servers; business management system; bus reservation service
Industry
Travel booking
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Name, DOB, email; passwords (~4.13M); refund bank account numbers/holder names possibly
Status
Notifying customers, requesting password change; 1 account unauthorized login confirmed
Notes
High (multiple sources). No passport numbers confirmed leaked
Attacker claims
Not reported in sources
Uzabase (NewsPicks) 8 October 2026 Media / entertainment Vulnerability / API / app-flaw exploit Names 59K, addresses 31K, emails 323K, card last-4 etc. 362K
Details for Uzabase (NewsPicks)
System
NewsPicks admin/business management tool
Industry
Media
Attack window
Up to 2026-10-08
Discovered
8 October 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Name, address, email, partial card number (last 4)
Status
Investigating; notifying from Oct 9; no password leak confirmed
Notes
High
Attacker claims
Not reported in sources
VALX 8 October 2026 Corporate community sites Unauthorized access (method undisclosed) 2,950
Details for VALX
System
VALX 'FUN' community
Industry
Various (community site)
Attack window
~2026-10-05/06
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed external system
Vendor link
Unknown
Data exposed
Email, member info
Status
Unknown
Notes
Timing matches Commune - unconfirmed
Attacker claims
Not reported in sources
WingArc1st (ウイングアーク1st) 8 October 2026 Corporate community sites Unauthorized access (method undisclosed) ~1,200
Details for WingArc1st (ウイングアーク1st)
System
nest Portal user site
Industry
Various (community site)
Attack window
~2026-10-05/06
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed external cloud service
Vendor link
Unknown
Data exposed
Email, member info
Status
Unknown
Notes
Timing matches Commune - unconfirmed
Attacker claims
Not reported in sources
Ceres (セレス) - Point Income 7 October 2026 IT / internet / SaaS Unauthorized access (method undisclosed) 195 (ITmedia) / 88 members + staff (漏洩ナビ)
Details for Ceres (セレス) - Point Income
System
Point Income system
Industry
Internet (points site)
Attack window
2026-10-05
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Member & staff info
Status
Unknown
Notes
Medium - counts differ between sources
Attacker claims
Not reported in sources
H.I.S. (エイチ・アイ・エス) - Thai subsidiary 7 October 2026 Travel / hospitality / leisure Unauthorized access (method undisclosed) Up to 627 travelers
Details for H.I.S. (エイチ・アイ・エス) - Thai subsidiary
System
Thai subsidiary file server
Industry
Travel
Attack window
2025-12 (month only)
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Thai local subsidiary
Vendor link
Confirmed
Data exposed
Passport info; passport images for some
Status
No misuse confirmed; strengthening security
Notes
High. Incident is from Dec 2025, disclosed Oct 2026
Attacker claims
Not reported in sources
Hokkai-Gakuen University (北海学園大学) 7 October 2026 Education / research Account / email compromise N/A
Details for Hokkai-Gakuen University (北海学園大学)
System
Student account
Industry
Education
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
N/A
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Ibaraki Prefecture & Ibaraki Police 7 October 2026 Government / public sector Ransomware N/A (website outage)
Details for Ibaraki Prefecture & Ibaraki Police
System
Prefecture & police websites (IDCF cloud)
Industry
Government
Attack window
2026-10-07 ~04:00 JST
Discovered
7 October 2026
Third party
Yes (via third party)
Vendor
IDC Frontier
Vendor link
Confirmed
Data exposed
None reported
Status
Websites down; licence renewals unaffected
Notes
High
Attacker claims
Not reported in sources
IDC Frontier (SoftBank subsidiary) 7 October 2026 IT / internet / SaaS Ransomware 495 companies and local governments affected (service outage); portal registration info of 48 companies illicitly queried; leakage of VM data not confirmed (Oct 7 notice per 漏洩ナビ)
Details for IDC Frontier (SoftBank subsidiary)
System
Part of cloud service run from Fukushima data center
Industry
Data center / cloud
Attack window
2026-10-07 (~03:40 JST outage start)
Discovered
7 October 2026
Third party
Vendor itself
Downstream victims
JR East: えきねっと ~1.67M + 大人の休日倶楽部 ~390K; View Card (VIEW's NET) ~4.03M emails; JR Central: ~15K (JR東海MARKET / いいもの探訪); Izumi (ゆめタウン): up to 400K names+emails (mail magazine); Nissui / Nissui Logistics: shipping halted from Oct 7 (no PII); Ibaraki Pref & Ibaraki Police websites down; NTT Docomo kids web-filter feature down; JR Kyushu (Web members up to ~1.3M emails at risk, later no leak confirmed); FutureShop (mail delivery servers affected, investigating)
Data exposed
Varies by customer (see downstream)
Status
Network isolated; data extraction/restoration from isolated servers said to be difficult (Oct 8)
Notes
High (multiple victim disclosures cite IDCF)
Saitama Prefecture - Shibusawa MIX 7 October 2026 Government / public sector Unauthorized access (method undisclosed) ~2,200 members viewed
Details for Saitama Prefecture - Shibusawa MIX
System
Innovation hub management system
Industry
Government
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Member PII
