Free diagnosis

Incidents on Oct 22, 2026

Publication date: Dates are source publication dates (JST), not occurrence dates.

Details and evidence links

Filter incidents

Showing 57 of 57 incidents

Incidents on Oct 22, 2026
DateTargetSummaryClassificationSource links
LEAK-435Capcom "CAPCOM ID"S 11,774,247 recordsCapcom confirmed unauthorized access to CAPCOM ID on October 19 and identified a data breach on October 20. Its October 22 disclosure confirmed 11,774,247 worldwide records containing email addresses and system identifiers were exposed. The total includes 43 records with additional profile details and 196 accounts whose passwords were changed without authorization; these subsets must not be added to the overall count. Capcom did not confirm exposure of passwords set by customers, and payment card data was not affected.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-593Matsue CityS 4,454,097 recordsUnauthorized access occurred to member information managed by Trust Bank Co., Ltd. on the hometown tax portal site "Furusato Choice," resulting in the leakage of personal information of donors. The leaked information included names, email addresses, addresses, phone numbers, hashed passwords, and estimated donation deduction amounts, totaling 4,454,097 records.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-595Takeo CityS 4,454,097 recordsUnauthorized access by a third party occurred to the member information managed by Trust Bank, the operator of the hometown tax portal site "Furusato Choice" used by Takeo City, resulting in the leakage of personal information of 4,454,097 records. The leaked information includes names, email addresses, addresses, phone numbers, hashed passwords, and estimated donation deduction amounts.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-596Oma TownS 4,454,097 recordsOn October 20, 2026, unauthorized access occurred at Trust Bank Co., Ltd., which operates the hometown tax portal site "Furusato Choice" for Oma Town, resulting in the leakage of personal information for 4,454,097 records. The leaked information includes names, email addresses, addresses, phone numbers, hashed passwords, and estimated donation deduction amounts. The service is currently suspended, and details are being confirmed.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-599Nichinan CityS 4,454,097 recordsNichinan City announced that Trust Bank Co., Ltd., the operator of Furusato Choice used for accepting hometown tax donations, suffered unauthorized access, resulting in the leakage of member personal information. The leaked information includes names, email addresses, addresses, phone numbers, and hashed passwords, totaling 4,454,097 records. The city is alerting donors to prevent misuse of their personal information.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-600Kumiyama TownS 4,454,097 recordsUnauthorized access occurred on the hometown tax site "Furusato Choice," resulting in the leakage of personal information. The leaked information includes 4,454,097 records, which contain names, email addresses, addresses, phone numbers, hashed passwords, and estimated donation deduction amounts.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-671Onga TownS 4,454,097 recordsUnauthorized access occurred on the hometown tax donation site "Furusato Choice," resulting in the leakage of donor information. The leaked personal information includes 4,454,097 records, consisting of names, email addresses, addresses, phone numbers, hashed passwords, and estimated donation deduction amounts. To prevent further damage, related services are temporarily suspended.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-730Sumoto CityS 4,454,097 recordsUnauthorized access occurred on the hometown tax portal site "Furusato Choice," confirming the leakage of 4,454,097 records of members' personal information. The leaked information includes names, email addresses, addresses, phone numbers, and hashed passwords.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-501Niigata Nippo "Niigata Nippo Passport"A Up to about 253,000 peopleIn its second report at 17:20 on October 22, 2026, Niigata Nippo announced that unauthorized third-party access to the Blastmail email delivery service operated by Rakus Light Cloud, used for email delivery to its "Niigata Nippo Passport" member service, leaked the personal information of all Niigata Nippo Passport members. Up to about 253,000 people are believed to be affected. The leaked data consists of names in katakana, prefecture, municipality, email address, gender, age bracket, subscribed product name and subscribed newsletter service name. Credit card information, phone numbers, dates of birth, bank account numbers and passwords are not included. Possible leakage of about 7,000 Niigata Salmon Project members is under investigation. Rakus Light Cloud reported suspicious access and an emergency shutdown of all services late on October 21 and reported the leak of all members' data on October 22. The third report on October 23 said Rakus Light Cloud had completed individual notifications to the 288 contracting customers where leakage was confirmed, and the fourth and fifth reports on October 24 said it had confirmed 56 additional leaks (both figures are counts of the contractor's customers overall, not of members); Niigata Nippo reported to the Personal Information Protection Commission on October 23. Several email services including newsletters and breaking-news mails are suspended until recovery, with no restoration date set. No misuse had been confirmed at the time of publication. The upstream intrusion is the same incident as LEAK-411.
