Week 45, 2026 security incident report

DOUZONE BIZON server breach raises wider concerns over client data exposure

Impact: As of 5 November, 28 companies and institutions had issued notices of possible personal data leaks; the actual scale of any leak remains unconfirmed

Two security breaches were confirmed at DOUZONE BIZON, raising the possibility that personal data belonging to client companies and third parties whose data those clients held may have been leaked. Historical records of companies whose services had ended may also have been affected, and as of 5 November, 28 companies and institutions had issued notices of possible data leaks. DOUZONE BIZON voluntarily reported the incidents to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission (PIPC) and disclosed progress on security investments totalling 16 billion won. The government deemed the incidents serious and launched a joint public-private investigation, while whether data was actually leaked and the extent of any leak remain under investigation.

Amadeus reservation system breach exposes passenger data at multiple airlines

Impact: Passenger booking data exposed at multiple airlines

Unauthorised access to the reservation system of Spanish travel technology company Amadeus exposed passenger booking data at multiple airlines. Alongside names and itinerary details, some passport numbers and contact details were exposed, with Japan Airlines, ANA and Cathay Pacific among the affected airlines. Further reports followed from Korean Air, Asiana Airlines and others, while Thailand's aviation authorities confirmed that Thai Airways and Bangkok Airways were affected among seven major airlines.

Frontline Education hack exposes data on more than 3.08 million people

3.1mImpact: Personal information of 3,085,266 students and staff members

Unauthorised access exploiting a vulnerability in third-party software occurred at Frontline Education on 14–15 August, resulting in the theft of information on students and staff in US school districts. Affected data from Frontline Central and school health management services included names, Social Security numbers, dates of birth, government-issued identification numbers, Medicaid and student identification numbers, and school health and billing records. Individual notifications have begun, and at least six class action lawsuits are under way. A filing in Indiana confirmed that 3,085,266 people were affected.

Outsourced SaaS breach sparks concern over NTT DATA bond buyer information

2.7kImpact: Possible leak of personal information involving 2,678 Kintetsu-related records and 1,169 SBI Securities customers, among others; total scale undisclosed

Unauthorised access occurred in a supplier's SaaS used by STdirectServices, NTT DATA's service supporting benefits for corporate bond buyers. Personal information, including investor names and purchase amounts, may have been leaked, with Kintetsu disclosing potential impacts involving 2,678 records and SBI Securities reporting 1,169 potentially affected customers. NTT DATA disclosed the incident on 31 October, suspended the service and began an investigation.

Hacking of supermarket refrigeration systems in Europe causes food losses and fires

Impact: Damage to refrigeration and freezing systems in nine European countries, with food losses and some fires at hundreds of supermarkets in France

In October 2026, cyber-attacks targeting refrigeration and freezing systems at hundreds of supermarkets in France raised temperatures, causing food losses and fires. Similar incidents subsequently occurred in several other European countries, bringing the number of affected countries to nine. In November, French authorities identified Shahid Kaveh, a cyber unit of Iran's Islamic Revolutionary Guard Corps, as responsible for the attacks.

CBcloud’s PickGo breach raises concerns over customer and delivery driver data

Impact: Possible exposure of information about users at client companies, shippers and delivery drivers

Unauthorised access to CBcloud’s delivery platform PickGo was confirmed to have potentially exposed information about users at client companies and delivery drivers. Information relating to shippers was also disclosed as potentially exposed, while the investigation into the extent of additional impacts on client companies and delivery drivers continues.

Unauthorised access at Yamagata Prefecture newsletter contractor

Unauthorised access occurred at the company responsible for running Yamagata Prefecture's email newsletter. The prefecture published its investigation findings on 12 November, with no information leaks confirmed from services it operates.

Arara email service cyber-attack exposes 81.33 million email addresses

81.3mImpact: 81,329,467 email addresses and some customers' member information

Japan's Arara Message email delivery service was breached through a web server vulnerability, exposing email addresses and some customers' member information. Further investigation put the number of unique email addresses exposed at 81,329,467. The attacker also misused the service to send up to approximately 7.13 million emails impersonating credit card companies, and the company isolated the servers and suspended its email delivery service entirely.