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Sompo Japan (損害保険ジャパン) 7 October 2026 Finance / insurance Unauthorized access (method undisclosed) ~60,000
Details for Sompo Japan (損害保険ジャパン)
System
SMILING ROAD drive-recorder service inquiry handling (outsourced to Scala)
Industry
Insurance
Attack window
2026-10-02/03
Discovered
3 October 2026
Third party
Yes (via third party)
Vendor
Scala Communications
Vendor link
Confirmed
Data exposed
Name, phone, address. No bank/card
Status
No misuse confirmed
Notes
High
Attacker claims
Not reported in sources
Toda Corporation (戸田建設) 7 October 2026 Manufacturing / construction / utilities Unauthorized access (method undisclosed) Up to 7,200 partner emails, 6,000 transaction records, 4,778 employees
Details for Toda Corporation (戸田建設)
System
Supplier payment management system
Industry
Construction
Attack window
2026-10-01 to 2026-10-05
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Emails, transaction data, employee PII
Status
Unknown
Notes
High
Attacker claims
Not reported in sources
Toyama Prefectural University (富山県立大学) 7 October 2026 Education / research Account / email compromise N/A
Details for Toyama Prefectural University (富山県立大学)
System
1 student Microsoft 365 account
Industry
Education
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
N/A
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Active (アクティブ) 6 October 2026 Retail / e-commerce Unauthorized access (method undisclosed) Up to 54,916
Details for Active (アクティブ)
System
Commercial frozen food online store
Industry
E-commerce (frozen food)
Attack window
2026-10-02
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Customer personal info
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Asahi Kasei Pharma / Therapeutics - Pharma DIGITAL 6 October 2026 Healthcare / pharma Unauthorized access (method undisclosed) ~514,000 HCPs + ~44,000 emails
Details for Asahi Kasei Pharma / Therapeutics - Pharma DIGITAL
System
HCP info website 'Pharma DIGITAL'
Industry
Pharma
Attack window
Unknown
Discovered
2 October 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Healthcare professional PII, emails
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Citizen Watch (シチズン時計) 6 October 2026 Manufacturing / construction / utilities Unauthorized access (method undisclosed) ~100,000 people
Details for Citizen Watch (シチズン時計)
System
Brand website inquiry reception (outsourced to Scala)
Industry
Manufacturing (watches)
Attack window
2026-10-02 night to 2026-10-03 morning
Discovered
3 October 2026
Third party
Yes (via third party)
Vendor
Scala Communications
Vendor link
Confirmed
Data exposed
Name, address, phone; bank account & credit card info possibly
Status
No secondary damage confirmed
Notes
High
Attacker claims
Not reported in sources
Daiki Suisan (大起水産) 6 October 2026 Restaurant / food service Unauthorized access (method undisclosed) 174,933
Details for Daiki Suisan (大起水産)
System
Official app system
Industry
Restaurant (sushi)
Attack window
Unknown
Discovered
15 September 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Name, phone, email, gender, address, birthdate (users registered Nov 2024 - Sep 15 2026). Passwords on separate server
Status
Investigation by specialist firm; no leak/misuse confirmed
Notes
Medium-High (single news source)
Dip (ディップ) - Baitoru / Baitoru NEXT 6 October 2026 IT / internet / SaaS Vulnerability / API / app-flaw exploit Up to 3,885,771 emails
Details for Dip (ディップ) - Baitoru / Baitoru NEXT
System
Baitoru, Baitoru NEXT
Industry
HR / job listings
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Email
Status
Reported to MHLW
Notes
High
Attacker claims
Not reported in sources
Koike Sanso Kogyo (小池酸素工業) 6 October 2026 Manufacturing / construction / utilities Unauthorized access (method undisclosed) Under investigation
Details for Koike Sanso Kogyo (小池酸素工業)
System
Unknown
Industry
Manufacturing
Attack window
Unknown
Discovered
5 October 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Unknown
Status
Investigating
Notes
Single secondary source
Attacker claims
Not reported in sources
Mr Max (ミスターマックス) 6 October 2026 Retail / e-commerce Unauthorized access (method undisclosed) Up to 1,735,154
Details for Mr Max (ミスターマックス)
System
Server holding app & online store member data
Industry
Retail (discount store)
Attack window
Unknown
Discovered
3 October 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Name, phone, email. No card/password
Status
No misuse confirmed
Notes
Medium-High (single news source)
Nakabayashi (ナカバヤシ) 6 October 2026 Manufacturing / construction / utilities Unauthorized access (method undisclosed) 1,826
Details for Nakabayashi (ナカバヤシ)
System
Applicant data on ApplyNow
Industry
Manufacturing / office products
Attack window
2026-09-06
Discovered
Unknown
Third party
Yes (via third party)
Vendor
ApplyNow
Vendor link
Confirmed
Data exposed
Applicant personal data
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
nimoca (ニモカ) 6 October 2026 Transport / logistics Unauthorized access (method undisclosed) 521
Details for nimoca (ニモカ)
System
Usage-history inquiry service
Industry
Transport IC card
Attack window
2026-10-04
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Email, card number etc.
