Data Breach & Cyberattack News

2026.11.07Second notice: website partially reopened

Possible leakUnauthorized accessThe company announced reopening of its website on November 7 except for some pages. The travel-memory photo-submission page remains suspended.

Approx. 4.32 million recordsOnline members’ names, nationality, gender, birth dates, addresses, phone numbers, emails, member IDs and emergency contacts. Login passwords, passport, card and bank data are stated to be excluded.

2026.11.06Update: three card numbers additionally confirmed

Leak confirmedUnauthorized accessThe system was shut down on October 30 after continued unauthorized access was found; road-service operations continue through alternative procedures.

Up to approx. 5.5 million records (including duplicates)Road-service users’ names, addresses, contact, vehicle and service-request information and some bank-account data. Three card numbers were additionally confirmed on November 6 and are a subset of the maximum of about 5.5 million records. Deduplicated person counts and partner-company scope remain under review.

2026.11.06Third report: online store and app functions suspended

Possible leakUnauthorized accessOn November 6 all online-store functions and all MUJI app functions except the membership barcode were suspended. Reopening was planned within one to two days; physical stores operate normally.

Up to approx. 27.26 million records; approx. 1.09 million MUJI Card records and others(1) Up to about 27.26 million MUJI app and online-store users, including former members: email address, birth date, gender and member ID; about 520,000 of them (so far) also include name, address and phone number. (2) About 1.09 million MUJI Card members who joined by July 2021: full card number, MUJI Card ID and birth date (about 345,000 cards still valid; cardholder name, expiry date and security code not included). (3) About 120 users who registered cards in the app or online store: first six and last two card digits and cardholder name. All may have been accessed externally. Some of the valid cards in (2) and the records in (3) were viewable together with user data in (1).

2026.11.06Breakdown corrected; total unchanged

Leak confirmedUnauthorized accessArara Message and ASP repica remain suspended, with no reopening date as of November 6. TKC has built a separate delivery infrastructure and is progressively restoring sending functions for individual systems.

81,329,467 email addresses (deduplicated)The November 6 third report gives a confirmed leak count deduplicated across all environments: 34,285,087 email-only records and 47,044,380 with attributes such as names. About 380 customer companies, 61 shared-environment customers and their individual disclosures are not added. A same-day correction changes a breakdown figure, not the total.

2026.11.06Restart target and undetermined OEM schedule reiterated

Leak confirmedUnauthorized accessThe management console, API and delivery remain suspended. The November 6, 1 p.m. update retains a target around November 11, subject to investigation and testing; OEM reopening remains undetermined.

All customer-contract information; non-contract information exposed for 421 contracts421 counts contracts, not all exposed records or recipients. For the 76 contracts newly identified on November 4, no exposure of reader data (recipient addresses, customer lists, etc.) or email bodies has been confirmed. Overlap with the information of all customers cannot be separated. Customer disclosures are related information for the same incident.

2026.11.06External forensic findings

Possible leakUnauthorized access

About 8,724,000 records

2026.11.06Investigation findings and affected counts disclosed

Leak confirmedUnauthorized access

Customer-management data for 2,797,545 people; call recordings containing card data for 9,715 peopleCustomer-management records contain names, addresses and phone numbers, varying by person. Some call recordings include card numbers and expiry dates, but not security codes or authentication information. The 9,715 recording subjects are not added because overlap with customer-management subjects is unresolved.

2026.11.06

Possible leakUnauthorized accessThe website and app remain suspended with no reopening date; retail sales continue.

Affected count undisclosed

2026.11.06

Possible leakUnauthorized accessThe information-security understanding-check service is suspended.

Up to 15,128 records

2026.11.06

Leak confirmedUnauthorized accessMizkan 365 is suspended while restoration proceeds. Mizkan’s shop and Fibee were also suspended as precautions from November 4.

487 altered accounts; data exposure affecting 29 peopleThe 29 people are a subset of the 487 altered accounts. The 26 with point/campaign data are also a subset and are not added.

2026.11.06

Possible leakUnauthorized accessOnline-shop and subscription ordering are suspended; confirmed orders continue to be shipped.

24,762 member records and 9 delivery-address records

2026.11.06Third report: exposed fields and continuing suspension

Leak confirmedUnauthorized accessProcedures on Docomo Online Shop and My docomo remain suspended; no restoration date was set as of 6 p.m. on November 6.

Up to about 300,000 recordsThe November 6 third report identified names, birth dates, addresses, phone numbers, email addresses, identity-document numbers and contract/plan data. Some records also contain legal-representative, employer, bank-account or childcare-program data. The maximum remains about 300,000 records; subsets are not added.

2026.11.06Related update

Leak confirmedUnauthorized accessThe guarantee system has been suspended for safety checks and maintenance (as of November 5). Partner Hokuyo Bank suspended new applications and limit increases for its Super Arca card loan.

Up to 320,118 peopleNames, gender, dates of birth, addresses, home and mobile phone numbers, email addresses, driver’s licence numbers, employer information (phone numbers, annual income, etc.) and contract information (financial institution codes, customer numbers, guarantee amounts, guarantee start dates, etc.). Images of identity documents such as driver’s licences are not included. Affected people will be contacted after the scope is identified.

2026.11.06Second report: scope and scale identified

Leak confirmedUnauthorized accessKikan Navi and MIR@I on the same server remain suspended. MIR@I is suspended as a precaution; no reopening date is set.

About 2,000 institutional investors/analysts and about 250 former employees, plus unquantified dataNames, email addresses and related information. Listed-company executives’ names and positions are also included, without a published count. Unauthorized access to MIR@I has not been confirmed.

2026.11.06Customer-data exposure and count disclosed

Leak confirmedUnauthorized accessAs of 12:00 on November 5, the policyholder page, One Day Supporter, e-travel overseas travel insurance, My Agent, the corporate customer web service, e-G1 and online accident reporting were suspended. The company says other services may also be suspended.

About 444,000 recordsPolicyholder data and related information. Three records containing the last four card digits and 19 containing partial bank-account information are subsets and are not added.

2026.11.06Customer-data exposure and count disclosed

Leak confirmedUnauthorized accessAs of 12:00 on November 5, the policyholder page, 1DAY insurance, the “Net de Hoken” travel, golf and cycle products, My Agent, the disaster alert service, the hail emergency alert, the corporate customer web service, e-G1, Jidosha Kantan Net and online accident reporting were suspended. The company says other services may also be suspended.

About 37,000 recordsPolicyholder data and related information. The company states that credit-card and bank-account information is not included.

2026.11.06Investigation completed; no leak confirmed

Leak not confirmedUnauthorized accessThe site was urgently suspended at 3:53 a.m. on November 2. Web orders are stopped; call-center orders are still accepted.

No personal-data leak confirmed so farThe investigation was completed, as announced on November 6. It found no confirmed leak of personal or card data and no confirmed unauthorized logins.

2026.11.06Compensation process for unauthorized-trading losses begins

Possible leakUnauthorized accessAll plans progressively suspended from 04:00 on October 21.

26,739 potentially affected servers; exposed-data count undisclosedServer counts are not converted into leaked-information counts.

2026.11.06Update: additional personal-data exposure

Leak confirmedUnauthorized accessWebsites provisionally reopened; some search and authenticated content remain unavailable.

Previously reported 743 records; an additional 142, 9,252 and 19 recordsAdditional groups comprise 142 event-calendar contacts, 9,252 current/former staff records and 19 maintenance/production-company contacts, including names and email addresses. The separate e-Venue incident is excluded.

