S About 9,000,000 recordsThe company confirmed unauthorized access by a third party to 5 Cuenote FC email delivery systems and external extraction of information from their databases. The cumulative volume of information, including email addresses, was estimated at approximately 9,000,000 records. This count may include duplicates and does not represent the number of individual victims. Details remained under investigation.
Unauthorized access & data leakConfirmedOfficial statement
Recruit "CarSensor.net and C-MATCH used-car platform"
S Up to 3,709,551 recordsOn October 21, 2026, Recruit disclosed that unauthorized access to CarSensor.net and the C-MATCH dealership support platform might have exposed up to 3,709,551 personal-information records. Its published categories comprise 3,210,421 inquiries by prospective car purchasers, 5,289 review submissions, 483,168 dealership records and 10,673 records for Recruit employees, contractors and sales agents. These figures aggregate heterogeneous record categories and are neither a deduplicated count of individuals nor proof all entries were exfiltrated. Suspicious system activity was detected on October 17, followed by precautionary service shutdown. Potentially exposed fields include names, contact details, inquiries, login IDs and, for certain sole proprietors, bank-debit details. Payment cards and login passwords were excluded. The company reported no confirmed downstream misuse as of October 21.
Unauthorized access & data leakPossibleOfficial statement
S About 1,260,000 recordsUnauthorized access to three Hankyu and Hanshin department store services reportedly exposed approximately 1.26 million customer records including names and contact details.
Unauthorized access & data leakConfirmedOfficial statement
Nifty "internet service application and intake management system"
A Up to 542,513 recordsUnauthorized access to a management system was confirmed on October 19. Up to 542,513 records were potentially affected, and whether leakage occurred and its scope remained under investigation. Payment-related information was not stored in the system.
Unauthorized access & data leakPossibleOfficial statement
A Up to about 420,000 recordsThe company confirmed unauthorized access by a third party to the music production services SONICWIRE and D2R. Up to approximately 420,000 records concerning SONICWIRE members and newsletter subscribers may have been viewed or acquired, including password hashes. The actual number of acquired records had not been established. Payment card information was not stored in the systems.
Unauthorized access & data leakPossibleOfficial statement
Zeabur shared clusters, GCP Dedicated Servers and platform database
A 321,810 accountsIn its October 19 preliminary report, Zeabur confirmed an October 14-15 intrusion using long-lived administrative credentials. Logs showed attacker access to shared clusters in nine regions, root login to 101 GCP Dedicated Servers, and platform database reads covering 3,218,965 environment-variable records and 321,810 user accounts. Commands were issued against 865 database services, but not every command succeeded and the disclosure does not prove all customer database contents were stolen. Customers were instructed to rotate credentials; whether the August incident involved the same attacker remains unproven.
A 317,971 recordsAn October 18 intrusion exploiting Gettii-Lite exposed GETTIIS member data. Following the October 19 initial notice, the October 20 update reported 317,971 records of member IDs, 311,451 hashed-password records and 29,515 payment-card-related records. These overlapping field counts must not be added together. Card-related data consisted of encrypted partial numbers, names and expiry dates; full card numbers and security codes were not stored.
Unauthorized access & data leakConfirmedOfficial statement
B 11,462 recordsUnauthorized access to Studio may have exposed 11,462 records from Crowd Town application forms, 299 from its inquiry form, 354 from the Academy and 16 from CrowdLinks. Third-party acquisition had not been confirmed. The count field represents the largest single form count, not a combined total.
C 5,877 records5,877 submissions to service information and application forms may have been exposed. Fields include names, phones, emails, addresses and birth dates, not payment cards. The 5,877 records are form submissions, not confirmed affected people or extracted records.
C 3,379 peopleLIXIL confirmed a breach of personal information relating to 3,379 people, including 375 current or former employees. Names, emails, birth dates and registration data were affected, but payment information was not.
Unauthorized access & data leakConfirmedOfficial statement
C 2,129 records2,129 inquiry records across travel and accommodation services may have been exposed through a Studio vulnerability; actual exfiltration is unconfirmed.
Unauthorized access & data leakPossibleOfficial statement
C About 1,440 recordsApproximately 1,440 contact and document request submissions may have been exposed following unauthorized access to Studio. The figure includes duplicate and test submissions.