Supply chainConfirmedOfficial statement
LEAK-526H.I.S. Hotel HoldingsA About 140,000 peopleH.I.S. Hotel Holdings announced that an external service used for distributing newsletters to its website members was subject to unauthorized access, potentially leaking names and email addresses of approximately 140,000 individuals. An investigation is currently underway, and they plan to report to the Personal Information Protection Commission.
Unauthorized access & data leakPossibleOfficial statement
LEAK-523Meitetsu Kanko Service Co., Ltd.A About 130,000 peopleMeitetsu Kanko Service Co., Ltd. announced that there was unauthorized access to the email newsletter distribution system "Blastmail," potentially leaking personal information of approximately 130,000 individuals. The leaked information may include names, phone numbers, email addresses, dates of birth, genders, and addresses (only the prefecture names).
Unauthorized access & data leakConfirmedOfficial statement
LEAK-456Tohoku Electric Power Frontier e-Point MallA Up to about 100,000 recordsOn October 22, Tohoku Electric Power Frontier reported possible exposure of up to approximately 100,000 e-Point Mall members' email addresses and internal member IDs through the outsourced blastmail service used by contractor ADDIX. Whether this specific subscriber list was actually exfiltrated remains unconfirmed. Names, addresses, phone numbers, passwords, payment data and utility-contract details were not shared with that mailing platform. The upstream intrusion is the existing blastmail incident, but this is a distinct subscriber group.
Supply chainPossibleOfficial statement
LEAK-524Minami Nihon ShimbunshaB About 66,500 peopleMinami Nihon Shimbunsha confirmed that its outsourced email distribution service Blast Mail suffered unauthorized access, resulting in the leakage of information for approximately 66,500 people. The leaked information included names, email addresses, dates of birth, and residential municipalities, but did not include phone numbers, detailed addresses, passwords, or credit card information.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-525Shikoku Railway CompanyB About 30,000 recordsUnauthorized access occurred to the email distribution service "Blast Mail" provided by Rakus Light Cloud, and it was announced that approximately 30,000 records of personal information may have been leaked. The potentially leaked information includes names, dates of birth, addresses, and email addresses. A detailed investigation is currently underway.
Unauthorized access & data leakPossibleOfficial statement
LEAK-592Okazaki CityB About 26,000 recordsUnauthorized access occurred to the information distribution system used by Okazaki City, revealing a possibility of personal information leakage. Approximately 26,000 records of email addresses may have been leaked, and an investigation is currently underway.
Unauthorized access & data leakPossibleOfficial statement
LEAK-497System5 "online shop integration system"B Up to about 15,000 peopleSystem5 Co., Ltd. announced in its first notice on October 22, 2026 that it had confirmed unauthorized third-party access to some systems linked to its online shop, that some customers' personal information may have been leaked externally, and that it had temporarily suspended the website. On October 24 it announced that unauthorized access to a system linked to its online shop led to the unauthorized acquisition of some customers' personal information. The information that may have been obtained is names, email addresses, point balances and product review data for up to about 15,000 people. Credit card and password data are not held or managed on the company's systems and are not at risk, and no unauthorized access caused by vulnerabilities in the internal network or the shopping cart system itself has been confirmed, the company says. The online shop reopened at about 19:00 on October 24 with login switched from passwords to a six-digit code sent by email; the point service, product reviews and online document issuance remain suspended. The company has reported to the Personal Information Protection Commission and consulted the police.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-455Digital Agency Studio-hosted inquiry formsB Up to 13,323 recordsOn October 22, Japan's Digital Agency disclosed possible exposure of up to 13,323 inquiry submissions stored in Studio across five form categories from May 2021 to March 2023 (8,833 general inquiries, 250 recruitment, 3,661 vaccination certificates, 117 costume loans and 462 other activities). Separately, 35 Studio accounts belonging to staff or contractors may be affected. These are maximum potentially affected records, not confirmed victims or confirmed exfiltrated records. No related misuse was reported. This is distinct from the agency's earlier VPN incident.
