Hacking & intrusion incidents
Hacking & intrusion incidents, most recently reported first.
Modoo Jobs website defaced, replacing service information
Impact: Website homepage defaced
According to a report published on November 15, 2026, the website of professional talent matching service Modoo Jobs was defaced in a hacking incident. The reported damage was website defacement; the information provided in the article does not establish whether personal information was leaked or the scale of any leak.
Read on 데일리시큐 ↗Unauthorized access to file-sharing platform at facility under Malaysia’s Ministry of Health
Malaysia’s Ministry of Health detected unauthorized access to a secondary file storage and sharing platform at one of its facilities on November 12, 2026, and blocked external access. It said an initial investigation found that the main databases had not been encrypted, and that core operational systems and medical and patient care services were operating normally without disruption.
Read on The Star ↗Around 17,000 ticket QR codes stolen from Hong Kong Disneyland
Impact: Around 17,000 admission ticket QR codes stolen; online ticket sales and hotel bookings suspended
Around 17,000 admission ticket QR codes were stolen from Hong Kong Disneyland's computer systems. The resort suspended ticket sales and hotel bookings on its official website and reported the incident to police. Police are investigating the incident as a case of unauthorized computer access.
Related reports: 2 →Trezor confirms three tampered wallets in October report investigation, updates response
Impact: Malicious devices identified in three Safe 5 hardware wallets
Trezor said its investigation into a wallet-tampering report received on October 28 identified malicious hardware devices in three Safe 5 wallets sold by Cryptobilis. The devices collect information including recovery phrases displayed on the screen and transmit it to attackers over mobile networks. Trezor released firmware on November 11 to block the devices’ data collection and said no related losses of funds had been reported so far.
Read on BleepingComputer ↗Unauthorized access at Yamada Denki may affect 3.5 million customer records
3.5MImpact: Up to 3.5 million customer records potentially affected
Unauthorized access was confirmed in Japanese retailer Yamada Denki’s renovation management system, raising the possibility that up to 3.5 million customer records may have been affected. The information includes names, addresses, phone numbers, renovation histories, and estimate records. The company has blocked external access and is investigating whether data was actually leaked externally and what caused the incident.
Related reports: 6 · last report →UK Housing Ombudsman plans case management system recovery after October cyberattack
Impact: Disruption to the case management system, online complaint forms, landlord portal, and webchat. Whether personal information was compromised and the number of people affected remain unconfirmed.
The UK Housing Ombudsman confirmed unauthorized access to data in its case management system supplied by an external provider in October 2026 and took the system offline. In November, it said it would begin recovery work soon after implementing additional security measures. Whether personal information was compromised and the full extent of the damage remain under investigation.
Read on Inside Housing ↗Kyungil University confirms intrusion into staff electronic document system
Impact: Claimed theft of 108 GB of data and restrictions on external access to major information services
Kyungil University said an external intrusion into its staff-only electronic document system occurred at around 8 p.m. on November 12, 2026. The university restricted external access to major information services over concerns that the damage could spread. That same day, a post on an online hacking forum identified the system’s address and claimed that 108 GB of university data had been obtained. The actual volume of data exfiltrated and whether personal information was leaked have not been confirmed.
Read on 데일리시큐 ↗Sega announces follow-up measures after unauthorised access halts Lucky Kuji online sales
Impact: Suspension of sales of certain online lottery products
Sega Lucky Kuji Online and related services have been suspended since November 1, 2026, for safety checks following unauthorized access to Sega Fave's servers. This report concerns follow-up measures for certain lottery products whose sales were suspended, rather than a new incident.
Read on Yahoo!ニュース ↗Bessent claims Chinese AI was used in French supermarket refrigeration hack
Impact: Refrigeration equipment at approximately 700 supermarkets in France was affected, resulting in spoiled food being discarded.
On October 12, 2026, a cyberattack hit refrigeration control systems at approximately 700 supermarkets in France, causing food to spoil. Several retailers, including Intermarché, Carrefour, and E.Leclerc, were affected. On November 12, U.S. Treasury Secretary Scott Bessent claimed that a Chinese AI model had been used in the attack.
Read on Mezha.net ↗Barracuda cloud hack gives attacker access to credential storage system
Impact: Unauthorized access to a system storing customer integration credentials
Barracuda's internal cloud was hacked, allowing an attacker to access a system storing credentials that connect customer systems to security services. The company disclosed the incident on November 10 and individually notified potentially exposed customers. It found no direct evidence that customer integration credentials had actually been viewed or taken.
Read on 데일리시큐 ↗NK Economy backup site and CEO’s Facebook account compromised
Impact: Intrusion into the blog backup site, takeover of the CEO’s Facebook account, and shutdown of the linked page
On November 12, 2026, an intrusion exploiting a system vulnerability was detected and addressed on NK Economy’s Digital Hurricane blog backup site. The site contained no personal information. On November 13, the recovery email address for the CEO’s Facebook account was changed and the account was made private, while the linked NK Economy Facebook page was also shut down. The extent of the damage and whether access has been restored still require confirmation from Facebook.