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Rakuten Drive (Rakuten Symphony / Rakuten Mobile) 6 October 2026 IT / internet / SaaS Account / email compromise 15,382 accounts' stored data
Details for Rakuten Drive (Rakuten Symphony / Rakuten Mobile)
System
Rakuten Drive admin account
Industry
Cloud storage
Attack window
Multiple times since Aug 2026
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Account info, stored data
Status
Unknown
Notes
Medium-High. Sources differ on entity (楽天シンフォニー vs 楽天モバイル)
Attacker claims
Not reported in sources
Salty Dog (ソルティドッグ) 6 October 2026 Media / entertainment Account / email compromise N/A
Details for Salty Dog (ソルティドッグ)
System
Google Ads manager account
Industry
Advertising agency
Attack window
2026-10-05
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
N/A
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Scala Communications (スカラコミュニケーションズ) 6 October 2026 IT / internet / SaaS Account / email compromise 713,126 records (cumulative) from up to 5 client companies
Details for Scala Communications (スカラコミュニケーションズ)
System
FAQ / inquiry system "i-ask" (admin site) for client companies
Industry
IT services (web inquiry/contact form systems)
Attack window
2026-10-02 night to 2026-10-03 morning
Discovered
Unknown
Third party
Vendor itself
Downstream victims
Daiwa Securities: ~220K items (~110K people); Citizen Watch: ~100K people; Sompo Japan: ~60K; 2 other clients unnamed. See also Daiwa, Citizen, Sompo rows
Data exposed
Varies by client: names, addresses, phones, emails; Daiwa: account numbers; Citizen: bank account & credit card info possibly included
Status
Investigating actual number of individuals
Notes
High
Weather Caster Network (気象キャスターネットワーク) 6 October 2026 Media / entertainment Unauthorized access (method undisclosed) Up to 15,959
Details for Weather Caster Network (気象キャスターネットワーク)
System
Website
Industry
Non-profit / media
Attack window
Unknown
Discovered
27 September 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Member personal info
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Daiwa Securities (大和証券) 5 October 2026 Finance / insurance Unauthorized access (method undisclosed) ~220,000 items (~110,000 people)
Details for Daiwa Securities (大和証券)
System
Web inquiry management (outsourced to Scala)
Industry
Finance
Attack window
2026-10-02 night to 2026-10-03 morning
Discovered
3 October 2026
Third party
Yes (via third party)
Vendor
Scala Communications
Vendor link
Confirmed
Data exposed
Name, email, account number
Status
No unauthorized trades
Notes
High
Attacker claims
Not reported in sources
GMO Research & AI (infoQ) 5 October 2026 IT / internet / SaaS Vulnerability / API / app-flaw exploit Up to 948,498
Details for GMO Research & AI (infoQ)
System
Survey site infoQ
Industry
Market research / survey site
Attack window
Unknown
Discovered
3 October 2026
Third party
No (direct)
Downstream victims
611 accounts had points fraudulently swapped to Amazon gift codes (¥2,869,500)
Data exposed
Name, address, phone, password etc.