2026.11.06Scheduled FutureShop restart and Shopify authentication change

Leak confirmedUnauthorized accessIntegration with eBay, Amazon and Walmart has been suspended since around 19:00 on October 20 until each store reissues its API tokens. SpeedPAK integration resumed on November 2 and BUYMA VINTAGE integration on November 5. WASABI corrected its guidance of around October 20: DHL does not require reauthentication. On November 6, FutureShop integration was scheduled to resume from November 9. Shopify integration is conditional on stores obtaining new tokens after the authentication change that day.

Number under investigationA separate route from the October 14 incident. Scope and overlap remain unresolved; no numerical amount counted.

2026.11.06Report 26: API integration resumed

Possible leakUnauthorized accessReport 26 on November 6 announced resumption of external-system API integration. Customer-side configuration is involved, with individual notices to affected users.

About 3,136,000 RAIDEN email addresses, 9,020 NET119 records and 97,000 119RAIDEN email addressesThe October 16 eleventh report corrected NET119 to 9,020 records. Phone/fax counts and customer subsets are not added.

2026.11.06Reviewed findings: leak affecting 27,139 members confirmed

Leak confirmedIncident at a vendor

27,139 peopleRegional-branch names, member names and numbers, gender, birth dates and email addresses. Addresses, phone numbers, passwords and bank-account data are not included. This reviewed person count replaces the initial mailing-list estimate of over 40,000 entries.

2026.11.06Additional potentially exposed fields

Possible leakUnauthorized access

951 employees and former employees951 current and former employees at four stores. The November 6 update adds employee numbers, gender, nationality, employment/work/social-insurance details, relatives’ names, relationships and addresses, and bank-account data.

2026.11.05Related update

Leak confirmedUnauthorized accessViewing and all functions of Fancrew have been suspended since 10:43 on November 1. The second report scheduled maintenance until 11:00 on November 5, but no reopening announcement has been confirmed.

1,030,741 monitor member recordsMember IDs, email addresses, hashed passwords, names, gender, postcodes and the last four digits of phone numbers. Former members are not included. No unauthorized logins or point exchanges using the leaked data have been confirmed. Partner Point Town announced that, for its linked users, Fancrew-issued IDs, gender and first-link dates leaked.

2026.11.05Second report: possible exposure of data on about 7.7 million people

Possible leakUnauthorized accessIris Plaza and related systems have been shut down since October 28. From the same day the SIMPLE STYLE site and Iris Tech Service’s appliance-subscription and delivery/installation sites were also suspended, with new applications stopped. Stores on other marketplaces remain available. No reopening date had been set as of November 5.

About 7.7 million people (about 5.8 million members and 1.9 million non-members)Total personal data stored in an external cloud service. The company has confirmed it may have been viewed or acquired; the actual number exposed and people affected remain under investigation. Member data (including former members) covers names, addresses, phone numbers, email addresses, gender, passwords (encrypted; excluding former members) and dates of birth; non-member data (purchasers without accounts, campaign entrants, etc.) covers names, addresses, phone numbers and email addresses. Fields vary by registration. Card data were not stored in that cloud and were unaffected, the company says.

2026.11.05Fifth report: web donations to resume in stages from 12:00 on November 6

Leak confirmedUnauthorized accessThe donation management system for municipalities and suppliers resumed on October 26 and the partner-site integration on October 28. The fifth report on November 5 said web donations on Furusato Choice would resume in stages from 12:00 on November 6; the app and Choice Pay are to resume later.

4,454,097 recordsThe five people with additional exposed fields are a subset of the previously disclosed 4,454,097 records.

2026.11.05Related update

Leak confirmedUnauthorized accessSystems at the affected data center were suspended as a precaution on October 18 and began reopening progressively on October 20; full restoration is not announced.

FC: 51,628,280 records in gross; BASE: 190 customer recordsExposure traces were found in 49 FC systems. The detailed table labels the gross figure as possible exposure; counts for 16 systems remain under investigation. The 190 BASE records are a separate customer-management dataset. Customer disclosures and the superseded approximate nine million are not added.

2026.11.05Correction/addition to the third report

Leak confirmedUnauthorized accessResumed September 27; earlier images remain subject to viewing and sharing restrictions

About 23.62 million user records, 666.4 million metadata records and 432 imagesThe 432 images belonged to 133 users. Metadata comprises about 490 million, 2.4 million and 174 million records. Counts include overseas usage and are not unique people. The 432 images and 133 users are not added to the reference sums because their correspondence with already counted data is unresolved. A November 5 correction said the 2.4 million records cover images uploaded mainly during about two days from January 1, 2016 and from January 1, 2020 (about 0.07% of all images), and that the about 174 million records relate to about 1.12 million accounts, of which about 57,000 have been closed.

2026.11.05

Possible leakUnauthorized accessThe system has been disconnected from the network, and the power usage and charges inquiry web service for registered customers on outlying islands and customers with power-sales contracts on the Kyushu mainland is suspended. Restoration was under consideration as of November 5.

4,139 power-usage recordsConsumption data (monthly and 30-minute values) with demand-side supply point numbers, and sales-of-power data (monthly and 30-minute values) with generation-side receiving point numbers. Names, addresses, phone numbers, email addresses, bank details and other contract information are not included, the company says.

2026.11.05Third report and service restart

Leak confirmedUnauthorized accessServices were suspended from about 10:40 on October 28. The corporate site reopened on October 29, and the web version reopened on November 4 with recorded viewing, revenue payout requests and Premier ticket sales and purchases. Live streaming and viewing are scheduled to resume partly on November 6 and fully on November 11. The apps will resume in stages after updated versions with security measures are released (as of November 5).

7 personal-data records (scope and scale of the server log data under investigation)The seven records with confirmed traces of external access are one record of a card expiry date and encrypted cardholder name, and six records of email addresses, activity history and similar data. The company says it does not hold card numbers or security codes. Separately, access to server log data partly containing account IDs and email addresses was confirmed; its scope and scale were still under review as of November 5.

2026.11.05Partial reopening from November 6

Leak confirmedUnauthorized accessThe official shop is closed. On November 5 the company announced that the shop would reopen from November 6 for product browsing only. My Account, new registrations, new orders, adding to cart and watch lists will resume after the third-party investigation and safeguards are completed; no date has been set.

Full card data possibly exposed for 2,800 people; last four digits etc. for 402,466 cards; order data for 5,356 people (all possible)The number of people behind the 402,466 cards is still being confirmed. Up to 202 of 7,774 orders from 5,356 customers were viewed but cannot be identified. The 384 ordering customers and 185 card-change customers are subsets of the 2,800. Overlap between groups is not disclosed. Only the largest group, 402,466 cards, is used in the totals.

2026.11.05Phone notifications begin for people whose names and phone numbers only may be affected

Possible leakUnauthorized accessReservation system suspended; no reopening date announced.

About 8,800 people

2026.11.05Exchange filing

Leak confirmedIncident at a vendor

Data on 209 people at three client companiesItems include names, departments, employee numbers, survey answers, short-survey results and stress-check results. The figures are based on a report from the provider Lafool and may change or grow. No unauthorized access to the systems of Ashita no Team or Wellness Communications has been found.

2026.11.05Update

Leak confirmedIncident at a vendor

387, 715, 52 and 93 people (four groups)On TAITO Odekake Navi, 387 photo-download applicants (organization, name, email, phone, purpose and IP address), 715 people who requested materials or made inquiries (organization, name, address, email, phone and inquiry content) and 52 site-operation contacts; on the Tsutaju site, 93 people who made inquiries (name, email, address, phone, inquiry content and other data). The scope was finalized on October 26.