Supply chainPossibleOfficial statement
LEAK-447Yokohama City "GREEN×EXPO 2027 city exhibition-area volunteers"C 6,334 peopleYokohama City disclosed on October 22 that names and email addresses belonging to 6,334 applicants to volunteer at the city's GREEN×EXPO 2027 exhibition area may have been exposed through unauthorized access to the outsourced blastmail service. The vendor reported extraction of some subscriber lists, but extraction of these 6,334 applicants' records has not been confirmed. This is a separate cohort from the Expo association's general volunteers; the underlying service intrusion is already recorded as LEAK-411.
Supply chainPossibleOfficial statement
LEAK-453KOMOJU payment platform and CRMC About 4,100 recordsOn October 22, KOMOJU disclosed that attackers exploited a vulnerability in a non-production environment beginning October 13 and gained access to internal systems. The company confirmed exposure of approximately 4,100 personal-data records containing email addresses and some merchants' API credentials. Unauthorized CRM access was also detected, with its scope still under investigation. KOMOJU reported no credit-card data leak or confirmed fraudulent-payment consequences.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-446Yokohama Gender Equality Promotion Association "four email newsletters"C A cumulative total of 3,932 recordsOn October 22, Yokohama City reported possible exposure of a combined 3,932 newsletter email registrations for the Yokohama Gender Equality Promotion Association and three managed centers (688, 1,094, 1,037 and 1,113 respectively) following unauthorized access to the outsourced blastmail platform. Duplicates may exist, so this is not a distinct-person count. Extraction of this specific data set has not been confirmed. The upstream intrusion is already documented as LEAK-411; this entry identifies a separate downstream subscriber group.
Supply chainPossibleOfficial statement
LEAK-454SmartHR group Studio-hosted inquiry formsC 2,012 peopleSmartHR reported on October 22 that contact-form submissions for 2,012 people across its group websites, including SmartHR, Smart Counseling Room, AIRVISA, BYARD and Looper, may have been exposed through the separate upstream Studio intrusion. Potential fields include names, organization names, telephone numbers, email addresses and inquiry text. Actual extraction of this cohort and secondary misuse have not been confirmed. Data held by the group's cloud services is not affected.
Supply chainPossibleOfficial statement
LEAK-602RECEPTIONISTC About 1,600 recordsRECEPTIONIST announced that the cloud environment of the external service "Studio" used for the production and operation of its old corporate website was subject to unauthorized access, potentially leading to the leakage of information sent through the inquiry form. Approximately 1,600 records may have been leaked, affecting around 1,200 individuals. It has not yet been confirmed whether any information was actually obtained, but the company is taking action regarding all potentially affected cases.
Unauthorized access & data leakPossibleOfficial statement
LEAK-832Jinrai Co., Ltd.D 283 recordsFrom July 22, 2026, to October 22, 2026, 283 records of unauthorized access were confirmed in Japan. Particularly since mid-September, there has been a continuous leak of information on the scale of millions of records, with main methods including abuse of membership sites and applications, attacks on contractors, and takeover of email accounts.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-529Yokohama City Shirahata District CenterD About 200 recordsThe designated administrator of the Yokohama City Shirahata District Center announced a potential leak of personal information through the email newsletter distribution service they use. The specific number of leaked records and the extent of the impact are unknown. About 200 email addresses may have been leaked.
