Supply-chain breaches
When a contractor, partner or software vendor that handles personal data is breached, customer data from the organisations that use it can leak too. Here is how far each incident spread. (168)
MetaM customer service systems hacked, exposing phone numbers and conversations
Impact: Phone numbers and customer service conversations in some customer service systems
An external attack on some of MetaM’s customer service systems revealed indications that phone numbers and customer service conversations had been accessed without authorisation or exfiltrated. MetaM became aware of the incident following a customer service outage at 6:03 am on 12 November 2026. During its investigation, the company found that abnormal access to some services had occurred before it became aware of the incident, and it is investigating the extent of any further data exposure and the intrusion vector.
Related reports: 2 · last report →
Fireworks AI breached again, exposing customer data and model weights
Impact: Some customers’ account information, billing information, secrets, datasets and unfinished model weights
Fireworks AI experienced further unauthorised access to its development systems on 24 October through a breach at an external cloud provider, 18 days after confirming the initial breach. The investigation confirmed that customer account and billing information, as well as some customers’ secrets, datasets and unfinished model weights, were affected. The company revoked credentials, isolated systems and notified all affected customers.
Related reports: 15 · last report →
Also affected: 1- NotionFireworks AI breach exposes Notion AI chat historiesAI chat histories exposed in fewer than 1% of all workspaces
Hacking of supermarket refrigeration systems in Europe causes food losses and fires
Impact: Damage to refrigeration and freezing systems in nine European countries, with food losses and some fires at hundreds of supermarkets in France
In October 2026, cyber-attacks targeting refrigeration and freezing systems at hundreds of supermarkets in France raised temperatures, causing food losses and fires. Similar incidents subsequently occurred in several other European countries, bringing the number of affected countries to nine. In November, French authorities identified Shahid Kaveh, a cyber unit of Iran's Islamic Revolutionary Guard Corps, as responsible for the attacks.
Related reports: 508 · last report →
Also affected: 3- DelhaizeSuspected cyber-attacks hit refrigeration systems at dozens of Belgian Delhaize storesRefrigeration and freezer systems affected at 40 Belgian stores
- 랭리지 오가닉British businesses caught in Europe-wide supermarket fridge attacks
- French Blood EstablishmentCooling systems hacked at three French Blood Establishment facilitiesTemperature control settings altered at three facilities; no blood products damaged
Bookeasy breach may expose Australian national park booking customers' data
Impact: Potential exposure of names, addresses, contact details and booking information of customers across several Australian states and territories
Unauthorised access to Australian booking platform Bookeasy was confirmed to have potentially allowed the names, addresses, contact details and booking information of its partners' customers to be viewed or exposed. National park booking customers across several states and territories were affected, and WhatsApp scam messages using actual booking information to demand additional payments were also reported. Parks Victoria temporarily suspended new campsite bookings, and no evidence of access to credit card information was found.
Related reports: 7 · last report →
Also affected: 3- Parks VictoriaBookeasy breach raises concerns for Parks Victoria booking customersSuspicious WhatsApp messages sent to booking customers and suspension of new campsite bookings
- Queensland Parks and Wildlife ServiceQueensland Parks and Wildlife Service booking users’ data stolenPersonal information of national park booking users, including email addresses, addresses and telephone numbers
- Australian Capital TerritoryAustralian Capital Territory warns around 6,000 people after booking service breachAround 6,000 people notified of possible exposure of personal information and booking details
Taiwan's 91APP order database breach may expose data of 4.8 million consumers
4.8mImpact: Potential exposure of information on 4,798,255 consumers across up to 1,329 brands
A breach of Taiwanese e-commerce platform 91APP's order database raised concerns that 4,798,255 consumers across up to 1,329 brands could be affected. Names, telephone numbers, delivery addresses, email addresses and order histories were potentially exposed, but the actual extent of unauthorised access or theft has not been confirmed. 91APP allowed consumers to apply for compensation even without financial losses and moved the application channel from Google Forms to its official website. Taiwan's Ministry of Digital Affairs suggested a link to the AI hacking tool ARTEX.