Read on NK경제 ↗MUJI curtain subcontractor's server breached; 19,933 customer records potentially exposed
19.9KImpact: Potential exposure of 19,933 customer records, including duplicate records for the same customers. The affected data includes names, addresses, phone numbers, order information, and delivery addresses; actual disclosure has not been confirmed.
MUJI operator Ryohin Keikaku announced on November 2 that customer information may have leaked from a server managed by Nanotech, a subcontractor handling made-to-order curtains. During an investigation on October 28, Nanotech found evidence of unauthorized external access on October 19. The potentially affected data comprises 19,933 customer records from orders placed between April 10, 2018, and January 25, 2022, including names, addresses, phone numbers, order information, and delivery addresses; an investigation is ongoing to determine whether any data actually leaked.
Read on ScanNetSecurity ↗August intrusion at Shimane no Furusato Chokusobin may have exposed seven people’s card details
7Impact: Possible exposure of seven people’s credit card numbers, expiration dates, cardholder names, security codes, and payment methods (six of whom completed purchases)
On November 2, Shimane Prefecture announced that an intrusion exploiting a vulnerability in the Amazon Pay plugin had occurred at Shimane no Furusato Chokusobin on August 13, 2026. The attacker created an unauthorized administrator account and planted a file that read payment information entered by users, potentially exposing the card details of seven people who went through the payment process from August 13 to 15. The operator deleted the unauthorized account, disabled the plugin, restored files, and notified those affected on October 23. As of November 1, no fraudulent card use had been confirmed for the six people who completed purchases.
Read on ScanNetSecurity ↗Tokyu Land websites breached; 4,082 personal information records potentially leaked
4.1KImpact: A total of 4,082 personal information records from two websites may have been leaked: 4,079 membership records and three inquiry records. An actual leak has not been confirmed.
Tokyu Land Corporation detected unauthorized access in the shared AWS server environment hosting websites it manages on October 19, 2026, and disclosed it on October 30. The attack exploited a CMS software vulnerability and inadequate server access permission settings, potentially exposing 4,079 GREEN CROSS PARK membership records and three GREENUP Cooldown Project inquiry records. The company urgently took the affected sites offline and carried out security measures and an investigation, but no actual data leak has been confirmed.
Read on ScanNetSecurity ↗Kyoto Prefecture confirms no applicant data leaked in October email service breach
288Impact: An investigation confirmed that 288 personal information records for representatives of volunteer applicants for the Games had not leaked
Kyoto Prefecture and the city of Kyoto said that no information on World Masters Games volunteer applicants had leaked following unauthorized access to servers of the email distribution service blastmail in October. Names and email addresses in 288 application representative records were initially thought to have potentially leaked, but an investigation by an external specialist organization completed on November 11 confirmed that no leak had occurred.
Read on 京都新聞デジタル ↗Taiwan's United Recommend International detects abnormal e-commerce access, investigates member order API
Taiwanese e-commerce and apparel company United Recommend International discovered abnormal system access from an external IP address while investigating customer reports of suspected scam emails. Some requests targeted an API related to member orders, and an investigation is underway to determine whether personal information was actually accessed and the extent of the impact.
Read on iThome ↗Evergreen Logistics attack causes server disruptions
Impact: Server disruptions affecting some information systems
Taiwan's Evergreen Logistics detected server disruptions on November 12, 2026, and confirmed that hackers had attacked some of its information systems. The systems returned to normal following response and recovery efforts supported by external security experts, and the company provisionally assessed that there was no material impact on its finances or operations.
Read on iThome ↗PLAID suspends all KARTE services after unauthorized access
Impact: All functionality suspended across all customer projects; possible external leak of some information
Japan's PLAID detected unauthorized third-party access to its customer experience platform KARTE on November 13 and progressively suspended functionality across all customer projects. Web and app measurement, message delivery, and administrative interfaces were among the functions affected. The company identified information that may have been leaked externally and notified the affected corporate customers individually, and it is investigating the intrusion route and the scope of the damage.
Related reports: 9 · last report →NHN Dooray revokes API keys and suspends service after unauthorized access attempts
Impact: Customers’ integrations with external systems and automation functions disrupted
NHN Dooray detected attempts by an outside party to access accounts without authorization and abnormal calls using API keys in the early hours of November 13. The company revoked all service and administrator API keys and suspended API access, disrupting customers’ integrations with external systems and automation functions. Whether an intrusion succeeded, whether personal information was leaked, and the extent of the damage remain under investigation.
Related reports: 3 · last report →Tochigi suspends Gurutochi website after unauthorized access and tampering
Impact: Gurutochi website taken offline
Unauthorized access and tampering that redirected visitors to a fake website were confirmed on Tochigi Prefecture’s Gurutochi website. The website has been offline since November 11, and the prefecture urged users to exercise caution.
Related reports: 2 · last report →