2026.11.04Investigation update: revised counts and dedicated hotline

Possible leakUnauthorized accessStores and the web store remain available; point use and some internal systems are suspended.

About 2.74 million customer records; about 10,000 business contacts; about 24,000 employee recordsCustomer data: name, birth date, gender, address, phone number, email and member ID (no payment data or passwords). Employee data cover social-insurance enrollees from June 2013 to November 2022, including some former employees: basic details and social-insurance calculation data, with no My Number data or special-care personal information. The approx. 10,000 business contacts are the October 23 figure.

2026.11.04

Possible leakRansomware

Member data of 142,591 accountsMember data that may have been affected. Items are names, email addresses, birth dates, gender, addresses and phone numbers, depending on the member. The company says it holds no card data.

2026.11.04Reopening update

No external leak foundUnauthorized accessApps and web services were suspended from 21:00 on October 17. Most reopened on October 29, GEO Arekore Rental on November 2, and home-delivery rental and the GEO Mobile UQ mobile online store on November 4. No reopening date is set for GEO Online Store, GEO Mobile Online or 2nd STORAGE.

No external leak of personal or confidential data foundThe source does not disclose an information count.

2026.11.04Final report: investigation complete

Leak confirmedUnauthorized access

317,971 member IDs and other items (counted per item)Counts are per data item, not people: 311,451 hashed passwords, 29,515 encrypted card-related records (first and last four digits and others), 309,759 names, 309,668 phone numbers and 311,426 emails, among others.

2026.11.04Third report: count refined to 39,505; dedicated hotline

Leak confirmedUnauthorized accessWebsite functions suspended since October 26; as of November 4 the suspension continues for investigation and safety checks.

39,505 records31,781 email-inquiry records, 5,698 school-lunch site members (including encrypted passwords), 1,613 press inquiries, 354 web entrants to a cosmetics campaign and the names of 59 employees who handled inquiries.

2026.11.04Final report: investigation results

Leak confirmedIncident at a vendor

396,920 peopleNames, phone numbers, email addresses and other data of applicants, contract signers and corporate users. The 30,067 people who signed employment contracts via ApplyNow Sign include, for some, My Number (number only), bank account data, basic pension numbers and residence-card numbers. ID-document images, interview videos and card data are not included.

2026.11.04Second report

Leak confirmedUnauthorized access

4,317 login email addresses and related data; 16,970 inquiry and other personal records of three client companiesThe 4,317 records are ferret One users’ login email addresses and site names. The 16,970 records are 16,968 lead and inquiry records (names, contact details, etc.; de-duplicated) of one client and one inquiry record each of two other clients. Separately, non-public page content of four clients, containing no personal data, was viewed or taken. Login passwords and payment data are not confirmed as viewed or taken.

2026.11.04Deletion of former members' data announced

Possible leakUnauthorized access

Count not disclosedNames, birth dates, gender, phone numbers, addresses, emails, career history and password hashes (items vary by member).

2026.11.04Developer's findings: no evidence of malicious activity on this store

Leak not confirmedIncident at a vendor

Developer's investigation found no evidence of malicious activity on this storeFrom 19:06 on October 14 to about 1:32 on October 15, malicious code redirecting to a fake checkout may have loaded on some shops using the app; customers may have entered card details on the fake site. No data were taken from the shop’s database. The wishlist feature is suspended as the vendor’s precaution.

2026.11.04Joint reporting to the PPC opened for customers

Possible leakUnauthorized access

Number under investigation

2026.11.03

Leak confirmedIncident at a vendor

164,180, 4,762 and 209 records (three groups by data items)Orderer (recipient) names in kana only: 164,180; names and addresses: 4,762; names, addresses, phone numbers and postal codes: 209. Order dates, store names and addresses and item names were also taken in some cases. Card data, IDs and passwords are stated not to have leaked. 7NOW is operating normally.

2026.11.03

Possible leakUnauthorized access

Count under investigationSome customers who used the old Denny's app are affected. Items are member codes, email addresses, birth dates, gender, prefecture, favorite restaurant and children's birthdays. The company says it does not hold names, addresses, phone numbers, passwords or card data. Only access records for October 7 have been reviewed; whether data were taken and how many people are affected are under investigation.

2026.11.02

Leak confirmedUnauthorized access

Approx. 3 million peopleUser IDs, nicknames, names, postal codes, addresses, phone numbers, emails, gender, birth dates, skin type and hair type of members at the time of access, including those who later left. Login passwords and card data are stated to be excluded. This is a separate notice from the September file-transfer case.

2026.11.02

Possible leakUnauthorized accessThe Netmile and Sugutama sites are suspended to prevent secondary damage; no restart date is set.

Up to approx. 5.49 million people (including former members)Names, emails and other reward-exchange information. The company states it holds no card or My Number card data.

2026.11.02

Leak confirmedUnauthorized accessNojima Online and the used-smartphone buyback site are temporarily suspended; reopening will be announced once safety is confirmed.

Approx. 7 million recordsNames, birth dates, gender, addresses, phone numbers, login IDs, encrypted passwords and emails of members of the two sites. Former members are excluded. The company states it holds no card data.

2026.11.02Related update

Lookup confirmedRansomwareThe backup service has resumed and backups can be extracted for 206 customers; this is not full recovery of the four affected zones. Portal reopening remains undated.

Up to 31 personal-name/email records; 495 organizations affectedRegistration data was queried for up to 71 customers, including up to 31 personal-data records at 31 customers. Four password changes are not added; the 495 affected organizations and 206 recoverable backups are not information counts.

2026.11.02Related update

Leak or possible leak confirmedUnauthorized accessExternal access was blocked at 13:20 on October 23 and the service was suspended in stages. It remained suspended as of October 26.

Count and number of client companies not disclosedAffected data include information on client companies’ admin-screen users (names, email addresses and encrypted passwords), LINE official account settings, and personal data of the clients’ end users (items vary by client). No card data are held. Client UCC Ueshima Coffee announced that 5,529 of its email addresses were confirmed as leaked.

2026.11.02Second report

Possible leakIncident at a vendorThe affected entry intake was suspended; on October 27 entries for one campaign resumed through the member system only.

14,594 records (excluding duplicate entries; revised from approx. 15,500 in gross)Names, ages, gender, occupations, marital status, household composition, phone numbers, emails, addresses and survey answers. The second report also gives a combined 14,848 people including 254 who entered both campaigns. Licence, card and bank data are excluded. The contractor is not named. The October 27 blastmail-related notice is a separate incident.

2026.11.02Notice by contractor GMO Payment Gateway

Leak confirmedIncident at a vendorPart of the service was suspended from October 31; resumption was announced on November 2.

69 accounts in totalBreakdown: 63 with names, emails, phone numbers and partial addresses; three with Vpreca numbers, dedicated security codes, expiry dates and names; three with partial Vpreca numbers. The three accounts with full card data were closed on October 31. The contractor GMO Payment Gateway describes the same data as possibly stolen. This is separate from the Ymirlink-related case announced on October 28.

2026.11.02

Possible leakIncident at a vendor

19,933 records (including duplicates for the same customers)Names, addresses, phone numbers, order details and delivery addresses of customers who ordered made-to-order curtains at MUJI from April 10, 2018 to January 25, 2022. Card data and emails are excluded. The server is managed by Nanotec, a subcontractor of MN Inter-Fashion. This is separate from the MUJI app case.