Related reports: 27 · last report →
Also affected: 2- MUJI Taiwan91APP breach may have leaked order data of about 180,000 MUJI Taiwan membersPossible leak of online order data of about 180,000 members
- COSMEDCOSMED affected by cyber-attack on 91APP
Malware on Quantum Systems servers prompts German military to halt drone operations
Impact: Temporary suspension of the German armed forces’ operations of the manufacturer’s drones
German drone manufacturer Quantum Systems detected a cyber-attack on its internal servers in late October 2026. Update files containing malware had been planted on the servers, reportedly in an attempt to affect drone operations through updates. The company began a joint investigation with the authorities, and the German armed forces temporarily suspended operations of the manufacturer’s drones as a precaution.
Related reports: 12 · last report →
Also affected: 1- German Armed ForcesMalicious drone update temporarily grounds German military dronesTemporary suspension of Quantum Systems drone operations
Amicus Lex hack exposes personal data of 20,028 users
20kImpact: Personal information of 20,028 LawForm users
A hack at Amicus Lex at 5:38 am on 11 November exposed the names, phone numbers and email addresses of 20,028 LawForm users. An SQL injection attack targeting the administrator page and a vulnerable API were identified, and the vulnerable API code was deleted. The Ministry of SMEs and Startups disclosed the incident approximately 60 hours after becoming aware of it.
Read on 헤럴드경제 ↗
Also affected: 1- Ministry of SMEs and StartupsHack exposes data of 818 participants in ministry's Entrepreneurship for All programmePersonal information of 818 Entrepreneurship for All participants
GMO Internet cloud breach leaks customer data and causes trading losses
Impact: Up to 26,739 servers affected; loss compensation claims totalling 2.99 billion yen for 2,943 accounts
GMO Internet's Onamae.com Desktop Cloud suffered a malware attack that affected up to 26,739 servers, resulting in customer data leaks and asset losses from unauthorised trades. The company advised customers to shut down their PCs and offered a bounty to track down the attackers, while acknowledging that it had not adequately responded to earlier warnings about security vulnerabilities. By 12 November, claims for loss compensation totalling 2.99 billion yen had been submitted for 2,943 accounts, while the final loss amount remained undetermined.
Related reports: 70 · last report →
Also affected: 1- Sompo Japan InsuranceSompo Japan contractor breach may have exposed 65,000 policyholder recordsPossible exposure of approximately 65,000 policyholder records
Intrusion into Japanese security firm's development environment raises customer data concerns
Impact: Possible exposure of some customers' company names, names, email addresses and service communications information
A Japanese security services provider detected suspected third-party access to its development administration environment after an employee's GitHub credentials were compromised. It is investigating whether some customers' company names, names, email addresses and service communications information may have been viewed or obtained. The company said it would respond across the organisation to prevent a recurrence and restore trust.
Related reports: 14 · last report →
Also affected: 4- City of KurashikiTicket vendor breach sparks concerns over Kurashiki buyers’ data
- Shinagawa CityShinagawa childcare programme exposes 195 email addresses in subcontractor breach195 email addresses leaked
- Toyo UniversityToyo University confirms alumni and parents’ email addresses leaked in external email service breach
- Kyoto City KYOCERA Museum of ArtKyoto City KYOCERA Museum of Art emails potentially exposed in ARTPASS contractor breach
Unauthorised access at Yamagata Prefecture newsletter contractor
Unauthorised access occurred at the company responsible for running Yamagata Prefecture's email newsletter. The prefecture published its investigation findings on 12 November, with no information leaks confirmed from services it operates.
Related reports: 10 · last report →
Unauthorised access to ReserVision bookings leads to customer phishing
Impact: Personal information and booking details of restaurant and hotel guests
Unauthorised access through customer accounts on reservation service ReserVision exposed the personal information and booking details of restaurant and hotel guests. The stolen information was used in phishing emails requesting payments or card details, and some businesses' actual email sending accounts were also misused.
Read on Tageskarte ↗
Also affected: 2- BorchardtBorchardt warns of payment scams after external booking system hack
- Bremer Union BrauereiBremer Union Brauerei customer data potentially exposedPotential exposure of customer names, contact details, booking information and some allergy information
Fireworks AI breach exposes client information
In October 2026, Fireworks AI, an AI service provider for Uber, was breached, leading to a leak of client information. The attacker stole the service provider’s internal credentials and used them to access Uber’s account with the provider. Uber is notifying US drivers that their personal information and driving licence information were exposed.