Unauthorized access & data leakPossibleOfficial statement
LEAK-436SkyDisc "recruitment interview application form"D 105 recordsFollowing unauthorized access to the third-party Studio website platform, 105 submissions to SkyDisc's recruitment interview application form between May 23 and October 14, 2026 may have been exposed. Potentially affected fields include names, email addresses, phone numbers and attachment file names, not confirmed attachment contents. Actual extraction and secondary harm have not been established.
Unauthorized access & data leakPossibleOfficial statement
LEAK-598Sakaide CityE 28 recordsIt was revealed that personal information entered in the migration consultation form on the Sakaide City migration portal site may have leaked externally. The damage includes 28 records containing names, email addresses, residences, and consultation details regarding migration.
Unauthorized access & data leakPossibleOfficial statement
LEAK-460Ministry of Health, Labour and WelfareF 6 peopleA cyber attack occurred on the website "1FEdu" operated by Techno Hill Co., Ltd., which is part of a commissioned project by the Ministry of Health, Labour and Welfare. It was confirmed that the email addresses and passwords of 6 people were leaked. Additionally, there is a possibility that personal information of up to 595 people may have been leaked. Currently, the service has been suspended and external access has been blocked.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-437New Japan Pro-Wrestling "email newsletter"Unauthorized access to the outsourced blastmail email distribution platform may have exposed email addresses subscribed to New Japan Pro-Wrestling's newsletter. Actual exfiltration and an affected count were not established. The Team NJPW fan-club newsletter uses a separate system and is not affected. New registrations and delivery of the potentially affected newsletter were suspended.
Unauthorized access & data leakPossibleOfficial statement
LEAK-438Laplace System "newsletters and server alerts"Unauthorized access to the third-party blastmail service may have exposed names, email addresses and other recipient information used for Laplace System newsletters and server outage notices. The company did not establish an affected count or confirm extraction of its own records. L-eye monitoring-screen error messages use a different notification system and are outside this reported impact.
Unauthorized access & data leakPossibleOfficial statement
LEAK-439My Action Future NAGANO Prefectural Citizens Council "membership and newsletter"An intrusion at the third-party blastmail service may have exposed subscriber type, individual or organization names, and email addresses held for the council's members and newsletter subscribers. No specific exfiltration from this group or misuse was confirmed, and the affected record count was not disclosed. The investigation remains ongoing.
Unauthorized access & data leakPossibleOfficial statement
LEAK-440Knowledge Lean "Eco Planet mailing magazine"Unauthorized access to the outsourced blastmail service may have exposed email addresses subscribed to Knowledge Lean's Eco Planet newsletter for local government environmental officials. The company did not establish actual extraction or a record count. Its other newsletters do not use blastmail and were explicitly excluded.
Unauthorized access & data leakPossibleOfficial statement
LEAK-441Kagoshima City Sports Promotion Association "newsletters and event notices"An intrusion at the outsourced blastmail platform may have exposed names and email addresses of recipients of the association's newsletters and event-lottery notifications. Although the platform provider reported removal of some distribution data, the association has not confirmed whether its own records were exfiltrated or how many people may be affected.
Unauthorized access & data leakPossibleOfficial statement
LEAK-442Daytona "DIOS contacts and Tea Meeting mailing list"Following unauthorized access to blastmail, Daytona warned that company names, contact names, B-codes and email addresses for DIOS business contacts and 2026 Tea Meeting exhibitors might have been exposed. The service operator confirmed some mailing-list exposure, but leakage of Daytona's own contacts and their number remain unconfirmed. DIOS order processing and inventory checks use a separate system and were not affected.
Unauthorized access & data leakPossibleOfficial statement
LEAK-448GREEN×EXPO 2027 Association "general volunteer email notices"A first-party release from the GREEN×EXPO 2027 Association attached to Yokohama City's October 22 press notice says unauthorized access to the outsourced blastmail platform may have exposed volunteer registration numbers, activity numbers and email addresses used for general-volunteer notices. Names and other direct identifiers were not supplied to the email delivery service. Actual extraction of this particular list remains unconfirmed and the affected count is unknown. This is a different cohort from the city's 6,334 exhibition-area volunteer applicants, sharing the previously recorded upstream intrusion LEAK-411.