2026.11.02

Possible leakUnauthorized access

Count not disclosed (login email addresses)Users’ login email addresses may have been viewed or obtained; other registration data such as names are stated to be excluded.

2026.11.02

Partial leak confirmedIncident at a vendor

Up to 9,086 people (54 of whom may have had bank-account numbers exposed)Names, addresses, phone numbers, emails, birth dates, gender, bank-account numbers and holdings of customers who opened accounts to apply for the digital bonds. The 54 are a subset. No card data were entrusted. None of the notices state a link to the NTT DATA STdirectServices case.

2026.11.02

Leak confirmedUnauthorized access

Approx. 90,000 people and six other groups(1) About 90,000 group and partner-company employees (names and emails); (2) 7,323 Mal de Shine registrants; (3) 7,173 applicants for 2026 new-graduate business roles; (4) 1,097 contacts stored on two company phones; (5) 324 Monte Bussan and partner employees; (6) 96 Izutsu Maisen delivery customers and delivery staff; (7) 25 supplier employees. Payment data are not included.

2026.11.02Trade Works third report

Leak confirmedIncident at a vendor

4,975 people

2026.10.31

Possible leakIncident at a vendorNTT DATA suspended the service; it states there is no current impact on benefit delivery because no bonds are currently eligible.

Count under investigation; distributors and issuers disclose separatelyNTT DATA gives no count. Rakuten Securities’ gross 362 records span three bond issues and include the Kagome (109) and JR West (2) figures. Kintetsu Group Holdings’ 2,678 records (names and purchase amounts) may overlap with distributors’ figures. All are shown as related disclosures and not added.

2026.10.31

Leak confirmedIncident at a vendorThe member platform has been urgently suspended since 22:00 on October 29; no reopening date is set.

1,889 customers39 customers: names, emails, addresses, birth dates, phones, nationality, dividend accounts and suitability data; 1,850 customers: names and units purchased. No card data is held. No alteration of holdings or on-chain transfers has been found.

2026.10.30Wording corrected

Partial leak confirmedUnauthorized access

Up to 4,238,242 recordsLogin IDs, hashed passwords (wording corrected on October 30) and email addresses. The figure is customers possibly affected; confirmed leaks are not separated. Names, addresses and card numbers are stated not to have leaked.

2026.10.30

Leak confirmedUnauthorized accessThe Matsuya app and related services including the website are suspended.

2,000 app members (up to 3,000) and 2,377,127 Matsuben Net and other usersApp-member data includes encrypted passwords; the 3,000 maximum includes the 2,000. Overlap between categories is not stated. The company says it holds no card data.

2026.10.30

Possible leakUnauthorized accessThe server was isolated from external networks and some related internal business systems were stopped.

Approx. 1.2 million member records in grossNames, addresses, phones, birth dates, gender and emails. The figure is gross and details are being confirmed; card or other payment data and facial data are not found to have leaked.

2026.10.30Related update

Leak confirmedUnauthorized accessLindt suspended its online shop from 16:00 on October 21; this is not a platform-wide shutdown.

3,147,469 member records at one storeLindt discloses the same member records and is not added again. Credit card data is excluded. On October 30 Lindt revised its figure to 3,147,377 after removing double-counted members; the totals use the platform’s figure.

2026.10.30Second report: reservation-site leak identified

Leak confirmedUnauthorized accessReservation site suspended October 16; E-STORES and Remo Order suspended October 17. As of the October 30 second report some services remain suspended for a full system review; no reopening date announced.

Approximately 1.26 million records / 6,243 reservation-form entriesIn addition to some fields in approximately 1.26 million H2O ID records, the second report found that 6,243 reservation-form entries (including participant application details; about 3% of 188,590 bookings) were leaked. The customer information at E-STORES and Remo Order mentioned in the first report was not found to have leaked.

2026.10.30Third report: refund bank account data confirmed leaked

Leak confirmedUnauthorized access

About 14.64 million customer records and card data of up to 6,140 people; 32,341 refund bank accounts (leaked); about 936,000 partial card records and about 118,000 travel insurance records (possible)About 4.13 million hashed-password records are a subset. Including the third report’s 32,341 refund bank accounts (confirmed), about 936,000 masked card records (about 414,000 people, 12 with full numbers) and about 118,000 travel-insurance records (possible), overlap between groups and with the other two events is unresolved, so they are not added.

2026.10.30Joint announcement

Possible leakUnauthorized accessLifeNet has placed some functions of “au no Seimei Hoken,” including applications, under maintenance.

22,541 records across six categoriesSix categories by data combination (4,524; 226; 8,434; 3,662; 4,888; 807). No total is printed. Passwords, card, bank, identity-document and insurance-contract data are excluded.

2026.10.30Possible data leak disclosed

Possible leakRansomwareAdministrative terminals were suspended on September 24, restarted on the 27th and normal operations resumed on the 28th; no impact on education, research or clinical systems was found.

Approx. 80,000 people; patient-data count under investigationStudents, staff, former students and staff and other parties; includes names, birth dates, addresses, contacts, passwords and sensitive data such as clinical department and diagnoses. Patient-data counts remain under investigation and are not included.

2026.10.30Announcement

Possible leakUnauthorized accessThe sites were cut off and placed in emergency maintenance on October 19 and have been progressively restored since October 20 after fixes.

4,079 member registrations and three inquiriesCounts are per site; overlap is not stated.

2026.10.30Sixth report: investigation results and scope

Leak confirmedMalware infectionPlanned restart of telephone dispatch and selected services

About 292,900 people across six groups (leaked or possibly leaked)About 13,100 hire-car customers, 60,100 drivers and staff, 107,900 job applicants, 37,700 family members, 2,100 business contacts and 72,000 accident counterparties. Some records include ID documents, My Number or health data; taxi passenger data is not included.

2026.10.30Exposure figures updated

Leak confirmedUnauthorized accessExternal access to the research support site suspended

369 files containing personal data (175 people as initially reported)Updated from 367 to 369 files on October 30. Includes 200 identity documents, 146 health examination results and 23 radiation-worker certificates (up from 21); seven people had Individual Numbers included (up from six). No update to the 175-person figure was given. The total of 2,419 downloaded files is not added.

2026.10.30Fourth report: investigation results

Possible leakRansomwareInternal systems were stopped in August; the third report did not specify their recovery status.

Personal-data count and fields under reviewPotentially includes sales and transaction information and personal data of customers, inquirers and employees. No count disclosed.

2026.10.30Third report

Leak confirmedMisconfiguration

2,492 companies and 45,030 peopleNames, emails, linked-service names and custom attributes such as employee numbers in bulk-operation files (44,836 people), plus names, addresses, phone numbers and emails of billing contacts (194 people), de-duplicated by email. The third report updated the provisional 2,007 companies and 37,747 people. Passwords, MFA data and payment data are not included. Before June 7, 2021 no access logs exist, and that period is treated as one of possible acquisition.

2026.10.30

Possible leakUnauthorized access

Approx. 3,600 records, including about 900 relating to non-ministry peopleEmail addresses, names and other data. The closed network for classified information and consular systems such as passports were not affected, according to the ministry.

2026.10.30JAL/JTA announcement

Viewing traces confirmedIncident at a vendor

Approx. 37,800 ANA and 92,000 JAL/JTA customersANA: about 36,100 (names, booking references, flight details) and about 1,700 (also email, phone, passport number and nationality); JAL/JTA: about 90,000 and about 2,000 with similar items. Breakdowns are not added. Each airline’s figure covers its own reservation records. JAL states that card numbers and passwords were not exposed.