Related reports: 4 · last report →
Also affected: 1- UberFireworks AI breach exposes licence data of thousands of US Uber driversPersonal information and driving licence data of thousands of US drivers, including 3,430 South Carolina residents
OPENLOGI breach exposes seven months of delivery data
Impact: Some dispatch data covering approximately seven months leaked; the total number of records remains under investigation.
Japanese logistics company OPENLOGI experienced unauthorised access on 8–9 November, and some delivery data received from 8 April to 8 November was exfiltrated. The data included recipients’ names, addresses, telephone numbers, email addresses and product information. By 12 November, 13 client companies and services had announced impacts, while the full extent of the breach remained under investigation.
Related reports: 12 · last report →
Also affected: 2- Carry OnKimagure Cook's agency Carry On warns of possible buyer data leak after logistics provider hack
- REALITY StudiosOPENLOGI breach may have exposed REALITY Studios customer dataPossible exposure of recipient, delivery, contact and product information for official online shop customers; affected customers and number of records under investigation
Dentsu Digital TONARIWA breach leaks personal data from two client companies
Impact: Personal data from two client companies leaked; number of affected records under investigation
Unauthorised access and privilege escalation using leaked administrator account credentials were confirmed on Dentsu Digital's marketing platform TONARIWA. A follow-up announcement on 12 November confirmed logs showing that personal data from two client companies had been exfiltrated, with names, dates of birth, contact details and LINE integration access tokens among the information identified as leaked. All servers were shut down and isolated, and the number of affected records is under investigation.
Related reports: 10 · last report →
Also affected: 1- Japan PostDentsu Digital breach shuts down Japan Post’s LINE serviceSuspension of the official LINE service and possible leak of user information
Taiwan netiCRM provider’s management server breached, client data stolen
Impact: Theft of non-profit clients’ contact details, contract and billing documents, and customer support records
An internal management server at Taiwan’s netiCRM provider was compromised, and non-profit clients’ contact details, contract and billing documents, and customer support records were stolen. More than 30 non-profit organisations warned donors about scams. The provider included servers belonging to around 500 clients in its inspection and rebuilding programme, and as of 12 November, no evidence of donor information theft had been found.
Related reports: 7 · last report →
Also affected: 1- Citizen Congress WatchCitizen Congress Watch warns of possible donor data breachPossible exposure of donor names, phone numbers, donation records and other information
Asahi ransomware attack disrupts Japanese production amid data leak concerns
2.3mImpact: Potential exposure of 2.28 million personal information records and disruption to production and dispatches in Japan
Asahi Group suffered a cyber-attack in September 2025 that disrupted production and dispatches in Japan, and subsequently confirmed that it was a ransomware attack. The ransomware group Qilin claimed responsibility, while the company kept operations running through manual processes. By July 2026, the number of personal information records potentially exposed had increased to 2.28 million.
Related reports: 48 · last report →
Also affected: 1- Seven-Eleven JapanAsahi cyber-attack leaves Seven-Eleven Japan short of beerShortage of Super Dry beer
Arara email service cyber-attack exposes 81.33 million email addresses
81.3mImpact: 81,329,467 email addresses and some customers' member information
Japan's Arara Message email delivery service was breached through a web server vulnerability, exposing email addresses and some customers' member information. Further investigation put the number of unique email addresses exposed at 81,329,467. The attacker also misused the service to send up to approximately 7.13 million emails impersonating credit card companies, and the company isolated the servers and suspended its email delivery service entirely.
