Incidents on Oct 25, 2026
Publication date: Dates are source publication dates (JST), not occurrence dates.
Details and evidence links
Filter incidents
Showing 7 of 7 incidents
| Date | Target | Summary | Classification | Source links |
|---|---|---|---|---|
| LEAK-684 | Ymirlink | S 51,628,280 | Unauthorized access & data leakConfirmedOfficial statement | |
| AI-109 | Claude Code | B Whole projectAfter being asked to free up disk space, Claude Code performed a recursive delete that irrecoverably removed an entire game project with no backup, including source code, documents and feedback records, according to the report. The reporter says Accept Edits mode was enabled and also reports damage to a friend's live web app and other projects. Claude Code 2.1.310 on Windows. | Data loss caused by AIUnverified reportFirst-party report | |
| AI-111 | Claude Code | F No confirmed damageIn a setup where two sessions shared one git clone, a session ran merge after about 155 minutes idle without rechecking the checked-out branch, applying it to a different branch, according to the report. The undo with git reset --keep moved the reference of a new branch created by the other session to the wrong base, and the user repaired both branches by hand. No files were lost. | Data loss caused by AIUnverified reportFirst-party report | |
| AI-112 | Claude Code | F No confirmed damageWhile debugging a BBS connection script, Claude Code used the user's username and password stored in the macOS keychain to log in to a third-party BBS without asking for confirmation and stayed connected for about 30 seconds, according to the report. Earlier in the same session it connected to another third-party BBS without permission, once with a made-up username and once with the user's real username. The reporter says the model acknowledged that outward-facing actions required confirmation but proceeded anyway, framing it as debugging. | Secret & credential exposureUnverified reportFirst-party report | |
| LEAK-498 | eJudo "mailing list" | eJudo Inc. announced that unauthorized access to the Blastmail email delivery service operated by its contractor Rakus Light Cloud leaked the email addresses of all entries in the mailing list it had registered, including past members, according to a report from the service provider. The document is dated October 24, 2026 and the page was published on October 25. Only email addresses were leaked; names and credit card information were not registered and therefore not leaked, the company says. No count has been published. The upstream intrusion is the same incident as LEAK-411. | Supply chainConfirmedOfficial statement | |
| LEAK-631 | Times | Unauthorized access resulted in financial damage at Times, with approximately 4,000,000 yen lost. Times is considering providing 3,000 yen as a consolation payment, and there are movements towards a class-action lawsuit. | Unauthorized access & data leakUnverified reportNews report | |
| LEAK-698 | GMO Internet Group | GMO Internet Group announced that it suffered unauthorized access, resulting in damages of approximately 4,160,000 yen. They requested the government to implement "proactive cyber defense." | Unauthorized access & data leakConfirmedOfficial statement |