S 4,454,097 recordsTrustbank confirmed exfiltration of 4,454,097 Furusato Choice member records through unauthorized access on October 17, including names, email and postal addresses, phone numbers, hashed passwords and estimated donation deductions. Services were suspended on October 19. Separate from the earlier Amazon Pay issue.
Unauthorized access & data leakConfirmedOfficial statement
S 4,454,097 recordsUnauthorized access occurred in the Furusato Choice service operated by Trust Bank Co., Ltd., resulting in the leakage of member information. A total of 4,454,097 records were leaked, including names, email addresses, addresses, phone numbers, hashed passwords, and estimated donation deduction amounts. To prevent further damage, related services have been suspended.
Unauthorized access & data leakConfirmedOfficial statement
S 4,454,097 recordsKagawa Prefecture confirmed an external leak of personal information due to unauthorized access from Trust Bank Co., Ltd. on the hometown tax donation site "Furusato Choice." The leaked information includes 4,454,097 records, containing names, email addresses, addresses, phone numbers, and hashed passwords. The scope of the impact is currently being assessed.
Unauthorized access & data leakConfirmedOfficial statement
S 4,454,097 recordsOn October 20, 2026, it was announced that some member information managed by Trust Bank, which operates the hometown tax portal site "Furusato Choice," was leaked due to unauthorized access by a third party. The leaked information confirmed includes names, email addresses, addresses, phone numbers, hashed passwords, and estimated donation deduction amounts totaling 4,454,097 records.
Unauthorized access & data leakConfirmedOfficial statement
Housing Energy Efficiency 2024 Campaign Secretariat (Hakuhodo) "subsidy application system"
B 23,918 peopleJapan's Ministry of Land, Infrastructure, Transport and Tourism disclosed on October 20 that unauthorized operations against a subsidy application system managed by Hakuhodo may have exposed personal information of a preliminary 23,918 people associated with 16,950 registered businesses. Potential information includes names, titles, addresses and contact details. This is not a count of confirmed exfiltrated records. Consumer applicants and the 2026 campaign were not confirmed affected. The secretariat suspended the affected system.
Unauthorized access & data leakPossibleOfficial statement
C About 8,538 recordsOn October 20, 2026, Relic disclosed that unauthorized access to the third-party Studio website platform may have exposed approximately 8,538 records of form submissions across websites for 19 of its services, including inquiries, document requests and event registrations. The submissions could contain names, contact details, affiliations, social media account names and messages. The total includes repeat submissions and entries without personal data, so it is not a count of affected individuals. Payment card data was not collected, and actual extraction or subsequent misuse has not been confirmed.
C A cumulative total of 2,936 recordsSchoo disclosed possible exposure of 2,936 submissions from approximately 2,600 people across enpeer, Schoo Swing, LoLLL and other Studio forms. Names, contact and workplace details were involved. Learner login accounts and study histories were not affected; actual third-party acquisition has not been confirmed.
C 2,295 recordsOn October 20, 2026, LayerX reported that unauthorized access to the third-party Studio platform may have exposed 2,295 records of inquiries sent through its corporate website from June 30, 2022 to November 1, 2023. Potentially affected fields include names, email addresses, company names, telephone numbers, inquiry content and attachment filenames, but not the attachments themselves. Customer data held for its Bakuraku and Ai Workforce services was outside the affected scope. Actual extraction and secondary misuse have not been confirmed.
C A cumulative total of 1,801 recordsTVer disclosed possible exposure of 734 advertising inquiries and 1,067 requests for information, totaling 1,801 submissions, on its Studio-hosted advertising website. Contact names, company names, email addresses and inquiry text were at risk. TVer streaming users were not affected; actual exfiltration is unconfirmed.
C Up to 1,150 recordsKushiro City said its Hokuyo High School contractor was hit by ransomware on August 29. Potentially exposed records include student accounts (200 and 195 by school year), device purchasers (190, 195, 191 and 179 by year) and network-equipment administration passwords. Yearly counts cannot be treated as unique individuals; exfiltration and misuse are unconfirmed. Affected-count basis: The annual school records contain 200 + 195 student-account entries and 190 + 195 + 191 + 179 purchaser entries, totaling up to 1,150 spreadsheet records. Different years and lists may overlap; this is not 1,150 distinct people. Administrative passwords are not assigned an invented record count.
C 1,113 recordsUnauthorized access to external services occurred at the Shonan International Village Center operated by Shonan International Village Association, revealing a potential data leak of personal information. The information that may have been leaked includes names, email addresses, phone numbers, company names, affiliations, and addresses from 1,113 records.
Unauthorized access & data leakConfirmedOfficial statement
D Up to 669 recordsSaitama Prefecture disclosed on October 20, 2026 that personal contact records for 669 registered entities (a mixture of companies and individual persons) in its Smart Agriculture Adoption Navigator may have been exposed through its contractor's mailing-service provider, Yumilink. Company records can include business and representative names, email addresses and industry; individual records can include names, email addresses and industry. The count field's maximum 669 records is an explicitly labeled affected-registration estimate grounded in the official 669-entity figure, not proof of 669 affected natural persons or verified exfiltrated entries. Subsequent misuse had not been confirmed.
D 428 recordsLIVA disclosed possible exposure of 428 inquiries submitted through a Studio-hosted advertising landing page between August 20, 2024 and August 7, 2026. The entries may include names, contact information, places of residence and messages. The main website did not use that form. Intrusion into LIVA's services and actual third-party acquisition have not been confirmed.