Status
Company to reimburse points in full
Notes
High. First confirmed secondary (financial) damage in the wave per TV Asahi
Attacker claims
Not reported in sources
Kufu Company HD (くふうカンパニー) 5 October 2026 IT / internet / SaaS Unauthorized access (method undisclosed) At least 1 email
Details for Kufu Company HD (くふうカンパニー)
System
Community app 'Kufu Machi Talk β'
Industry
Internet services
Attack window
Unknown
Discovered
2 October 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Email
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Osaka Metropolitan University (大阪公立大学) 5 October 2026 Education / research Ransomware At least ~130,000 students/alumni possibly
Details for Osaka Metropolitan University (大阪公立大学)
System
Information infrastructure (~500 servers)
Industry
Education
Attack window
2026-10-02
Discovered
2 October 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Student/alumni PII
Status
All classes cancelled until Oct 8
Notes
Medium-High
Attacker claims
Not reported in sources
Safer Internet Association (セーファーインターネット協会) 5 October 2026 Other Unauthorized access (method undisclosed) Unknown
Details for Safer Internet Association (セーファーインターネット協会)
System
Data stored on 'Sakura Rental Server'
Industry
Non-profit
Attack window
2026-09 (month only)
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Sakura Internet (rental server)
Vendor link
Confirmed
Data exposed
Personal info stored on server
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
White Essence (ホワイトエッセンス) 5 October 2026 Healthcare / pharma Unauthorized access (method undisclosed) ~1.05M accounts
Details for White Essence (ホワイトエッセンス)
System
Booking site & core system
Industry
Healthcare (dental whitening)
Attack window
Unknown
Discovered
5 August 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Customer & staff personal info
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Yakiniku King (Monogatari Corp / 物語コーポレーション) 5 October 2026 Restaurant / food service Unauthorized access (method undisclosed) 10,788,963 (of 10,808,784 registered users)
Details for Yakiniku King (Monogatari Corp / 物語コーポレーション)
System
Official app member management system
Industry
Restaurant
Attack window
From 2026-10-02
Discovered
2 October 2026
Third party
Unknown
Vendor
Unnamed (maintenance outsourced)
Vendor link
Unknown
Data exposed
Name, email, phone etc. No payment data held
Status
Service continuing with defensive measures; detailed investigation with developer/related companies; no misuse confirmed
Notes
High. Monogatari owns the server; maintenance outsourced to unnamed company - no evidence the vendor was the entry point
Nikkei (日本経済新聞社) 4 October 2026 Media / entertainment Account / email compromise ~9,000 spoofed emails; 1,646 people (Google Workspace)
Details for Nikkei (日本経済新聞社)
System
Employee Microsoft 365 account; Google Workspace account; cloud service
Industry
Media
Attack window
M365: ~2026-09-30 spoofed mails; Google Workspace/cloud: since late July 2026
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Recipient names/addresses, some email content; employee/partner PII
Status
Asked recipients to delete emails
Notes
High
Attacker claims
Not reported in sources
Nikkei BP (日経BP) 4 October 2026 Media / entertainment Account / email compromise 26
Details for Nikkei BP (日経BP)
System
Employee email account
Industry
Media
Attack window
2026-09-30
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Email correspondents' PII
Status
Unknown
Notes
Medium-High
Attacker claims
Not reported in sources
Abahouse International (アバハウス) 3 October 2026 Retail / e-commerce Unauthorized access (method undisclosed) Not disclosed
Details for Abahouse International (アバハウス)
System
Online store member/order DB
Industry
Apparel
Attack window
Est. 2026-09-27 to 2026-09-28
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Name, email, address, phone, DOB, purchase history
Status
Unknown
Notes
High
Attacker claims
Not reported in sources
Recruit (リクルート) - StudySapuri 3 October 2026 Education / research Vulnerability / API / app-flaw exploit 3,687 emails identified as registered
Details for Recruit (リクルート) - StudySapuri
System
StudySapuri function (spec flaw)
Industry
Education
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Email (registration status)
Status
No other PII or account takeover confirmed
Notes
High
Attacker claims
Not reported in sources
Dai-ichi Life Group / Dai-ichi Life Insurance 2 October 2026 Finance / insurance Unauthorized access (method undisclosed) ~120K (≈50K employees + ≈70K retirees)
Details for Dai-ichi Life Group / Dai-ichi Life Insurance
System
Employee HR system
Industry
Insurance
Attack window
Unknown
Discovered
24 September 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Name, employee number, address, phone
Status
No customer-data access or secondary damage confirmed
Notes
High
Attacker claims
Not reported in sources
JOGMEC (エネルギー・金属鉱物資源機構) 2 October 2026 Government / public sector Unauthorized access (method undisclosed) ~8,500 emails
Details for JOGMEC (エネルギー・金属鉱物資源機構)
System
Information system
Industry
Government agency
Attack window
Unknown
Discovered
9 September 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Staff & external contact emails
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Kodansha BECK (講談社BECK) 2 October 2026 Media / entertainment Account / email compromise Unknown
Details for Kodansha BECK (講談社BECK)
System
Employee email account
Industry
Media
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Mailbox PII
