S Up to 6,230,000 recordsJoshin announced that its network was subject to unauthorized access, potentially leaking up to 6,230,000 pieces of customer information. The leaked information includes names, addresses, phone numbers, two images of driver's licenses, one My Number card, and five account numbers, but does not include credit card information.
Unauthorized access & data leakUnverified reportNews report
S 4,454,097 recordsUnauthorized access occurred in Furusato Choice, confirming the leakage of 4,454,097 records of personal information. The leaked information includes names, email addresses, addresses, phone numbers, hashed passwords, and estimated donation deduction amounts. Maniwa City is urging donors to change their passwords.
Unauthorized access & data leakConfirmedOfficial statement
S 4,454,097 recordsUnauthorized access by a third party was confirmed to member information managed by Trust Bank Co., Ltd. on Furusato Choice, resulting in the leakage of 4,454,097 records of personal information. The leaked information includes names, email addresses, addresses, phone numbers, and hashed passwords.
Unauthorized access & data leakConfirmedOfficial statement
S 4,454,097 recordsOn October 26, 2026, it was announced that personal information of registered members was leaked due to unauthorized access by a third party to the hometown tax portal "Furusato Choice" operated by Trust Bank Co., Ltd. The confirmed leaked personal information includes 4,454,097 records, which consist of names, email addresses, addresses, phone numbers, hashed passwords, and estimated donation deduction amounts.
Unauthorized access & data leakConfirmedOfficial statement
S 4,454,097 recordsUnauthorized access occurred to member information managed by Trust Bank Inc. on the hometown tax site "Furusato Choice," confirming the leakage of 4,454,097 records of personal information. The leaked information includes names, email addresses, addresses, phone numbers, hashed passwords, and estimated donation deduction amounts.
Unauthorized access & data leakConfirmedOfficial statement
S 4,454,097 recordsUnauthorized access occurred on the hometown tax portal site "Furusato Choice," confirming the leakage of 4,454,097 records of personal information. The leaked information includes names, email addresses, addresses, phone numbers, hashed passwords, and estimated donation deduction amounts.
Unauthorized access & data leakConfirmedOfficial statement
S 4,454,097 recordsUnauthorized access occurred to member information managed by Trust Bank Co., Ltd. on the hometown tax portal site "Furusato Choice," confirming the leakage of 4,454,097 records of personal information. The leaked information included names, email addresses, addresses, phone numbers, hashed passwords, and estimated donation deduction amounts.
Unauthorized access & data leakConfirmedOfficial statement
Rakuten Group "Rakuten Travel (overseas hotel booking site and multilingual booking site)"
S Up to about 3,460,000 recordsRakuten Group, Inc. announced on October 26, 2026 that it had confirmed unauthorized access by an outside third party to some pages of the Rakuten Travel overseas hotel booking site and to its multilingual booking site, and that customer information was confirmed to have been the target of that unauthorized access. On the overseas hotel booking pages, managed and operated by subsidiary Rakuten Travel Xchange, an anomaly was detected on September 10, the cause was identified on September 15 and system fixes were completed on September 16. The affected data there covers up to about 40,000 booking records (names, email addresses, phone numbers, country of residence, internal identifiers, booking details such as property name and amount, and companions' names and countries of residence), payment information for up to about 36,000 of them (card issuer identification number and last four digits, cardholder name, expiry date and card brand), and up to about 2.6 million login-user records (names, email addresses, phone numbers and internal identifiers). The affected regions are parts of Europe, the United States and Canada, and some countries and regions in Asia and Oceania. On the multilingual booking site, managed by Rakuten Group, possible unauthorized access was detected on October 20, the cause was identified the same day and fixes were completed on October 21; the affected data covers up to about 860,000 login-user records (email addresses and internal identifiers) and up to about 40,000 accommodation staff accounts (account names, email addresses and internal identifiers). Full card numbers, security codes, passwords, passport and other identity document information, and addresses are not included, and the company says the affected information alone cannot be used for fraudulent payments or cash advances. The notice describes the data as the target of unauthorized access rather than confirming a leak or exfiltration. The company has reported to the Personal Information Protection Commission and relevant overseas authorities, and no secondary damage or impact on other services had been confirmed at the time of the notice. Basis for the count field: up to about 2.6 million login-user records on the overseas hotel booking site and up to about 860,000 login-user records on the multilingual booking site are summed as user records of separate sites, giving up to about 3,460,000 records. The up to about 40,000 booking records are excluded because they may overlap with login users on the same site, and the up to about 40,000 accommodation staff accounts are excluded because they are not customer records. This is not a number of unique people.