Supply chainPossibleOfficial statement
LEAK-457giftee mailing lists for Travel Tax IDs, e-machi and giftee BenefitOn October 22, giftee warned that contact information registered in the compromised blastmail platform might have been exposed. Potentially affected categories include Travel Tax user IDs and email addresses, municipal or corporate contacts for the e-machi platform, and email addresses, benefit IDs and corporate login URLs for giftee Benefit. Extraction of giftee's own lists has not been confirmed, and the affected count is unpublished. The upstream blastmail intrusion is already recorded separately.
Supply chainPossibleOfficial statement
LEAK-482OANDA Securities CorporationOn October 21, 2026, unauthorized access was confirmed on the "Onamae.com Desktop Cloud" service provided by GMO Internet Group, potentially allowing information on the service's servers to be viewed. As a result, there is a possibility that login information for customers using OANDA's MT4/MT5 was accessed by a third party, prompting a request for password changes.
Unauthorized access & data leakPossibleOfficial statement
LEAK-483Titan FX LimitedOn October 22, 2026, Titan FX asked customers who stored or used MT4/MT5 login credentials on GMO Internet's VPS "Onamae.com Desktop Cloud" to take security measures after GMO announced on October 21 that third parties had gained unauthorized access to that service. Titan FX requested prompt password changes (including any identical passwords used for the client cabinet or other services), a review of MT4/MT5 trading history and account status, continued monitoring of the official Onamae.com announcements, avoidance of password reuse, and contact with Titan FX support if unauthorized logins or trades are found. The notice does not state that Titan FX's own systems were breached or that its customer data leaked, and gives no affected count ("some customers"). The underlying GMO incident is LEAK-393.
Unauthorized access & data leakPossibleOfficial statement
LEAK-488IS6FXIS6FX announced security measures for MT4/MT5 accounts due to potential unauthorized access by a third party on Onamae.com Desktop Cloud. They requested customers to change their passwords and called for important actions to protect accounts. The impact of the unauthorized access is currently uncertain, but they are proceeding with verification and investigation of the situation.
Unauthorized access & data leakPossibleOfficial statement
LEAK-490GMO Internet, Inc.On October 21, 2026, unauthorized access was reported on GMO Internet, Inc.'s VPS service "Onamae.com Desktop Cloud." Malicious programs were installed on some customers' server environments, potentially allowing third parties to view information stored on the servers. An investigation by the company is ongoing, and the servers for the affected service have also been shut down.
Unauthorized access & data leakPossibleOfficial statement
LEAK-494AXIORYOn October 21, 2026, GMO Internet, Inc. announced that unauthorized access by a third party was confirmed on its VPS service "Onamae.com Desktop Cloud," where unauthorized programs may have been installed on some server environments, potentially allowing information to be viewed. AXIORY stated that no unauthorized access to its systems has been confirmed regarding this matter.
Unauthorized access & data leakPossibleOfficial statement
LEAK-527Asahi MarketsOn October 21, 2026, unauthorized access by a third party was confirmed in the "Onamae.com Desktop Cloud" service provided by GMO Internet Group, and it was reported that information within the service's servers may have been viewed. As a result, there is a possibility that account information (account numbers and passwords) of customers using Asahi Markets' MT5 was accessed by a third party. Customers are advised to change their passwords and use two-factor authentication.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-528Golden Way Japan CorporationA cyber attack on another company's VPS server detected the potential unauthorized acquisition of some customers' trading account login IDs and passwords. Customers are strongly advised to change their passwords.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-590Comic CmoaThe e-book distribution service Comic Cmoa experienced unauthorized access by a third party and announced that it had suspended services since the 15th, but has now resumed some functions.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-591Securities companies and banksAn attack exploiting a PHP vulnerability was detected domestically, causing online services of securities companies and banks to temporarily suspend operations while they rushed to implement fixes.