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Moonstar (ムーンスター) 2 October 2026 Manufacturing / construction / utilities Unauthorized access (method undisclosed) Unknown
Details for Moonstar (ムーンスター)
System
Company server
Industry
Manufacturing (shoes)
Attack window
Unknown (first reported March 2026)
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Customer personal info possibly
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Sammy Networks (サミーネットワークス) 2 October 2026 Media / entertainment Unauthorized access (method undisclosed) Unknown
Details for Sammy Networks (サミーネットワークス)
System
Pachinko hall entry lottery app '777CON-PASS'
Industry
Entertainment / apps
Attack window
Unknown
Discovered
25 September 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
User personal info
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
The Japan Times (ジャパンタイムズ) 2 October 2026 Media / entertainment Unauthorized access (method undisclosed) Under investigation
Details for The Japan Times (ジャパンタイムズ)
System
Group company server
Industry
Media
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Unknown
Status
Investigating
Notes
Single secondary source
Attacker claims
Not reported in sources
Aflac (アフラック) 1 October 2026 Finance / insurance Unauthorized access (method undisclosed) Unknown
Details for Aflac (アフラック)
System
Unknown
Industry
Insurance
Attack window
Multiple times in 2026-06
Discovered
2026-06 (month only)
Third party
Unknown
Vendor link
Unknown
Data exposed
Personal information
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
ALSOK Joylife 1 October 2026 Healthcare / pharma Unauthorized access (method undisclosed) No PII leak confirmed
Details for ALSOK Joylife
System
Elderly facility systems
Industry
Elderly care
Attack window
2026-07 (month only)
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
None confirmed
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Japan Atomic Energy Agency (JAEA) 1 October 2026 Education / research Unauthorized access (method undisclosed) 175 facility users
Details for Japan Atomic Energy Agency (JAEA)
System
Research support website (research reactor)
Industry
Research
Attack window
Unknown
Discovered
25 September 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
PII; ID images (driver's license / My Number card) for 6
Status
Unknown
Notes
High
Attacker claims
Not reported in sources
Lashinbang (らしんばん) 1 October 2026 Retail / e-commerce Unauthorized access (method undisclosed) Unknown
Details for Lashinbang (らしんばん)
System
Operated service
Industry
Retail (used goods)
Attack window
2026-09-14 to 2026-09-16
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Name etc.
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Nippon Rent-A-Car (ニッポンレンタカー) 1 October 2026 Transport / logistics Unauthorized access (method undisclosed) 55 members
Details for Nippon Rent-A-Car (ニッポンレンタカー)
System
Nippon Rent-A-Car app
Industry
Mobility
Attack window
2026-09-19 to 2026-09-21
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
PII, driver's license info, card last 4
Status
Unknown
Notes
High
Attacker claims
Not reported in sources
Starts Publishing (スターツ出版) - OZmall 1 October 2026 Media / entertainment Unauthorized access (method undisclosed) 442,779 members
Details for Starts Publishing (スターツ出版) - OZmall
System
Salon booking service OZmall
Industry
Media / booking
Attack window
Unknown
Discovered
26 September 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Personal info
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Jelly Beans Group (ジェリービーンズ) 30 September 2026 Retail / e-commerce BEC / payment fraud N/A (funds lost)
Details for Jelly Beans Group (ジェリービーンズ)
System
Executive impersonation transfer instruction
Industry
Retail (shoes)
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
N/A
Status
Investigation report published
Notes
Single secondary source
Attacker claims
Not reported in sources
Kansai University of International Studies (関西国際大学) 30 September 2026 Education / research Unauthorized access (method undisclosed) Not disclosed
Details for Kansai University of International Studies (関西国際大学)
System
e-Portfolio learning system
Industry
Education
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Students' (enrolled up to Mar 2023) learning records
Status
Unknown
Notes
Medium-High
Attacker claims
Not reported in sources
Sagawa Express (佐川急便) 30 September 2026 Transport / logistics Unauthorized access (method undisclosed) Under investigation
Details for Sagawa Express (佐川急便)
System
Parcel tracking inquiry service (お荷物問い合わせサービス)
Industry
Logistics
Attack window
Unknown (~100 days of data possibly exposed per Mynavi headline)
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Sender/recipient names, addresses, phones from waybills. No card/password
Status
Online tracking stopped; dedicated hotline opened
Notes
High
Attacker claims
Not reported in sources
Shudo Gakuen (修道学園) 30 September 2026 Education / research Unauthorized access (method undisclosed) Not disclosed
Details for Shudo Gakuen (修道学園)
System
School server
Industry
Education
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Supplier bank info, staff PII possibly
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Yoshinoya Holdings (吉野家) 30 September 2026 Restaurant / food service Unauthorized access (method undisclosed) 5,366 accounts (+other)
Details for Yoshinoya Holdings (吉野家)
System
Part-time applicant data on ApplyNow
Industry
Restaurant