Related reports: 20 · last report →
Also affected: 25- AsoviewAsoview service provider breach exposes 15,821,184 member records15,821,184 member records
- Solaseed AirAround 490,000 Solaseed Air customer email addresses leakedAround 490,000 customer email addresses
- TKCArara email service breach exposes up to 2.23 million TKC user email addressesUp to 2,230,812 user email addresses
- City of FukushimaUnauthorised access to Arara may have exposed up to 4,700 Fukushima personal data recordsPotential leak of up to 4,700 personal data records
- Sumitomo Mitsui Banking CorporationAround 227,000 customer email addresses leaked at Sumitomo Mitsui Banking CorporationAround 227,000 customer email addresses
- Sakai CityUp to around 290,000 email addresses potentially leaked from Sakai City's online application systemPotential leak of up to around 290,000 email addresses
- ShogakukanArara hack raises fears of nearly 2 million Shogakukan member records leakingPossible leak of 1,993,665 member records
- Yokohama RubberYokohama Rubber subscriber data leaked in Arara incidentCompany names and email addresses of news release and email newsletter subscribers exposed; the official announcement did not disclose the number of records
- City of YaitaUnauthorised access to Arara raises email leak concerns in Yaita
- TV Shin-HiroshimaUnauthorised access to Arara exposes 5,192 TV Shin-Hiroshima users’ email addressesEmail addresses belonging to 5,192 people
- City of HonjoHonjo warns of possible card appointment data leak following subcontractor breachPossible personal information leak
- City of Yokohama508 email addresses leaked from Yokohama facility booking system508 email addresses exposed: 443 belonging to user organisations and 65 belonging to facilities
- L’Arc-en-Ciel Fan ClubL’Arc-en-Ciel fan club email addresses exposed in Arara breach
- Cabinet Office of JapanAbout 62,000 email addresses of Japan Cabinet Office newsletter users leakedAbout 62,000 email addresses of newsletter users
- Mitsubishi UFJUnauthorised access to Arara exposes some Mitsubishi UFJ shareholders’ email addressesEmail addresses of some shareholders
- Bank of YokohamaBank of Yokohama loan customer data leak affects up to 60,505 recordsUp to 60,505 records belonging to some card loan and unsecured personal loan customers affected by the leak. The count may change following detailed investigation.
- Kewpie Group125,788 customer email addresses exposed at five Kewpie Group companies125,788 customer email addresses
- City of NahaNaha confirms 15,700 email addresses leaked in external email service cyber-attack15,700 user email addresses
- Tokyo GasUnauthorised access to Arara exposes 85,565 Tokyo Gas customer email addresses85,565 customer email addresses
- Akita Northern HappinetsAkita Northern Happinets fan club data leak affects 41 membersPersonal information of 41 fan club members
- City of OsakaArara breach leaks over 1.07 million Osaka administrative service email addresses1,078,713 email addresses belonging to users of the online administrative system, plus email addresses of users and participating merchants in a separate gift voucher programme
- Sanfrecce Hiroshima2,900 Sanfrecce Hiroshima customer email addresses leaked2,900 customer email addresses
- Sasebo e CoinOver 35,600 registered Sasebo e Coin email addresses leakedMore than 35,600 registered email addresses leaked
- City of KobeAround 85,700 email addresses leaked from Kobe's electronic application systemApproximately 85,700 email addresses
- Hokkaido Electric PowerHokkaido Electric Power reports 5,664 email addresses leaked in October Arara cyber-attack5,664 email addresses
SMBC Consumer Finance data breach affects up to 320,118 customers
320.1kImpact: Personal information of up to 320,118 customers
A third party breached Japan's SMBC Consumer Finance loan guarantee operations system and transferred data containing the personal information of up to 320,118 people outside the company. The compromised information included names, addresses, dates of birth, telephone numbers, email addresses, driving licence numbers, workplaces, annual incomes and guarantee contract details. The company detected the intrusion on 2 November, blocked access and temporarily shut down the system, while some partner financial institutions also suspended loan applications.
Related reports: 21 · last report →
Also affected: 2- San-in Godo BankData of 1,585 San-in Godo Bank personal loan customers leakedCustomer information of 1,585 personal loan borrowers
- Hiroshima Bank747 Hiroshima Bank card loan customer records leaked747 card loan customer records
AllUnited cyber-attack exposes Dutch sports club members' data
Impact: More than 350 sports clubs reported the breach; members' personal information and bank account details were exposed
An attacker exploited a software flaw in AllUnited, a Dutch sports club membership management platform, to copy its membership database. The exposed information included names, addresses, dates of birth, passwords and bank account details. The company began resetting all passwords, and more than 350 sports clubs reported the breach to the data protection regulator.
Related reports: 6 · last report →
Also affected: 1- De Zoutkeet Draughts ClubAllUnited hack exposes De Zoutkeet club members’ dataClub members’ information exposed
Unauthorised network access and system encryption at Canadian child welfare agency
Unauthorised access and system encryption occurred on the network of Canada’s Highland Shores Children’s Aid Society. The agency was providing IT services to The Children’s Foundation. The foundation announced that personal information belonging to people associated with it may have been affected.
Read on DataBreaches.net ↗
Also affected: 1- The Children’s FoundationThe Children’s Foundation warns of possible personal data exposure following outsourced IT breachPossible exposure of names, addresses, telephone numbers, email addresses and other personal information of people associated with the foundation