Unauthorized access & data leakPossibleOfficial statement
Central Japan Railway, West Japan Railway and Kyushu Railway "Express Yoyaku and Smart EX"
A About 170,000 recordsCentral Japan Railway Company (JR Central), West Japan Railway Company (JR West) and Kyushu Railway Company (JR Kyushu) announced on October 26, 2026 that Ymirlink, Inc. informed them that day that unauthorized access to its Cuenote FC email delivery service, which the two services used for member mailings, allowed a third party to view or obtain some members' email addresses, member IDs, names in katakana and membership types, and that this information was leaked. When Ymirlink was breached on October 16, it had told the companies that users of the two services were not affected. Affected members are those who received mailings sent through the service, such as promotional emails and notices that departure times of booked trains had changed because of the Kumamoto earthquake. Other personal information, including names other than katakana, dates of birth, addresses, phone numbers, credit card numbers and expiry dates, could not have been leaked, and no leak from the systems JR Central holds for the two services has been confirmed. The number of affected records has not been published because Ymirlink is still confirming it (media reports put it at about 170,000). The companies stopped using the affected email service, reported the incident to the Personal Information Protection Commission the same day and will contact affected members individually. The upstream intrusion is the same incident as LEAK-383 (Ymirlink "Cuenote FC").
B About 40,000 recordsUnauthorized access occurred on the Yakult Headquarters website, confirming the leakage of approximately 40,000 records of personal information. The leaked information includes names, genders, age groups, addresses, phone numbers, and email addresses. A detailed investigation is currently underway, with reports being made to the Personal Information Protection Commission and consultations with the police.
Unauthorized access & data leakConfirmedOfficial statement
C 1,209 recordsPan House Co., Ltd. announced that unauthorized access occurred to the external service "Studio," potentially leading to the leakage of personal information submitted through the company's website forms. The information that may have been leaked includes names, company names, email addresses, and phone numbers for 739 individuals, totaling 1,209 records. Currently, it has not been confirmed that any information was actually exfiltrated, but the company is taking action.
Unauthorized access & data leakPossibleOfficial statement
C About 1,000 recordsPalan Inc. announced that personal information was leaked due to unauthorized access and issued an apology. The leaked information includes approximately 1,000 records.
Unauthorized access & data leakConfirmedOfficial statement
D 344 recordsUnauthorized access occurred at Rakus Light Cloud, and there is a possibility of personal information leakage. On October 24, 2026, an additional 56 records of leakage were confirmed, bringing the total to 344 records, but it has been confirmed that Gifty's contract information is not included. The investigation is ongoing, and the situation may change with future developments.
Unauthorized access & data leakPossibleOfficial statement
D 288 recordsOn October 26, 2026, it was announced that unauthorized access occurred at Raksul Light Cloud, the operating company of Suwa City's hometown tax portal site "Tabisaki Nozei," with a possibility of leakage of 288 records of personal information. According to contract information from Gifty, it has been confirmed that the leaked data is not included.
Unauthorized access & data leakPossibleOfficial statement
E 65 recordsUnauthorized access occurred to the server of Sankei Living Newspaper, which is used for recruiting survey monitors for family education support awareness materials issued by the Hiroshima Prefectural Board of Education, revealing the possibility of leakage of 65 records of personal information. The potentially leaked information includes names, email addresses, and nicknames, and no secondary damage has been confirmed.