Attack window
~2026-09
Discovered
Unknown
Third party
Yes (via third party)
Vendor
ApplyNow
Vendor link
Confirmed
Data exposed
Name, email, password, address, phone, DOB
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
e+ (イープラス) - Smachike 29 September 2026 Travel / hospitality / leisure Unauthorized access (method undisclosed) 1,463 refund applicants (+others)
Details for e+ (イープラス) - Smachike
System
Refund info management system
Industry
Ticketing
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Name, email, address, bank account, purchase history
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Japan Post (日本郵政) - Post Office app 29 September 2026 Transport / logistics Unauthorized access (method undisclosed) 69 items
Details for Japan Post (日本郵政) - Post Office app
System
Post Office app
Industry
Postal / logistics
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Name, email, address, phone, DOB
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Seicomart (セイコーマート) 29 September 2026 Retail / e-commerce Unauthorized access (method undisclosed) 574,647 app members
Details for Seicomart (セイコーマート)
System
Seicomart app server
Industry
Retail (convenience store)
Attack window
2026-09-29
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Personal info viewable
Status
Unknown
Notes
High
Attacker claims
Not reported in sources
Yamato Transport (ヤマト運輸) 29 September 2026 Transport / logistics Unauthorized access (method undisclosed) Under investigation
Details for Yamato Transport (ヤマト運輸)
System
Kuroneko deferred payment service (クロネコ代金後払いサービス)
Industry
Logistics
Attack window
Unknown
Discovered
28 September 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Name, address, phone, billing amount, receivable balance. No card/password
Status
Service stopped night of Sep 28; investigating
Notes
High
Attacker claims
Not reported in sources
Hayama Hotel Otowanomori (葉山ホテル音羽ノ森) 28 September 2026 Travel / hospitality / leisure Unauthorized access (method undisclosed) Unknown
Details for Hayama Hotel Otowanomori (葉山ホテル音羽ノ森)
System
Reservation management system
Industry
Hospitality
Attack window
Unknown
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Temairazu
Vendor link
Confirmed
Data exposed
Guest personal info
Status
Unknown
Notes
Downstream of Temairazu
Attacker claims
Not reported in sources
Kuretakeso Holdings (呉竹荘) 28 September 2026 Travel / hospitality / leisure Unauthorized access (method undisclosed) Unknown
Details for Kuretakeso Holdings (呉竹荘)
System
External reservation-linking service
Industry
Hospitality
Attack window
Unknown
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed (same day as Temairazu disclosure)
Vendor link
Suspected
Data exposed
Reservation info
Status
Unknown
Notes
Vendor not named in summary; timing matches Temairazu
Attacker claims
Not reported in sources
Nagano Toshi Gas (長野都市ガス) 28 September 2026 Manufacturing / construction / utilities Unauthorized access (method undisclosed) ~3,600
Details for Nagano Toshi Gas (長野都市ガス)
System
Outsourced contractor
Industry
Utility (gas)
Attack window
Unknown
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed contractor
Vendor link
Confirmed
Data exposed
Personal info
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Shueisha (集英社) 28 September 2026 Media / entertainment Unauthorized access (method undisclosed) 2,835 bloggers (+others)
Details for Shueisha (集英社)
System
Blogger management system HAPPY PLUS COMMUNITY
Industry
Media
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Name, email, address, phone, DOB
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Temairazu (手間いらず) 28 September 2026 Travel / hospitality / leisure Unauthorized access (method undisclosed) Up to ~4.45M people
Details for Temairazu (手間いらず)
System
Site controller "TEMAIRAZU" series (accommodation reservation management)
Industry
Travel / hotel booking SaaS
Attack window
Unknown
Discovered
21 September 2026
Third party
Vendor itself
Downstream victims
Hotels/inns using the system (not named)
Data exposed
Name, phone, facility name, stay dates, price. No card data
Status
Unknown
Notes
Medium-High (single news source)
Keio Corporation (京王電鉄) group 26 September 2026 Transport / logistics Ransomware No PII leak confirmed
Details for Keio Corporation (京王電鉄) group
System
Group company server
Industry
Rail / retail / hotels
Attack window
2026-09-26 (early morning)
Discovered
26 September 2026
Third party
Unknown
Vendor link
Unknown
Downstream victims
Group stores: card payments & hotel booking unavailable
Data exposed
None confirmed
Status
Rail unaffected; investigating with police
Notes
High
Attacker claims
Not reported in sources
Tokyo Metro (東京メトロ) 26 September 2026 Transport / logistics Unauthorized access (method undisclosed) ~59,000 emails
Details for Tokyo Metro (東京メトロ)
System
Metopo (Metro Point Club) member email delivery service (contractor server)
Industry
Rail
Attack window
~2026-09-20 (malfunction)
Discovered
25 September 2026
Third party
Yes (via third party)
Vendor
Unnamed email delivery contractor
Vendor link
Confirmed
Data exposed
Email only
Status
Technical measures taken; investigating
Notes
Single secondary source
Attacker claims
Not reported in sources
Fines (ファインズ) 25 September 2026 IT / internet / SaaS Unauthorized access (method undisclosed) 1,536,322 reservation records
Details for Fines (ファインズ)
System
Reservation system
Industry
IT / marketing
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Name, email, phone etc.