2026.10.30

Possible leakUnauthorized access

Up to 7,622 peopleNames, addresses, phone numbers, emails and purchase history, still under review; card data is stated not to have leaked.

2026.10.30Second report

Possible leakUnauthorized access

24,480 customer recordsNames, vehicle registration numbers, store and staff names and cost or repair amounts for customers from November 2024 to September 2026; no addresses, phone, bank or card data. The 825 spoofed emails in the first report are messages sent and are not added.

2026.10.30

Possible leakUnauthorized access

5,096 accounts alteredMember numbers, delivery details, purchase history and last four card digits of altered accounts may have been viewed. Up to 5,520 delivery addresses belong to the same accounts and are not added; 27 suspicious orders and 71 fraudulent registrations are counts of actions.

2026.10.29Notice to client businesses added

Partly confirmedUnauthorized access

1,536,322 records

2026.10.29Fifth report: some functions resumed

Leak confirmedUnauthorized accessOn October 29 browser reading, the subscription reading service, member-detail changes and cancellation requests resumed; purchases, the bookshelf app and new registrations have not.

319 registration records and up to about 4.2 million log recordsLogs may include repeated information about the same users. Their overlap and scope relative to registration records remain unresolved, so neither figure is added to the reference sums.

2026.10.29

Possible leakUnauthorized access

7,162 merchant registration recordsUser names (company or personal names), email addresses, internal system identifiers and similar data. Login passwords, end-user data, card data, bank-account data, transaction data and ID documents are stated to be excluded. Order intake and payment processing were not affected.

2026.10.29Related update

Leak confirmedUnauthorized access

Count under investigation (reservation data of guests at some contracted facilities)Reservation data including names and contact details; the exact items and count are under investigation. Card data are not stored. No site-controller integration data leaked.

2026.10.28Second report

Leak not confirmedRansomwarePart of the services for SEMS customers and partners has been affected since October 17; as of October 28 no recovery date is set.

No external leak of personal or customer data confirmed; investigation continuesThe source does not disclose an information count.

2026.10.28Unauthorized access and leak announced

Leak confirmedUnauthorized accessThe Customer Web Service, app and related services have been suspended since 08:00 on October 28; restoration timing is undecided.

Approx. 385,000 recordsNames, birth dates, addresses, phones, policy numbers and contract details of Medicare Life policyholders and insureds handled by Sony Life as agent. Medicare Life’s identical figure is not added; the scope is still being identified.

2026.10.28METI press release

Under investigationUnauthorized accessThe site is out of operation; reports are accepted by email until it is restored.

Whether data leaked is being checkedThe source does not disclose an information count.

2026.10.28

Leak confirmedIncident at a vendorThe service has been suspended since 17:00 on October 21; no restart date is set.

29,465 peopleNames, kana, birth dates, gender, postcodes, emails, customer numbers and payment-management numbers; no card numbers. Credit Saison reports the same figure, which is not added.

2026.10.28Unauthorized access and leak announced

Leak confirmedUnauthorized accessExternal access to customer pages and parts of the website is blocked and some content is unavailable.

57 customersNames, addresses, customer-page login IDs and passwords and contract, usage and billing details; bank and card data are excluded.

2026.10.28Second report: up to about 230,000 records

Data theft confirmedUnauthorized access

Up to about 230,000 personal-data records (obtained or possibly obtained)Names, affiliations, phone numbers and emails, among others. Includes duplicates and data that cannot identify individuals on its own; under review. No card or bank data of business partners or external parties leaked, according to the company.

2026.10.28

Leak cannot be ruled outRansomware

Count not disclosedNames and partial addresses and phone numbers of customers who requested watch repairs at group stores since September 2025.

2026.10.27

Leak confirmedUnauthorized access

2,141,986 So-net member records and 443,495 plala (S course) member recordsNames, phones, emails, user IDs, birth dates, gender and connection IDs (no passwords). Separately, email addresses with mail passwords (54,401 addresses across four services), 16 bank-account records and seven notice records leaked; they likely overlap with So-net members and are not added. No card data.

2026.10.27Final report / service resumed

One user’s data confirmed obtainedUnauthorized accessThe service was suspended on October 5 and resumed on October 27.

308 users, including one whose email was confirmed obtainedBirth dates and gender of 308 users were externally viewable; for one of them, the email address was obtained and could be linked.

2026.10.27Notice to users

No personal-data leak confirmedUnauthorized accessThe system was stopped on October 25 and will not be reused; disruptions to some e-gift exchanges are being resolved progressively.

No personal-data leak confirmedExpected loss of about JPY 550 million (a monetary amount, not an information count). This is separate from the RAKUS Lite Cloud blastmail incident.

2026.10.27

Possible leakUnauthorized accessSystem suspended to prevent further damage; reopening undated.

Up to 133 recordsNames, emails, telephone, mobile and fax numbers. This concerns a different system from the separately reported 743-record JETRO website incident.

2026.10.27Investigation results: about 124,000 people

Possible leakUnauthorized access

About 124,000 peopleAbout 54,000 employees and 70,000 former employees; about 96,000 involve only addresses and phone numbers. Updated from about 120,000.

2026.10.27Second report: individual notices

Possible leakIncident at a vendor

About 124,000 records

2026.10.27

Leak confirmedUnauthorized access

Data on 73 patients viewed; unauthorized logins to 14 patient accounts and 6 accounts of 5 medical institutionsAt three of the institutions whose accounts were accessed, data on 73 patients (names, email addresses, phone numbers, dates of birth, addresses, gender, medical record numbers, patient card numbers, consultation status and doctors’ notes) were viewed. Through patient accounts, names, email addresses, phone numbers, dates of birth, addresses, gender and patient codes may have been viewed. For some patients, prescription images, consultation records and service usage history are also affected. Names and email addresses of medical staff are also affected; their number is not stated. Identity documents and passwords are not included.

2026.10.27

Leak confirmedUnauthorized access

14,034 campaign participant recordsParticipant data from three MOS Burger social media campaigns (receipt challenge 2,995, Halloween giveaway 11,001 and VALX collaboration receipt campaign 38): X or LINE user names and IDs, entry times, draw and coupon status and similar data. Names, addresses, phone numbers, email addresses and card data were not collected and are not included.

2026.10.27

Leak confirmedIncident at a vendor

10,194 closed beta applicants, 71 staff and related persons, 5 survey respondents and 3,034 customer support inquirersApplicant data are email addresses, IP addresses, application times and device type. The 71 persons are employees of Bushiroad and affiliates (including names) and contractor employees (phone numbers). The 3,034 support inquirers contacted support between September 24 and October 14; besides inquiry text, the data include, depending on the inquiry, device information (2,832), player IDs (2,820), email addresses (311), names (257), phone numbers (11) and addresses/postcodes (6), all subsets of the 3,034. Passwords, card data and similar items are not confirmed as leaked.

2026.10.26

Data confirmed as targetedUnauthorized access

Up to approx. 40,000 bookers and up to approx. 2.6 million logged-in usersPayment data (issuer number, last four digits, name, expiry) for up to about 36,000 bookers is a subset. Overlap between bookers and logged-in users is not stated. Full card numbers, passwords, ID documents and addresses are excluded.

2026.10.26Second report: counts of possible exposure

Possible leakUnauthorized accessSome services suspended following external connection restrictions.

Up to about 6 million member records, 230,000 subscription records and 800 renovation photo records (possible)All are maximum counts of possible exposure; the renovation photos include two driver-licence images, one My Number card and five bank account numbers. The company says these are not confirmed leak counts and it holds no card data.