Unauthorized access & data leakUnverified reportNews report
LEAK-594Chikuhoku VillageUnauthorized access exploiting a PHP vulnerability was reported on the official website of Chikuhoku Village. Specifically, unauthorized access was detected on the portal site "Furusato Choice," used for accepting hometown tax donations, and the site is currently unavailable. The scope of the impact is under investigation.
Unauthorized access & data leakPossibleOfficial statement
LEAK-597Nagashima TownUnauthorized access occurred on the hometown tax portal site "Furusato Choice," resulting in the personal information of registered users being leaked externally. Donors are urged to change their passwords if they use the same email address and password combination on other services. The scope of the impact is currently under investigation.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-601Misawa CityMisawa City reported unauthorized access to the hometown tax portal "Furusato Choice," resulting in the leakage of donor personal information. Related services have been suspended to prevent further damage.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-603Ashiya UniversityUnauthorized access occurred to Ashiya University's internal system, with external access confirmed via overseas IPs. Traces of access to personal information on the internal database were found. The affected server was disconnected from the network, and system functions were temporarily suspended. An investigation is ongoing to identify the impacted data.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-604Valtec CorporationValtec Corporation announced a potential leak of customer information due to unauthorized access by a third party and has suspended some services for emergency maintenance. Initially, the cause of the leak was reported to be a cyber attack targeting a PHP vulnerability, but it has been confirmed to be misinformation. An investigation is currently underway to determine the detailed cause and scope of the impact.
Unauthorized access & data leakPossibleOfficial statement
LEAK-605GREEN×EXPO AssociationGREEN×EXPO Association reported unauthorized access to an email distribution service, with a possibility of personal information leakage. The potentially leaked information includes volunteer registration numbers, activity numbers, and email addresses, but no personal names or specific information were provided.
Unauthorized access & data leakPossibleOfficial statement
LEAK-672Kihō TownKihō Town reported unauthorized access by an external third party to the email distribution service "Blast Mail," which may have resulted in the leakage of personal information. The potentially leaked information includes names and email addresses.
Unauthorized access & data leakPossibleOfficial statement
LEAK-673Shimotsuma CityReports indicate that personal information of donors registered on the hometown tax portal "Furusato Choice" was leaked externally due to unauthorized access. The leaked information includes names, email addresses, addresses, phone numbers, and hashed passwords. Currently, related services are suspended.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-674Nihon Keizai ShimbunUnauthorized access to Nihon Keizai Shimbun confirmed the leakage of personal information of users of National Geographic services. The leaked information may include names, email addresses, addresses, phone numbers, and dates of birth, but does not include credit card information. Nihon Keizai Shimbun reported the incident to the Personal Information Protection Commission and is investigating the extent of the leak.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-675Yonsei UniversityYonsei University's internal portal site was accessed illegally, resulting in the leakage of personal information for 15,000 people, including students.
Unauthorized access & data leakUnverified reportNews report
LEAK-714Aisin CorporationAisin Corporation announced a potential unauthorized access to the external service "Studio," which may have resulted in a leak of personal information. Specific details regarding the extent of the damage have not been disclosed.
Unauthorized access & data leakPossibleOfficial statement
LEAK-724Ducas Copy Japan Co., Ltd.Due to unauthorized access by a third party on another company's VPS server, customers using the VPS server are requested to change their transaction passwords.
Unauthorized access & data leakConfirmedOfficial statement
LEAK-762Oamishirasato CityUnauthorized access occurred to the hometown tax portal site "Furusato Choice," resulting in the personal information of registered donors being leaked externally. Consequently, the site has temporarily suspended services. Donors are being urged to be cautious of suspicious communications.
Unauthorized access & data leakConfirmedOfficial statement

Showing 20 of 57 cases

Incidents on Oct 22, 2026