Unauthorized access & data leakPossibleOfficial statement
IRIS "TOKYO PRIME, TAXISEAL and corporate website"
C Up to 1,410 recordsUnauthorized access to Studio may have exposed information submitted through inquiry forms and other forms on 3 websites. Up to 1,410 records of form submissions, including duplicates, were potentially affected. Actual acquisition by a third party and misuse had not been confirmed.
C 1,024 recordsand US announced that unauthorized access occurred in the external service "Studio," potentially leading to the leakage of personal information held by the company. Currently, it is reported that personal information obtained from the corporate and recruitment site inquiry forms may have leaked, with a potential count of 1,024 records. The impact is limited to the corporate and recruitment sites, with no effects on other services.
Unauthorized access & data leakPossibleOfficial statement
D A cumulative total of 901 recordsUnauthorized access to Studio may have enabled external acquisition of a cumulative total of 901 records of inquiries submitted through the company's service information websites. Actual acquisition or alteration had not been confirmed.
Green Energy & Company "Studio forms for 3 group companies"
D 857 recordsThe company disclosed possible exposure of 857 records received through forms on the corporate websites and other sites of 3 group companies following unauthorized access to Studio. Names, company names, contact details, addresses and inquiry contents were potentially affected. Actual acquisition by a third party had not been established.
Japan External Trade Organization (JETRO) "websites"
D 743 recordsJETRO announced on October 19 that some websites had been accessed without authorization since October 14, with 743 confirmed leaked personal-information records including company names and business-contact email addresses. Some website functions were restored on October 20 after a shutdown from October 17. The 743 records do not establish the number of distinct individuals.
Unauthorized access & data leakConfirmedOfficial statement
ajike "Studio inquiry, request and recruitment forms"
D 734 records734 submissions to ajike inquiry, request and recruitment forms may have been exposed, including names, companies and contact details. The 734 records represent submissions rather than confirmed extraction or individual victims.
Mitsumura Printing and Ozu "event website and corporate website inquiry forms"
D 490 recordsUnauthorized access to Studio may have exposed 490 records of inquiry form information: 1 from Mitsumura Printing's event website and 489 from the website of its subsidiary Ozu. Actual acquisition by a third party had not been confirmed.
D 249 accountsUnauthorized logins by a third party using credentials leaked elsewhere were identified. 249 accounts may have been accessed, and 83 address book records stored in 1 account may also have been acquired. Leakage from the company's own systems had not been confirmed. This was separate from the post office app incident announced on September 29.
Unauthorized access & data leakPossibleOfficial statement
D 202 peopleUnauthorized access occurred to the relocation and settlement portal site and YuzaWork operated by Yuzawa Town, potentially leaking personal information of 202 users. The leaked information includes names, genders, addresses, dates of birth, phone numbers, email addresses, occupations, family structures, and passwords for administrator accounts. Currently, the service provider Studio Inc. is blocking the unauthorized access route and conducting an investigation into the cause.
Unauthorized access & data leakConfirmedOfficial statement
E About 85 recordsAbout 85 submissions in a Studio-hosted fiscal 2021 startup collaboration proposal form may have been exposed, including company and contact names and proposal details. The figure remains under review and actual extraction or affected individuals are unconfirmed.
Omron Social Solutions "meemo information download website"
E 63 recordsUnauthorized access to Studio, used for the promotional website of the public ridesharing service meemo, may have exposed 63 records submitted through an information download form. Actual third-party acquisition and secondary harm had not been confirmed. The meemo service itself was not affected.
E 62 recordsUnauthorized access to Studio may have enabled external acquisition of 62 records submitted through mid-career and graduate recruitment application forms and inquiry forms. Actual acquisition had not been confirmed.
Shinseiki Social Welfare Corporation "Komorebi inquiry form"
F 2 records2 submissions to the Komorebi inquiry form between June 10 and October 1 may have been exposed, including names and contact details. Care-service user records were excluded. The 2 submissions are not confirmed extracted records.