2026.10.26

Leak confirmedIncident at a vendorNew member registration is suspended (as of October 26).

197 email addresses, relationship to the person with a disability, and disability categoryNo counts are given for the relationship and disability-category items. Names, addresses and phone numbers are stated to be excluded.

2026.10.26Update

Under investigationCyberattackThe core system went fully down and order intake and shipping were temporarily suspended; orders are accepted by fax to branches until recovery.

Whether data leaked is under investigationThe source does not disclose an information count.

2026.10.26

Data confirmed as targetedUnauthorized access

Up to approx. 860,000 logged-in users and up to approx. 40,000 property-staff accountsUsers’ names, emails, phones and countries of residence, and property staff’s account names and emails on the admin screen.

2026.10.26

Possible leakUnauthorized accessThe web system and server were stopped on October 14; order-taking and shipping operations continue normally.

Count under investigationThe source does not disclose an information count.

2026.10.26

Possible leakUnauthorized accessLogistics system temporarily suspended while investigation and recovery proceed.

Count under investigationThe source does not disclose an information count.

2026.10.26Third report / some exposure confirmed

Some exposure confirmed; scope under investigationUnauthorized accessMultiple services suspended; phased resumption was planned from October 26.

1,213 customer company records and sales data for 875 companies; personal-information count under investigationOverlap between the company and sales-data figures and the number of personal-information records are unconfirmed; neither figure is included in the gross information total.

2026.10.26Investigation results and current response

Leak confirmedUnauthorized accessIntegration with futureshop stopped at 17:40 on October 16. As of October 26 penetration testing was under way with no restart date; on October 30 the company issued preparation guidance for resuming Yahoo! Shopping and related integrations.

Number under investigation

2026.10.26Third-party investigation report published

Leak confirmedUnauthorized access

Up to about 50,000 records in Japan

2026.10.25Distinct events and recovery explained

Leak not confirmedUnauthorized accessFour potentially affected servers were stopped October 21; affected stores reopened at 23:35 on October 22.

Count undisclosedFour counts stopped servers, not leaked information records. An external investigation is being arranged.

2026.10.24Exposed data fields corrected

Leak confirmedUnauthorized access

2,155,345 records

2026.10.24

Leak confirmedUnauthorized accessThe app service was stopped on October 22 and resumed on the 23rd after the vulnerability was fixed.

373 membersMember data, bank-account data, card data (last four digits, expiry and others), Charika account data and betting history.

2026.10.24

Possible leakLoss of media

Affected people and document count unknownApproximately 300 forms is the caller’s claim, not a verified count, and is not included in totals.

2026.10.23

Leak confirmedUnauthorized access

1,424,748 records (ID numbers, PINs and balances)Of these, 569,224 were issued IDs and 855,524 unissued IDs. The company states no personal data were involved. Issued IDs were at risk of misuse but have been dealt with, and no actual loss is reported.

2026.10.23Second report / retail-site impact

Leak confirmedUnauthorized access

11,774,247 records worldwideAdditional attributes for 43 accounts, 196 unauthorized password changes and 19 Japanese retail accounts are subsets; the headline is not a Japan-only count.

2026.10.23

Possible leakUnauthorized access

About 6.19 million user-information recordsIncludes information that is not personal data. Approximately 66,003 email addresses and other fields are subsets.

2026.10.23Fifth report / final counts and image-retention policy

Leak confirmedUnauthorized access

6,628,007 Times Car recordsWithin the same account group, 1,464,800 ID images show exfiltration traces and 891,602 show access only. Overlap with Times Club’s five identity records, 135,436 linked IDs and other fields is unresolved.

2026.10.23Tracking resumed / maximum count disclosed

Possible leakUnauthorized accessWeb parcel tracking resumed October 23; the tracking API and specified booking and delivery-change services remain suspended.

Up to approximately 53.23 million records, including duplicatesSubstantial duplication remains after partial deduplication. This is neither a unique-person count nor a count of confirmed exfiltration.

2026.10.23

Under investigationUnauthorized accessAffected services suspended from about 16:13 on October 22; recovery outlook to be announced.

Personal-data impact under investigationThe source does not disclose an information count.

2026.10.23Related customer disclosures

Possible leakUnauthorized accessSome web services suspended, including browsing, registration, login, applications and surveys.

Under investigation; overall count undisclosedCustomer disclosures are related information within the same incident and are not added to an unknown overall count.

2026.10.23

Some leakage confirmedUnauthorized accessNew reservations suspended for five services; bookings completed by 16:30 on October 20 remain usable.

Up to about 730,000 customers; up to 6,000 license images in a separate database remain under investigationThe confirmed portion is not separately quantified. The 6,000 images in a separate database are not added to the customer maximum.

2026.10.23

Leak confirmedUnauthorized accessat-link and related services suspended since October 14; no completed reopening announced.

Count under investigation

2026.10.23Possible viewing of registration data

Possible leakUnauthorized accessDora-Tora, My Route and route-email services suspended; reopening undated.

Affected count undisclosed

2026.10.23

Leak confirmedUnauthorized accessExternal access and application forms suspended; October 28 is a planned reopening.

746,277 customer records; 750 business-contact/employee records; 1,000 device recordsEleven customer records also include names and addresses; overlap with other categories is unresolved.

2026.10.23Investigation and reopening preparations

Possible leakUnauthorized accessService suspended for emergency maintenance; reopening undetermined.

Affected count undisclosed

2026.10.23

Lost; no leak confirmedLoss of media

Personal data of 1,932 people (four hard drives)1,037 people from companies, the national government and municipalities, and 895 local residents and others. Most entries contain only names; some include addresses or phone numbers. No leak or other secondary harm has been confirmed so far.

2026.10.23

Leak confirmedUnauthorized access

Count undisclosed

2026.10.23Third report: information possibly exposed

Possible leakRansomware

Affected count undisclosed

2026.10.23Investor Q&A

Possible leakUnauthorized access

Affected count undisclosed

2026.10.23Second report / affected counts

Leak confirmedUnauthorized access

25,775 m3.com members and others; 2,260 pharmaceutical-company contactsThe six and 264 people with email-address exposure are subsets of their respective groups.

2026.10.22

Access confirmedUnauthorized accessThe affected system is to restart after safety checks; NP Atobarai itself operates normally.

28,884 transactionsNames and addresses (company and department for business users) and whether invoices were returned.

2026.10.22

Partial leak confirmedUnauthorized accessService suspended and external access blocked.

Six confirmed / up to 595 people including the sixCredentials for six people were confirmed exposed. The maximum 595 database subjects include these six; they are not added again.

2026.10.22Third report: all functions resumed

Leak not confirmedUnauthorized accessSome system integrations had been suspended; on October 22 service resumed for all app functions. The latest version of the app is required.

No personal-data exposure found in the investigation

2026.10.22Internal systems restored

Under investigationRansomwareInternal systems restored and normal operations announced on October 22; the website remains a simplified version.

Scale not disclosed

2026.10.22Potential personal-data exposure disclosed

Possible leakUnauthorized access

Affected number and period under investigationThe source does not disclose an information count.

2026.10.21Update

Possible leakUnauthorized accessAll related services suspended from around 17:00 on October 17.

Up to 3,709,551 recordsTotal across inquiries, reviews, dealers and staff. The 447,670 records with detailed addresses are a subset.

2026.10.21Restoration status updated

Possible leakUnauthorized accessAs of October 21, 17 sites were restored and three accept inquiries through interim pages; member pages operate normally.