Unauthorized access & data leakConfirmedOfficial statement
F 2 peopleTrust Bank Co., Ltd. announced that personal information was leaked due to unauthorized access in Furusato Choice. The leaked information includes credit card details (last four digits, name, expiration date) of 2 donors, but no other donor information has been confirmed as leaked. Reports have also been made to the Personal Information Protection Commission and the police.
Unauthorized access & data leakPossibleOfficial statement
Furukawa Electric Power Systems Co., Ltd. announced that it confirmed an incident suspected of unauthorized access from outside to its web system for shipment management in the disaster prevention products department. As a result, there is a possibility that personal information may have been viewed or obtained externally. A detailed investigation is currently underway, and the potentially affected information includes orderer information and product delivery information, but it does not handle credit card information or account information.
Unauthorized access & data leakPossibleOfficial statement
OANDA Securities reported an incident regarding unauthorized access and information leakage related to the GMO Internet Group's VPS environment that occurred on October 21, 2026. While no unauthorized access to OANDA's management systems has been confirmed, there is a possibility that login information was leaked due to GMO's services. Customers are advised to change their passwords and set up two-factor authentication.
Unauthorized access & data leakPossibleOfficial statement
On October 24, 2026, unauthorized access occurred against "MeLL+professional" operated by Wiseman Co., Ltd. Currently, no personal information leakage has been confirmed, but related services have been temporarily suspended and security measures have been strengthened.
Unauthorized access & data leakPossibleOfficial statement
Unauthorized access occurred against the external service "Cuenote FC," potentially leading to the leakage of registered information. The leaked information may include email addresses and names. An investigation into the extent of the impact is currently underway.
Unauthorized access & data leakPossibleOfficial statement
Unauthorized access occurred in the "Onamae.com Desktop Cloud" provided by GMO Internet, affecting AI Gold Securities Co., Ltd. Customer trading account information was not included, and no unauthorized access to the trading system or leakage of account information was confirmed. Customers are being urged to change their passwords.
Unauthorized access & data leakConfirmedOfficial statement
Unauthorized access by an external third party was confirmed in the tenant application service "GoWeb" provided by GoWeb Cloud. The potentially affected information includes the names, birth dates, and addresses of applicants, but it has been confirmed that there was no unauthorized access to images of identification documents. An investigation into the extent of the impact is currently underway.
Unauthorized access & data leakConfirmedOfficial statement
Unauthorized access occurred in the logistics system managed by Bandai Logipal, confirming the potential leakage of some personal information. The leaked information may include delivery details for "Ichiban Kuji ONLINE" (name, address, phone number), but does not include credit card information. An investigation is currently underway for further details.
Unauthorized access & data leakConfirmedOfficial statement
It was discovered that when the Hiratsuka Civil Engineering Office sent a business report related to land acquisition to the landowner corporation, personal information of unrelated third parties was included in the report. The leaked information contained the names and expense records of 5 corporations and 4 individuals.
Unauthorized access & data leakConfirmedOfficial statement
Reports indicate that a PHP vulnerability issue has occurred in Oita, prompting administrative and corporate responses. There are concerns about unauthorized access, leading to browsing restrictions and functionality limitations.
Unauthorized access & data leakUnverified reportNews report
Since late September 2026, there have been daily announcements of personal information leaks from domestic companies and services, with over 70 announcements made between October 1 and 16 alone. Significant leaks have been confirmed at companies such as SourceNext, SkyTicket, Burger King, and Yakiniku King. JPCERT/CC has also confirmed that attackers are using AI.
Unauthorized access & data leakConfirmedOfficial statement
Unauthorized access occurred at the provider of the email distribution service "Cuenote FC" used by SBI Shinsei Bank. Upon confirmation, it was determined that the bank's usage environment is not affected, and no information leakage has been confirmed at this time.
Unauthorized access & data leakPossibleOfficial statement
Unauthorized access occurred in the email distribution service "Cuenote" of Ymirlink Inc., revealing that some of the information handled through the service was leaked externally. Currently, verification of the details and impact of the leaked information is ongoing.
Unauthorized access & data leakConfirmedOfficial statement
