Hacking & intrusion incidents
Hacking & intrusion incidents, most recently reported first.
Modoo Jobs website defaced, replacing service information
Impact: Website homepage defaced
According to a report published on 15 November 2026, the website of professional talent matching service Modoo Jobs was defaced in a hacking incident. The reported damage was the alteration of the website’s display; the information supplied in the article does not establish whether personal information was leaked or the scale of any leak.
Read on 데일리시큐 ↗Unauthorised access to file-sharing platform at facility under Malaysia’s Ministry of Health
Malaysia’s Ministry of Health detected unauthorised access to a secondary file storage and sharing platform at one of its facilities on 12 November 2026 and blocked external access. It said an initial investigation found that the main databases had not been encrypted, and that core operational systems and medical and patient care services were operating normally without disruption.
Read on The Star ↗Around 17,000 ticket QR codes stolen from Hong Kong Disneyland
Impact: Around 17,000 admission ticket QR codes stolen; online ticket sales and hotel bookings suspended
Around 17,000 admission ticket QR codes were stolen from Hong Kong Disneyland's computer systems. The resort suspended ticket sales and hotel bookings on its official website and reported the incident to the police. The police are investigating the incident as a case of unauthorised computer access.
Related reports: 2 →Trezor confirms three tampered wallets in October report investigation, updates response
Impact: Malicious devices identified in three Safe 5 hardware wallets
Trezor said its investigation into a wallet-tampering report received on 28 October identified malicious hardware devices in three Safe 5 wallets sold by Cryptobilis. The devices collect information including recovery phrases displayed on the screen and transmit it to attackers over mobile networks. Trezor released firmware on 11 November to block the devices’ data collection and said no related losses of funds had been reported to date.
Read on BleepingComputer ↗Unauthorised access at Yamada Denki may affect 3.5 million customer records
3.5mImpact: Up to 3.5 million customer records potentially affected
Unauthorised access was confirmed in Japanese retailer Yamada Denki’s renovation management system, raising the possibility that up to 3.5 million customer records may have been affected. The information includes names, addresses, telephone numbers, renovation histories and quotation records. The company has blocked external access and is investigating whether data was actually leaked externally and what caused the incident.
Related reports: 6 · last report →UK Housing Ombudsman plans case management system recovery after October cyber-attack
Impact: Disruption to the case management system, online complaint forms, landlord portal and webchat. Whether personal information was compromised and the number of people affected remain unconfirmed.
The UK Housing Ombudsman confirmed unauthorised access to data in its case management system supplied by an external provider in October 2026 and took the system offline. In November, it said it would begin recovery work shortly after putting additional security measures in place. Whether personal information was compromised and the full extent of the damage remain under investigation.
Read on Inside Housing ↗Kyungil University confirms intrusion into staff electronic document system
Impact: Claimed theft of 108 GB of data and restrictions on external access to key information services
Kyungil University said its staff-only electronic document system suffered an external intrusion at around 8 pm on 12 November 2026. The university restricted external access to key information services amid concerns that the damage could spread. On the same day, a post on an online hacking forum named the system’s address and claimed to have obtained 108 GB of university data. The actual amount of data exfiltrated and whether personal information was leaked remain unconfirmed.
Read on 데일리시큐 ↗Sega announces follow-up measures after unauthorised access halts Lucky Kuji online sales
Impact: Suspension of sales of certain online lottery products
Sega Lucky Kuji Online and related services have been suspended since 1 November 2026 for safety checks following unauthorised access to Sega Fave's servers. This report concerns follow-up measures for certain lottery products whose sales were suspended, rather than a new incident.
Read on Yahoo!ニュース ↗Bessent claims Chinese AI was used in French supermarket refrigeration hack
Impact: Refrigeration equipment at approximately 700 supermarkets in France was affected, resulting in spoiled food being discarded.
On 12 October 2026, a cyber-attack hit refrigeration control systems at approximately 700 supermarkets in France, causing food to spoil. Several retailers, including Intermarché, Carrefour and E.Leclerc, were affected. On 12 November, US Treasury Secretary Scott Bessent claimed that a Chinese AI model had been used in the attack.
Read on Mezha.net ↗Barracuda cloud hack gives attacker access to credential storage system
Impact: Unauthorised access to a system storing customer integration credentials
Barracuda's internal cloud was hacked, allowing an attacker to access a system storing credentials that connect customer systems to security services. The company disclosed the incident on 10 November and individually notified potentially exposed customers. It found no direct evidence that customer integration credentials had actually been viewed or taken.
Read on 데일리시큐 ↗NK Economy backup site and CEO’s Facebook account compromised
Impact: Intrusion into the blog backup site, takeover of the CEO’s Facebook account and shutdown of the linked page
On 12 November 2026, an intrusion exploiting a system vulnerability was detected and addressed on NK Economy’s Digital Hurricane blog backup site. The site contained no personal information. On 13 November, the recovery email address for the CEO’s Facebook account was changed and the account was made private, while the linked NK Economy Facebook page was also shut down. The extent of the damage and whether access has been restored still require confirmation from Facebook.