D 228 recordsPocketSign disclosed possible exposure of 228 submissions sent to a hidden Studio form between February 5, 2025 and October 14, 2026. Names, organizations, contact details and inquiries were involved. Normal forms and municipal application user data were not affected; actual exfiltration is unconfirmed.
D 205 records205 records submitted through Jitera inquiry and interview application forms may have been exposed, including names, contact details and messages. The 205 figure counts form submissions rather than confirmed individuals.
D 159 accountsCredential stuffing attacks from September 4 to 7 resulted in confirmed unauthorized logins to 159 accounts belonging to members. Some member information, purchase histories and partial card-related information may have been viewed. Server intrusion, bulk exfiltration of member data and fraudulent payments had not been confirmed.
Unauthorized access & data leakConfirmedOfficial statement
Chiba Prefecture / four outsourced Studio projects
D Up to about 141 recordsChiba Prefecture disclosed possible exposure of information from four outsourced Studio projects: 78 registered organizations and 15 people across 18 inquiries in Chibabu; 29 medical institutions; 11 DX trainees; and four tourism organizations across five inquiries. Only heterogeneous submitted-record entries (78 + 18 + 29 + 11 + 5) can be summed as an approximate 141-record proxy, not as unique persons; actual exfiltration remains unconfirmed. Affected-count basis: As a mixed-record proxy across four programs, 78 organization registrations plus 18 inquiry submissions, 29 medical-institution records, 11 trainee registrations and 5 tourism inquiries total approximately 141 submitted records. These different categories cannot be combined into a unique-person or verified-exfiltration count.
D 138 peopleIshikawa Prefectural Board of Education announced that information for a total of 138 students from seven schools, including a prefectural school for the blind, was accessible from outside. Among these, the names, grades, and guardian names of 110 students from the school for the blind were leaked. The cause was a configuration error by staff, and no secondary damage has been confirmed.
Unauthorized access & data leakUnverified reportNews report
Toho Gas "Shine Muscat production and Ielabo information stored on Studio"
D 100 recordsUnauthorized access to Studio may have exposed 100 records concerning people who inquired about Shine Muscat production and housing-company contacts introduced through Ielabo. Names, email addresses and some company names were involved. Misuse was not confirmed. City-gas and electricity supply were not affected.
E Up to 32 recordsSKY Perfect JSAT reported that up to 32 inquiry submissions for SATELLITE CRAYON PROJECT might have been exposed after the Studio breach. Company names, names, addresses, phone numbers, email addresses and inquiry text were at risk. No payment card data was included and exfiltration is unconfirmed.
E 13 recordsKTS Kagoshima Television announced that unauthorized access occurred on the inquiry form for the housing fair, potentially leaking 13 records of personal information. The leaked information includes names, phone numbers, email addresses, and inquiry details. Currently, there have been no reports of the information being used improperly.
Unauthorized access & data leakPossibleOfficial statement
NEC confirmed that a contractor was attacked in late September; stolen credentials were used to access multiple customer systems and encrypt server files. Shared cloud-storage files containing customer personal and system information were also leaked. The affected record count is unknown.
Neo Career reported possible exposure of names, email addresses, phone numbers and inquiries submitted to Studio-backed forms for X-Tech Agent and Bee. Actual third-party data acquisition remains unconfirmed; affected counts were not disclosed.
ExaWizards reported possible exposure of Studio form records for wellwiz, BizDevRecruit and Rehawiz, including names and contact details. Some Rehawiz for SCI forms collected self-reported injury sites. Actual acquisition is unconfirmed, and the unrelated exaBase Studio product was not affected.
LIFULL announced possible exposure of customer information stored on Studio by some of its services after unauthorized access to that platform. The number of affected records and any confirmed extraction of data have not been established from the public announcement.
Good Real Estate "GoWeb tenancy application service"
Good Real Estate reported unauthorized access to its upstream GoWeb service identified on October 16. Possible effects on tenancy applicants and real estate agent data remain under investigation; no count is published. Indexed first-party text was reviewed, while the live page returned HTTP 502.
JPYC corporate inquiry data submitted between May 7, 2021 and October 16, 2026 may have been exposed, including company names and contact details. Counts and extraction are unconfirmed; the JPYC EX issuance and redemption service is excluded.
Yokohama City Sakae Ward suspended the use of its emergency information transmission system due to unauthorized access on October 13, 2026. There is a possibility of personal information leakage, and the extent of the impact is under investigation.
Unauthorized access & data leakConfirmedOfficial statement
Japan Information Economy Society Promotion Association
Following a recent incident of unauthorized access leading to information leakage, relevant ministries and related organizations have issued alerts and information regarding countermeasures. It is recommended to check the information released by each organization to prevent damage and strengthen information security measures.
Unauthorized access & data leakPossibleOfficial statement
Unauthorized access to the emergency information transmission system of eight wards in Yokohama City was reported, with a possibility of leakage of registered information. Approximately 2,024 people may be affected, and investigations into the impact are ongoing.
Unauthorized access & data leakUnverified reportNews report
Kanagawa Prefecture announced that there is a possibility of unauthorized access to the air pollution information email and telephone distribution service it has commissioned, which may have led to the leakage of users' email addresses and phone numbers. The number of potentially leaked email addresses is 6,769, including 6,275 registrations for photochemical smog warning information.
Unauthorized access & data leakPossibleOfficial statement
Ministry of Land, Infrastructure, Transport and Tourism
Reports indicate that personal information of over 20,000 individuals who applied for subsidies from the Ministry of Land, Infrastructure, Transport and Tourism may have been leaked, and it has also been reported that unauthorized access occurred.
Unauthorized access & data leakUnverified reportNews report