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
LEGOLAND Japan - Hotel 25 September 2026 Travel / hospitality / leisure Unauthorized access (method undisclosed) 1,557 bookings
Details for LEGOLAND Japan - Hotel
System
Hotel booking platform
Industry
Leisure
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Name, email, phone
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Times Car (Park24 / パーク24) 25 September 2026 Transport / logistics Unauthorized access (method undisclosed) Up to ~6.6M
Details for Times Car (Park24 / パーク24)
System
Web system
Industry
Mobility (car sharing)
Attack window
Unknown
Discovered
25 September 2026
Third party
Unknown
Vendor link
Unknown
Data exposed
Name, address, phone, driver's license info (漏洩ナビ also lists email, password, DOB, member ID)
Status
Service continuing; Yamagata Pref reissuing licenses from Sep 28
Notes
Medium-High (single news source)
Toyobo (東洋紡) group 25 September 2026 Manufacturing / construction / utilities Account / email compromise N/A
Details for Toyobo (東洋紡) group
System
Group employee email accounts
Industry
Manufacturing
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Unknown
Status
Investigating
Notes
Medium-High
Attacker claims
Not reported in sources
Ikegami Tsushinki (池上通信機) 24 September 2026 Manufacturing / construction / utilities Ransomware Unknown
Details for Ikegami Tsushinki (池上通信機)
System
Servers
Industry
Manufacturing (broadcast equipment)
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Company information
Status
Unknown
Notes
Medium (single secondary source)
Attacker claims
Data believed to be the company's posted on attacker leak site (per 漏洩ナビ); group not named
JGC Digital (日揮グループ) 18 September 2026 IT / internet / SaaS Vulnerability / API / app-flaw exploit ~60,000 accounts (incl. AZAS ~40K)
Details for JGC Digital (日揮グループ)
System
BI tool 'Metabase'
Industry
IT / engineering
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Name, email
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Land Housing (ランドハウジング) 18 September 2026 Manufacturing / construction / utilities Account / email compromise Unknown
Details for Land Housing (ランドハウジング)
System
Third-party viewing-reservation system account
Industry
Real estate
Attack window
Unknown
Discovered
Unknown
Third party
Yes (via third party)
Vendor
Unnamed viewing-reservation system provider
Vendor link
Confirmed
Data exposed
Property key information
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Taikisha (大気社) - Malaysia group co. 18 September 2026 Manufacturing / construction / utilities Account / email compromise Unknown
Details for Taikisha (大気社) - Malaysia group co.
System
Employee email account
Industry
Engineering
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Unknown
Status
Investigating
Notes
Single secondary source
Attacker claims
Not reported in sources
Daiko Printing (大興印刷) - PhotoGoods 16 September 2026 Retail / e-commerce Unauthorized access (method undisclosed) Not disclosed
Details for Daiko Printing (大興印刷) - PhotoGoods
System
Goods-making service PhotoGoods
Industry
E-commerce
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Card info, address, password
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Helpfeel - Gyazo 16 September 2026 IT / internet / SaaS Vulnerability / API / app-flaw exploit ~23.62M user records + ~490M image metadata (+~174M deleted-image metadata)
Details for Helpfeel - Gyazo
System
Gyazo (image upload server vuln)
Industry
SaaS (image sharing)
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Name, email, password, IDs, image metadata
Status
Unknown
Notes
High
Attacker claims
Not reported in sources
Ainokaze Toyama Railway (あいの風とやま鉄道) 15 September 2026 Transport / logistics Unauthorized access (method undisclosed) 1,409 passengers/bookers
Details for Ainokaze Toyama Railway (あいの風とやま鉄道)
System
Tourist train seat management system
Industry
Rail
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Address etc.