10 applicants and three administrators

2026.10.21

Under investigationUnauthorized access

Affected scope and count under investigationThe affected sites and information count have not been disclosed.

2026.10.21Second report: scope narrowed to up to 18,000 records

Possible leakUnauthorized access

Up to 18,000 recordsRevised from the first report’s up to 542,513 records across three services after narrowing the scope to @nifty Hikari.

2026.10.20Security measures announced

Leak confirmedUnauthorized access

10,788,963 records

2026.10.20Second report

Leak confirmedUnauthorized accessThe second report states that the e-commerce site operates normally.

49,191 recordsCompany and salon names, names, phones, emails and password hashes; addresses, purchase history and card data are not found to have leaked.

2026.10.20Password resets reopened

Possible leakUnauthorized accessThirteen affected accounts temporarily suspended; password reset functionality was reported reopened on October 20.

13 accounts

2026.10.20

Possible leakUnauthorized accessThe affected system was suspended after unauthorized access was detected.

Up to 730 records

2026.10.20

Possible leakUnauthorized accessAll system functions suspended. Only functions needed for completion reports and related work are planned to reopen after checks.

23,918 people at 16,950 businesses, preliminaryPeople and business counts describe the same scope and are not added together.

2026.10.20

Leak confirmedUnauthorized accessFile encryption made customer systems unavailable; restoration scope is not disclosed.

Number undisclosed

2026.10.20Announcement

Possible leakRansomware

Account data by year (up to 11,106 student records and others)School names, names, kana, account names and passwords of elementary and junior-high students and staff by year (2020, 2025, 2026; likely overlapping) and admin passwords for all 39 schools. Hokuyo High School files hold 179–200 records each. No total is published.

2026.10.19EC app reopened

Leak confirmedUnauthorized accessEC app resumed at noon on October 19; the notice does not establish reopening of the entire online store.

Up to 817,215 peopleUnauthorized viewing is confirmed; the maximum scope is counted only as possible exposure.

2026.10.19Reservation function resumed

Leak confirmedUnauthorized accessReservation function resumed October 19; app update required.

26 recordsNot added to the LAWSON ID event.

2026.10.19

Leak confirmedUnauthorized access

Number undisclosed

2026.10.16

Leak confirmedUnauthorized access

Approximately 1.83 million recordsAbout 120,000 email records are within the 150,000 subset. The 1.83 million total is counted once; separate from the Google Workspace and Microsoft 365 incidents.

2026.10.16Password update

Leak confirmedUnauthorized access

22,519,960 possibly exposed recordsExfiltration is confirmed, but not for all 22,519,960 records; the full scope is counted only as possible exposure.

2026.10.16Announcement

Leak confirmedUnauthorized accessService reopened at 13:00 on October 9.

About 5.26 million customer records, 50,000 delivery-recipient records and 4,100 merchant recordsAbout 490,000 email records are a customer-data subset. Overlap across customer, recipient and merchant categories is unresolved; excluded from the gross reference sum.

2026.10.16Final report / confirmed scope

Leak confirmedUnauthorized access

Approximately 23,356,000 people across 7,858 storesFinal-report estimate after matching records; some duplication may remain. Partial card information for about 2,096,900 people is a subset. Store counts are not added, and this replaces the earlier maximum cumulative count.

2026.10.16Announcement

Leak confirmedUnauthorized accessCoupon use and prepaid-ticket purchases affected, with delivery delays; full restoration not announced.

1,789 employee/vendor records; 55 customer records potentially affected

2026.10.16

Leak not confirmedIncident at a vendorMy Page login unavailable from about 19:50 on October 15 to 06:00 on October 16; restoration announced.

Number not disclosed

2026.10.16Second report / alleged publication under investigation

Under investigationRansomwareBusiness systems at some group companies affected; recovery work continues in the second report. The initial notice reported no effect on train operations.

Number under investigation

2026.10.16Related update

Possible leakIncident at a vendor

Up to 8,341 bookings (5,614 people)Katakana booking names, phone numbers and booked-bus details. The 8,341 bookings and 5,614 people describe the same scope and are still being finalized. Card, bank, address, email and password data were not stored.

2026.10.15

Leak confirmedUnauthorized access

Approximately 11.18 million recordsPublished approximate record count; individual data fields are not added.

2026.10.15Usage history service resumed

Leak confirmedUnauthorized accessOn October 15 the company announced the usage history service had resumed after investigation and countermeasures, stating no passwords were leaked.

521 records

2026.10.15Third report / scope

Theft confirmed; full scope remains possibleUnauthorized access

Up to 593,000 peopleTheft was inferred from impersonation emails containing private order data; the maximum scope is counted only as possible exposure.

2026.10.15

Unauthorized viewing confirmedMisconfiguration

483 files sent by 139 schoolsCounts viewed attachments. The number containing personal information and the number of affected people were not disclosed; excluded from gross information totals.

2026.10.15Update

Leak confirmedUnauthorized access

About 59,000 email-address recordsEmail addresses of Metpo members whose delivery had been stopped because messages could not be delivered. The affected server held no member information other than email addresses.

2026.10.14

Possible leakUnauthorized accessThe site was closed on detection on July 29 and has reopened after fixes and checks; the reopening date is not stated.

Approx. 4,400 recordsNames, emails, phones, addresses and inquiry text in the inquiry-form log; no sign of outflow found. The site operator Chubu Insatsu published the same notice.

2026.10.14News posting

Possible leakUnauthorized access

697,209 usersPhone numbers and user IDs, plus names, emails, birth dates, gender and addresses where registered; not every item for every user. Passwords, payment data and usage history are excluded. Disclosures by adopting stores are not added.

2026.10.14

External leakage not confirmedUnauthorized accessForensic investigation and removal of unauthorized access mechanisms were completed, with normal operations resumed.

Multiple accounts; information count undisclosedThe source does not disclose an information count.

2026.10.14Second report / confirmed exposure count

Leak confirmedUnauthorized accessService suspended from October 3; no reopening date in the second report.

894,082 recordsThe second report confirms the personal-data total. The previous maximum of 948,498, 9,068 records with personal data already deleted, 45,348 not extracted and 611 unauthorized point exchanges are not added.

2026.10.13Third report

Possible leakRansomwareOrders via official websites and apps suspended; phone, in-store, Demae-can and Uber Eats orders continue

Up to about 6.5 million recordsNot the number of confirmed leaked records.

2026.10.13Renewed suspension and reopening plans

Leak confirmedUnauthorized accessSuspended again from October 10; limited reopening planned from October 16

About 307,000 members (estimated)Includes about 126,000 with email addresses and about 42,000 employee and demo accounts.

2026.10.13Third report / investigation results

Leak confirmedUnauthorized access

136,464 peopleIncludes 109,311 people whose address information was involved; this subset is not added.

2026.10.13Updated disclosure

Leak confirmedUnauthorized access

7,919 people across 8 propertiesThe October 13 notice retains 7,919 people across 8 properties; property counts and related disclosures are not added.

2026.10.12

Possible leakUnauthorized access

Number not disclosed

2026.10.11Related update

Possible leakUnauthorized accessNormal operation announced

Up to about 4.45 million peopleReservation holders’ contact details such as names, phones and emails, and booking data; no card data is held. Individual hotel notices are not added.

2026.10.09

Leak confirmedUnauthorized access

Up to about 6.43 million membership-number recordsCount of membership numbers, not unique people.