Securitize Japan breach exposes digital securities customers’ data

9.1kImpact: Customer information leaked, including data on 621 Sony Bank customers and up to 9,086 Marui Group applicants

Customer information for digital securities from several client companies was exfiltrated from Securitize Japan after administrative privileges were obtained by exploiting a vulnerability in its authentication functionality. Those affected included 621 Sony Bank customers and up to 9,086 Marui Group applicants, with the exposed data including names, addresses, contact details, dates of birth, investment information and some account information. Client companies including NTT DATA, Sony Bank and Marui Group disclosed the leaks.

ETS Data Breach Exposes Current and Former California Students’ Records

Impact: Records of current and former students in California

A data breach at Educational Testing Service (ETS) exposed records belonging to current and former students in California. The sensitive records exposed included material dating back to 2023. A lawsuit was brought against ETS over the incident.

Sega Fave server breach disrupts online arcade services in Japan

Impact: Suspension of ALL.Net- and Aime-based services at Japanese arcades, including online play and card authentication

Unauthorised access by an outside party to Sega Fave's ALL.Net and Aime servers led to the suspension of related services from 1 November. Online play, card authentication and access to game progress data at Japanese arcades were disrupted, while the initial investigation found no evidence of customer or business partner information being leaked. Eligible Bandai Namco games resumed operations on a trial basis on 8 November, but as of 10 November, no date had been set for restoring online services for Sega games.

CYBERBIZ database breach raises fears of client order data leaks

Impact: Four client companies disclosed possible compromise of order data and personal information

Unauthorised access to part of the database of Taiwanese e-commerce service provider CYBERBIZ prompted four client companies to disclose that order data and personal information may have been compromised. Acer Gadget and Acerpure suspended their online shops. Some clients have been informed of the extent of the impact, but Taiyen and Far East Bio-Tec are still verifying the precise scope of the damage, while the overall extent also remains under investigation.

GMO Internet cloud breach leaks customer data and causes trading losses

Impact: Up to 26,739 servers affected; loss compensation claims totalling 2.99 billion yen for 2,943 accounts

GMO Internet's Onamae.com Desktop Cloud suffered a malware attack that affected up to 26,739 servers, resulting in customer data leaks and asset losses from unauthorised trades. The company advised customers to shut down their PCs and offered a bounty to track down the attackers, while acknowledging that it had not adequately responded to earlier warnings about security vulnerabilities. By 12 November, claims for loss compensation totalling 2.99 billion yen had been submitted for 2,943 accounts, while the final loss amount remained undetermined.

Taiwan's 91APP order database breach may expose data of 4.8 million consumers

4.8mImpact: Potential exposure of information on 4,798,255 consumers across up to 1,329 brands

A breach of Taiwanese e-commerce platform 91APP's order database raised concerns that 4,798,255 consumers across up to 1,329 brands could be affected. Names, telephone numbers, delivery addresses, email addresses and order histories were potentially exposed, but the actual extent of unauthorised access or theft has not been confirmed. 91APP allowed consumers to apply for compensation even without financial losses and moved the application channel from Google Forms to its official website. Taiwan's Ministry of Digital Affairs suggested a link to the AI hacking tool ARTEX.

Possible exposure of 3,059 patients’ data at Washington eye care network

3.1kImpact: Possible exposure of personal and medical information of approximately 3,059 people

Unauthorised access to files was confirmed at an eye care network in Washington state, affecting approximately 3,059 people. Names, addresses, dates of birth, and medical information such as diagnoses, test results, and medications may have been exposed. Potential litigation related to the data breach was subsequently reviewed.

Web3Auth security flaw compromises Keplr wallet private keys

Impact: Private keys compromised and assets stolen from some Keplr wallets; actual amount stolen undisclosed

A security flaw in Web3Auth's infrastructure compromised the private keys of some Keplr wallets created using Google or Apple accounts, resulting in unauthorised transactions. Web3Auth suspended its service and moved approximately $5.6 million to a recovery wallet to prevent further theft. The amount actually stolen by the attacker was not disclosed.

SM Entertainment business systems hacked, exposing employee data

Impact: Personal information of executives and employees and internal documents, including contracts, leaked; scale under investigation

SM Entertainment confirmed on 4 November that an external attacker had gained unauthorised access to its business systems and exfiltrated documents. The exposed information included executives' and employees' resident registration numbers, bank account numbers, mobile phone numbers, addresses and contract information. The company apologised and is investigating the exact scale of the damage.