Supply Chain Attacks and Third-Party Incidents

Stores that use the e-commerce cart system ShopServe, operated by Estore Co., Ltd., have published notices saying the system suffered unauthorized access from outside. This entry covers 8 stores.

The notices of PRGR and Waiefushii "ADVAN" say that between May 21 and August 1, 2026 a third party gained unauthorized access to Estore's servers and customer information was sent externally. The items named as leaked include names, addresses, email addresses, member IDs and encrypted passwords. On card data, Designphil lists part of the card number (the first 6 and last 4 digits), while Remedikomu says card data was kept on a separate server and was not affected.

The stage of confirmation differs by store. Enoguya Sankichi says that on September 25, 2026 it was informed by Estore that its customers' information was also confirmed as affected. JA Raifu Kurieito Fukushima "E-gyu Shop" says it is still confirming whether its customers are included, and Amtrans says it cannot confirm whether its own customers are affected, so those two are at the investigation stage.

A vulnerability in third-party software that KDDI had installed in its mail platform for ISPs was exploited, and email addresses and related data of the operators that use the platform leaked. The notices of 6 companies, including BIGLOBE, JCOM and KDDI Web Communications (CPI), are covered here.

The scope differs by company. BIGLOBE says the email addresses and BIGLOBE IDs of 5,016,432 persons leaked, and that 4,631,775 of them also had passwords leaked. STNet says the unauthorized access to its data took place from June 14 to 17. JCOM says that, in addition to the email address leak, passwords also leaked for 1,257 of the affected persons, and that it has finished resetting the passwords of those affected.

Several of the notices say KDDI confirmed the unauthorized access on June 17, 2026 and modified the system the same day. For the Business Standard and KWC Mail plans, CPI attaches a note stating that passwords were managed in hashed form and the passwords themselves were not leaked.

In its security bulletin (April 24, 2026), Vercel said it had identified unauthorized access to certain internal systems. According to Vercel, the incident originated with a compromise of Context.ai, a third-party AI tool used by one of its employees. The attacker used that access to take over the employee's Google Workspace account and then gained access to the employee's Vercel account.

Vercel says the attacker then moved through its systems and enumerated and decrypted environment variables that were not marked as sensitive. It first identified a limited subset of customers whose non-sensitive environment variables that decrypt to plaintext were compromised and contacted them, and says a continued investigation found a small number of additional compromised accounts, whose owners it notified.

Vercel says that, together with GitHub, Microsoft, npm and Socket, it confirmed that no npm packages published by Vercel were compromised. It also published an indicator of compromise (IOC) for the Context.ai Google Workspace OAuth app, saying that the app was the subject of a broader compromise.

Malicious versions of the Nx monorepo tool and its plugins were reportedly published to npm after attackers compromised its CI workflow. The postinstall script is reported to have harvested credentials and exfiltrated data, and to have abused local AI coding agents such as Claude Code, Gemini and Amazon q.

According to the report, by invoking unsafe flags it coerced the tools into scanning developer machines for sensitive files, which the AI Incident Database describes as one of the first known AI-assisted supply chain attacks. Another report says the malicious releases were live for about 5 hours 20 minutes before removal, and that the Nx Console VS Code extension was also affected.

A reported compromise of Amazon's AI coding assistant Q allegedly involved the insertion of commands that, if executed, could have wiped local files and potentially affected cloud resources. The altered code is reported to have been incorporated into a public release before it was detected and removed.

The AI Incident Database entry points to the compromised release as version 1.84.0 of the Amazon Q Developer extension. It also lists, among its reports, a security update for that extension published by Amazon Web Services (publication date: July 23, 2025).

Large language models reportedly hallucinated names of software packages that do not exist, some of which were later uploaded to public repositories and incorporated into real codebases.

In one reported case, a package named huggingface-cli, purported to have been originally suggested by an AI model, was downloaded more than 15,000 times. It is also reported that several big businesses published source code that incorporates a package previously hallucinated by generative AI.

The technique in which attackers register hallucinated package names to introduce potential malware into software supply chains is called slopsquatting by security researchers.