2026.10.09

Leak confirmedUnauthorized access

Up to 3,885,771 recordsLeakage of every record in the maximum figure has not been confirmed.

2026.10.09

Part confirmed / part possibleRansomwareAll stores reopened

310 files publicly exposed; 1,044,906 records potentially affected27 applicants and employees were notified. These figures use different units and scopes and are not added.

2026.10.09Precautionary portal suspension

Leak confirmedRansomwareOwners portal suspended as a precaution

207,773 possibly affected recordsThe figure does not confirm leakage of all 207,773 records.

2026.10.09Second report

Possible leakUnauthorized access

Up to 323,000 email records; 362,000 partial card-data recordsMaximum figures for separate data fields, not a combined count of people.

2026.10.09

Possible leakUnauthorized access

Number under investigationTraces of file exfiltration were found; customer-data exposure remains under investigation.

2026.10.09

Leak confirmedUnauthorized access

449 resumes; 1,845 employment-history documents

2026.10.09

Leak confirmedUnauthorized access

About 26,000 member records; about 36,000 reservation records

2026.10.09

Possible leakUnauthorized access

Number not disclosed

2026.10.09

Leak / possible leakUnauthorized access

17,780 records, including duplicatesOther affected information is still being counted. Not added to the other two events.

2026.10.09

Viewed / possibly viewedMisconfiguration

About 12,000 reservationsNot a count of people including companions. Not added to the other two events.

2026.10.08Related update

Possible leakUnauthorized access

Up to 713,126 cumulative inquiry recordsCount of inquiries, not unique people.

2026.10.08

Leak confirmedUnauthorized access

38,509 contractsA customer with multiple contracts may be counted more than once.

2026.10.07

Possible leakUnauthorized access

Up to 627 peoplePhone numbers, addresses, email addresses and card data were not included.

2026.10.07

Leak confirmedUnauthorized access

Up to 7,200 email addresses; up to 6,000 transaction recordsSeparately, data for 4,778 employees. Categories are not added together.

2026.10.07

Leak confirmedUnauthorized access

A list of about 2,200 people; details for 3 of them

2026.10.06

Leak confirmedUnauthorized access

Up to 1,735,154 people

2026.10.06

Possible leakUnauthorized access

174,933 people

2026.10.06

Possible leakUnauthorized accessServices restricted from October 2; a temporary site was available on October 17, while login and other member functions remained unavailable.

About 514,000 healthcare professionals, plus other categoriesAbout 44,000 with email addresses and other data are a subset. Separately, about 700 employees.

2026.10.06

Possible leakLoss of media

About 200 images

2026.10.06Additional disclosure of possibly exposed data

Possible leakUnauthorized access

237 agency and partner contacts and 763 corporate customersPartner contacts: organization names and email addresses. Corporate electricity customers: organization names, addresses, account details containing personal names and billing amounts.

2026.10.06

Leak confirmedUnauthorized access

687 accountsThe three events are not added because overlap is unknown. The date is the information cutoff stated in the notice.

2026.10.06

Leak confirmedUnauthorized access

313 accountsThe three events are not added because overlap is unknown. The date is the information cutoff stated in the notice.

2026.10.06

Leak confirmedUnauthorized access

15,382 accountsThe three events are not added because overlap is unknown. The date is the information cutoff stated in the notice.

2026.10.06

Possible leakUnauthorized access

Up to 54,916 records

2026.10.05

Leak confirmedUnauthorized access

About 1.05 million accounts

2026.10.05Fourth report / affected scope

Leak confirmedUnauthorized accessSome login and account-management functions restricted or ended

574,647 peopleExcludes people who had left the club by September 24; replaces the previous estimate of about 570,000 accounts.

2026.10.05Second report

Possible leakUnauthorized access

159,850 telephone numbersCount of telephone numbers, not unique people.

2026.10.05

Possible leakMisconfiguration

Theoretical maximum: 314,009 studentsNot the number actually viewed.

2026.10.04

Possible leakUnauthorized access

1,646 peopleReaders and news sources are excluded. Separate from the Microsoft 365 incident.

2026.10.04

Possible leakUnauthorized access

Leak count under investigationAbout 9,000 counts impersonation emails sent, not leaked records.

2026.10.03Second report / information leakage confirmed

Leak confirmedRansomwareNetwork-based order processing suspended. The October 3 second report describes an expected restart, not completed recovery.

Count undisclosedLeakage of internal information is confirmed; whether it includes personal information and its scale are undisclosed.

2026.10.03

Possible leakUnauthorized access

3,687 email addresses

2026.10.02

Possible leakUnauthorized access

About 1,100 staff and 7,400 external email addressesCounts of email addresses, not unique people.

2026.10.01FAQ update and partial reopening

Leak confirmedUnauthorized accessYorisou Net reopened on September 28 except for some services; remaining reopening dates are not announced.

About 4.4 million policyholders and 40,000 agenciesAbout 220,000 people with account information are a subset. Policyholders and agencies are not added together.

2026.10.01

Possible leakUnauthorized access

55 membersNames, phones, emails, login IDs, usage history and reservations; for members who registered them, driver-licence details (number, address, birth date) and card last four digits and holder names may also have been viewed. This is a separate intrusion from the previously listed first event.

2026.09.30

Leak confirmedUnauthorized access

About 170,000 records

2026.09.30Second report / investigation results

No evidence of leakage; cannot be ruled outRansomwareNo prospect of restoring encrypted files; full system recovery remains in progress

Number under investigation

2026.09.30

Possible leakUnauthorized access

Up to 2,272 people

2026.09.30

Possible leakIncident at a vendor

About 6,800 records

2026.09.30

Possible leakUnauthorized access

Up to about 70,000 member identifiers

2026.09.30

Leak confirmedMisconfiguration

13,460 people across 2,322 organizations

2026.09.29

Leak confirmedMisconfigurationForm-access permissions were corrected on September 26; the seminar was cancelled.

26 applicants26 applicants’ records were accessible; third-party viewing or downloading has not been established.

2026.09.29

Leak confirmedMisdelivery

177,426 people, potentially including duplicatesThe figure may include the same person more than once.

2026.09.29

Leak confirmedUnauthorized access

1,463 records

2026.09.28

Possible leakMisconfiguration

Two patient photographs and data for two staff members

2026.09.28

Leak described as highly unlikelyLoss of media

Approx. 9,000 customersNames, account numbers, closure amounts, reasons and last transaction dates for accounts closed from July 1992 to March 2001 at predecessor banks; the records were most likely discarded by mistake.

2026.09.28

Possible leakUnauthorized access

1,409 people

2026.09.28

Leak confirmedUnauthorized access

2,835 blogger records; other categories listed separatelySeparately: 630 project records, 11,237 emails and 10,780 business-contact records.

2026.09.28Second report

Possible leakUnauthorized access

Up to 19,000 employee-related and 36,000 external-contact records

2026.09.26

Possible leakUnauthorized access

41 peopleCard data is limited to the last four digits and cardholder names. The notice does not state leakage of license images.

2026.09.25Second report / investigation status

No leakage confirmed; investigation ongoingUnauthorized accessSite suspended from September 10 evening and reopened at 16:00 on September 14

Number not disclosedAs of September 25, no traces of external transfer or unauthorized access to personal information had been found.

2026.09.25Related update

Leak confirmedRansomwareNormal operations resumed

3,308 delivery; 6,849 partner; 43,709 employee-related recordsSeparately, 43,709 employee-related records. Categories are not added together.

2026.09.25

Possible leakIncident at a vendor

1,557 reservations