Gifu Prefecture "GIFU new business co-creation challenge program event website (Studio)"
F 2 recordsOn October 19, 2026 (updated), the Gifu Prefecture Industry Innovation Promotion Division disclosed that the event announcement website for its fiscal 2025 "GIFU new business co-creation challenge program," built by contractor AlphaDrive Co., Ltd. on Studio Inc.'s web production service, was affected by the unauthorized access to Studio (September 30 to October 1, 2026; confirmed by Studio on October 13, patched and blocked on October 13-14, published October 16). Two event-inquiry records containing company/affiliation, name, e-mail address, inquiry text and submission time may have been exposed; event registration data was managed separately and is not affected. The contractor notified the prefecture on October 16. No misuse has been confirmed, the contractor deleted the two records from Studio's cloud, and the prefecture apologized to the individuals and warned them about suspicious e-mails. The underlying Studio incident is LEAK-244.
Unauthorized access & data leakPossibleOfficial statement
F 2 recordsUnauthorized access occurred at Studio Corporation, and there is a possibility that personal information has leaked, as reported by Gifu Prefecture. Specifically, unauthorized access by a third party was confirmed on an external service used to create an event announcement website. The information that may have leaked includes personal information such as company name, affiliation, name, and email address, totaling 2 records. No unauthorized use has been confirmed at this time, but investigations and countermeasures are underway.
Unauthorized access & data leakPossibleOfficial statement
On October 18, the company became aware of possible unauthorized access from outside to the server of the e-book sales site Renta! and temporarily suspended the service to conduct emergency maintenance. As of the company's announcement on October 19, the details of the unauthorized access were still under investigation, and the existence of information leakage and the number of affected records were not disclosed. The timing for resuming the service is also undecided.
Unauthorized access & data leakUnder investigationOfficial statement
Following unauthorized access to Studio, information entered into a recruitment form may have been exposed. No acquisition or misuse was confirmed; the number of records was not disclosed.
Unauthorized access & data leakPossibleOfficial statement
An attempt to gain unauthorized access to My SoftBank-related systems was detected on October 17. The web versions of My SoftBank, My Y!mobile and My Menu were temporarily suspended to ensure safety. The company did not announce that information leakage had occurred.
Unauthorized access & data leakUnder investigationOfficial statement
The company confirmed unauthorized logins to its accounts using credentials believed to have been leaked from other companies' services. Login restrictions were imposed on affected accounts. The announcement did not indicate that credentials had leaked from Square Enix's own systems. The number of affected accounts was not disclosed.
Unauthorized access & data leakConfirmedOfficial statement
The company disclosed possible exposure of information submitted through inquiry forms on its websites following unauthorized access to Studio. Names, addresses, contact details and other submitted information were potentially affected. Speeda and NewsPicks accounts and passwords were not affected. Third-party acquisition had not been confirmed.
X Mile website inquiry submissions stored on Studio may have been exposed. The notice was first published October 19 and updated October 21. No verified count or confirmed extraction was found, and the notice does not establish intrusion into other company systems.
SYMMETRY corporate contact form data, including names and contact details, may have been exposed. Actual extraction or secondary misuse was not confirmed, and no count was published. Indexed first-party text was reviewed.
Leafea inquiry, service application and survey data may have been exposed, including names and contact information. Payment card and bank account data were not solicited. Extraction and secondary misuse are unconfirmed, and affected counts are under investigation.
Canly web form information stored on Studio may have been exposed following upstream unauthorized access. Actual extraction or misuse was not confirmed; the affected count and detailed data fields were not established by the reviewed official notice.
A cloud service provider experienced unauthorized access, raising concerns about potential leakage of personal information. There is a warning that phishing scam emails and suspicious phone calls pretending to be from the prefecture may occur in the future, urging caution.
Unauthorized access & data leakConfirmedOfficial statement
Unauthorized access occurred in the cloud environment of the company providing the website creation tool for Seapass Park, potentially leading to the leakage of personal information. The vulnerability has now been fixed, and the access route has been blocked, but investigations into the extent of the impact are ongoing.
Unauthorized access & data leakPossibleOfficial statement
Over 700 supermarkets in France were subjected to a cyber attack, resulting in abnormal temperature increases in freezers and the disposal of food. Attackers infiltrated the remote management system of refrigeration equipment and changed the set temperature to 150 degrees Celsius. The estimated damage is around 10,000,000,000 yen.
Unauthorized access & data leakUnverified reportNews report
There were signs of unauthorized access to the internal systems of Ashiya Gakuen Educational Institution, and the database server reportedly stopped functioning.
Unauthorized access & data leakUnverified reportNews report