Read on NK경제 ↗MUJI curtain subcontractor's server breached; 19,933 customer records potentially exposed
19.9kImpact: Potential exposure of 19,933 customer records, including duplicate records for the same customers. Names, addresses, telephone numbers, order information and delivery addresses are affected; actual disclosure remains unconfirmed.
MUJI operator Ryohin Keikaku announced on 2 November that customer information may have leaked from a server managed by Nanotech, a subcontractor handling made-to-order curtains. In an investigation on 28 October, Nanotech identified signs of unauthorised external access on 19 October. The potentially affected data consists of 19,933 customer records relating to orders placed between 10 April 2018 and 25 January 2022, including names, addresses, telephone numbers, order information and delivery addresses; whether any data actually leaked remains under investigation.
Read on ScanNetSecurity ↗August intrusion at Shimane no Furusato Chokusobin may have exposed seven people’s card details
7Impact: Possible exposure of seven people’s credit card numbers, expiry dates, cardholder names, security codes, and payment methods (six of whom completed purchases)
On 2 November, Shimane Prefecture announced that an intrusion exploiting a vulnerability in the Amazon Pay plugin had occurred at Shimane no Furusato Chokusobin on 13 August 2026. The attacker created an unauthorised administrator account and planted a file that read payment information entered by users, potentially exposing the card details of seven people who went through the payment process from 13 to 15 August. The operator deleted the unauthorised account, disabled the plugin, restored files, and notified those affected on 23 October. As of 1 November, no fraudulent card use had been confirmed for the six people who completed purchases.
Read on ScanNetSecurity ↗Tokyu Land websites breached; 4,082 personal information records potentially leaked
4.1kImpact: A total of 4,082 personal information records from two websites may have been leaked: 4,079 membership records and three enquiry records. An actual leak has not been confirmed.
Tokyu Land Corporation detected unauthorised access in the shared AWS server environment hosting websites it manages on 19 October 2026 and disclosed it on 30 October. The attack exploited a CMS software vulnerability and inadequate server access permission settings, potentially exposing 4,079 GREEN CROSS PARK membership records and three GREENUP Cooldown Project enquiry records. The company urgently took the affected sites offline and carried out security measures and an investigation, but no actual data leak has been confirmed.
Read on ScanNetSecurity ↗Kyoto Prefecture confirms no applicant data leaked in October email service breach
288Impact: An investigation confirmed that 288 personal information records for representatives of volunteer applicants for the Games had not leaked
Kyoto Prefecture and the city of Kyoto said that no information on World Masters Games volunteer applicants had leaked following unauthorised access to servers of the email distribution service blastmail in October. Names and email addresses in 288 application representative records were initially thought to have potentially leaked, but an investigation by an external specialist organisation completed on 11 November confirmed that no leak had occurred.
Read on 京都新聞デジタル ↗Taiwan's United Recommend International detects abnormal e-commerce access, investigates member order API
Taiwanese e-commerce and clothing company United Recommend International discovered abnormal system access from an external IP address while investigating customer reports of suspected scam emails. Some requests targeted an API related to member orders, and an investigation is under way to determine whether personal information was actually accessed and the extent of the impact.
Read on iThome ↗Cyber-attack disrupts Evergreen Logistics servers
Impact: Server disruptions affecting some information systems
Taiwan's Evergreen Logistics detected server disruptions on 12 November 2026 and confirmed that hackers had attacked some of its information systems. The systems returned to normal after response and recovery work supported by external security specialists, and the company provisionally assessed that there was no significant impact on its finances or operations.
Read on iThome ↗PLAID suspends all KARTE services after unauthorised access
Impact: All functionality suspended across all customer projects; possible external leak of some information
Japan's PLAID detected unauthorised third-party access to its customer experience platform KARTE on 13 November and progressively suspended functionality across all customer projects. Web and app measurement, message delivery and administrative interfaces were among the functions affected. The company identified information that may have been leaked externally and notified the affected corporate customers individually, and it is investigating the intrusion route and the scope of the damage.
Related reports: 9 · last report →NHN Dooray revokes API keys and suspends service after unauthorised access attempts
Impact: Customers’ integrations with external systems and automation functions disrupted
NHN Dooray detected attempts by an external party to access accounts without authorisation and abnormal calls using API keys in the early hours of 13 November. The company revoked all service and administrator API keys and suspended API access, disrupting customers’ integrations with external systems and automation functions. Whether an intrusion succeeded, whether personal information was leaked, and the extent of the damage remain under investigation.
Related reports: 3 · last report →Tochigi suspends Gurutochi website following unauthorised access and tampering
Impact: Gurutochi website taken offline
Unauthorised access and tampering that redirected visitors to a fake website were confirmed on Tochigi Prefecture’s Gurutochi website. The website has been offline since 11 November, and the prefecture urged users to exercise caution.
Related reports: 2 · last report →