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Odawara Engineering (小田原エンジニアリング) 15 September 2026 Manufacturing / construction / utilities Account / email compromise Unknown
Details for Odawara Engineering (小田原エンジニアリング)
System
Email of employee seconded to German subsidiary
Industry
Manufacturing
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Partner correspondence
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Higashi Sangyo (東産業) 14 September 2026 Manufacturing / construction / utilities Vulnerability / API / app-flaw exploit Unknown
Details for Higashi Sangyo (東産業)
System
Official website (vulnerability)
Industry
Manufacturing
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Inquiry form customer info
Status
Investigating
Notes
Single secondary source
Attacker claims
Not reported in sources
Nihon University (日本大学) 14 September 2026 Education / research Account / email compromise Unknown
Details for Nihon University (日本大学)
System
5 faculty email accounts
Industry
Education
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Possible data access
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Digital Agency (デジタル庁) 11 September 2026 Government / public sector Vulnerability / API / app-flaw exploit ~246,000 (possibly leaked)
Details for Digital Agency (デジタル庁)
System
Government Solution Service (GSS) - shared IT environment for ministries; file server accessed
Industry
Government
Attack window
Late May 2026 (believed start of intrusion via remote-maintenance VPN device)
Discovered
25 June 2026
Third party
Yes (via third party)
Vendor
Outsourced maintenance/operations staff account used (contractor unnamed); VPN product and CVE not named by agency
Vendor link
Confirmed
Downstream victims
23 organizations (~154K users) use GSS; affected ministries not named
Data exposed
~189K staff of GSS-using orgs / public servants (incl. independent administrative agencies) + ~57K contractors/individuals (incl. web-meeting participants). Name ~236K, email ~231K, phone ~94K, address ~1K. No My Number, bank, pension or general-public data
Status
Jul 9 account suspended & device cut off; Jul 15 reported to PPC; Sep 11 public announcement; Minister (Sep 15): no secondary harm confirmed
Notes
High (official notice + Q&A + minister's press conference). Date conflict RESOLVED: official disclosure Sep 11; TV Asahi's Sep 6 is an error. CVE not named by agency - piyolog infers Palo Alto GlobalProtect CVE-2026-0257 (inference only). Gap: 78 days (~11 weeks) detection->disclosure; ~3.5 months from believed intrusion (late May) to disclosure
Attacker claims
No attribution; agency consulting NPA and NCO
Institute of Energy Economics, Japan (IEEJ) 11 September 2026 Education / research Account / email compromise 795 incl. 13 passport records
Details for Institute of Energy Economics, Japan (IEEJ)
System
6 staff Microsoft 365 accounts (phishing)
Industry
Research
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Passport info, name, email, phone, bank account
Status
Unknown
Notes
High
Attacker claims
Not reported in sources
Nippon Trex (日本トレクス) 11 September 2026 Transport / logistics Unauthorized access (method undisclosed) No leak confirmed
Details for Nippon Trex (日本トレクス)
System
Information systems
Industry
Manufacturing (trailers)
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
None
Status
Investigation found no leak
Notes
Single secondary source
Attacker claims
Not reported in sources
ApplyNow 9 September 2026 IT / internet / SaaS Vulnerability / API / app-flaw exploit Unknown (multiple customers)
Details for ApplyNow
System
Recruitment management platform (via data-analysis tool vuln)
Industry
SaaS (recruitment management)
Attack window
~2026-09-06
Discovered
Unknown
Third party
Vendor itself
Downstream victims
Yoshinoya HD (5,366 accounts), Nakabayashi (1,826), several municipalities/companies
Data exposed
Applicant personal data
Status
Unknown
Notes
High
Attacker claims
Not reported in sources
Rikkyo University (立教大学) 8 September 2026 Education / research Account / email compromise 6 accounts
Details for Rikkyo University (立教大学)
System
Student/alumni Google accounts
Industry
Education
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Email etc.
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources
Healingpaper - Unni (カンナムオンニ) 7 September 2026 Healthcare / pharma Unauthorized access (method undisclosed) 219,665 incl. ~48,000 Japan users
Details for Healingpaper - Unni (カンナムオンニ)
System
Unni service
Industry
Beauty-medical platform (Korean co.)
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
Personal info
Status
Unknown
Notes
Foreign (Korean) operator; included for Japanese victims
Attacker claims
Not reported in sources
Tottori Prefecture - radiation monitoring 3 September 2026 Government / public sector Ransomware N/A
Details for Tottori Prefecture - radiation monitoring
System
Environmental radiation monitoring system
Industry
Government
Attack window
Unknown
Discovered
Unknown
Third party
Unknown
Vendor link
Unknown
Data exposed
N/A
Status
Unknown
Notes
Single secondary source
Attacker claims
Not reported in sources

From the same reporting

These pieces are about the same breach wave. The counts above stay tied to the sheet.

If this reaches your vendors

I provide IT support and administration for organizations in Japan. That covers accounts and access, email and domains, the website, and the vendors those systems depend on. If you want a second look at the setup behind one of these notices, email me or send a note.

Discuss your project matt@mkultraman.com