Supply-chain breaches
When a contractor, partner or software vendor that handles personal data is breached, customer data from the organizations that use it can leak too. Here is how far each incident spread. (168)
MetaM customer service systems hacked, exposing phone numbers and conversations
Impact: Phone numbers and customer service conversations in some customer service systems
An external attack on some of MetaM’s customer service systems revealed indications that phone numbers and customer service conversations had been accessed without authorization or exfiltrated. MetaM became aware of the incident following a customer service outage at 6:03 a.m. on November 12, 2026. During its investigation, the company found that abnormal access to some services had occurred before it became aware of the incident, and it is investigating the extent of any further data exposure and the intrusion vector.
Related reports: 2 · last report →
Fireworks AI breached again, exposing customer data and model weights
Impact: Some customers’ account information, billing information, secrets, datasets, and unfinished model weights
Fireworks AI suffered renewed unauthorized access to its development systems on October 24 through a breach at an external cloud provider, 18 days after confirming the first breach. The investigation confirmed that customer account and billing information, along with some customers’ secrets, datasets, and unfinished model weights, were affected. The company revoked credentials, isolated systems, and notified all affected customers.
Related reports: 15 · last report →
Also affected: 1- NotionFireworks AI breach exposes Notion AI chat historiesAI chat histories exposed in fewer than 1% of all workspaces
Hacking of supermarket refrigeration systems in Europe causes food losses and fires
Impact: Damage to refrigeration and freezing systems in nine European countries, with food losses and some fires at hundreds of supermarkets in France
In October 2026, cyberattacks targeting refrigeration and freezing systems at hundreds of supermarkets in France raised temperatures, causing food losses and fires. Similar incidents subsequently occurred in several other European countries, bringing the number of affected countries to nine. In November, French authorities identified Shahid Kaveh, a cyber unit of Iran's Islamic Revolutionary Guard Corps, as responsible for the attacks.
Related reports: 508 · last report →
Also affected: 3- DelhaizeSuspected cyberattacks hit refrigeration systems at dozens of Belgian Delhaize storesRefrigeration and freezer systems affected at 40 Belgian stores
- 랭리지 오가닉British businesses caught in Europe-wide supermarket fridge attacks
- French Blood EstablishmentCooling systems hacked at three French Blood Establishment facilitiesTemperature control settings altered at three facilities; no blood products damaged
Bookeasy breach may expose Australian national park booking customers' data
Impact: Potential exposure of names, addresses, contact details and booking information of customers across several Australian states and territories
Unauthorized access to Australian booking platform Bookeasy was confirmed to have potentially allowed the names, addresses, contact details and booking information of its partners' customers to be viewed or exposed. National park booking customers across several states and territories were affected, and WhatsApp scam messages using actual booking information to demand additional payments were also reported. Parks Victoria temporarily suspended new campsite bookings, and no evidence of access to credit card information was found.
Related reports: 7 · last report →
Also affected: 3- Parks VictoriaBookeasy breach raises concerns for Parks Victoria booking customersSuspicious WhatsApp messages sent to booking customers and suspension of new campsite bookings
- Queensland Parks and Wildlife ServiceQueensland Parks and Wildlife Service booking users’ data stolenPersonal information of national park booking users, including email addresses, addresses and phone numbers
- Australian Capital TerritoryAustralian Capital Territory warns about 6,000 people after booking service breachAbout 6,000 people notified of possible exposure of personal information and booking details
Taiwan's 91APP order database breach may expose data of 4.8 million consumers
4.8MImpact: Potential exposure of information on 4,798,255 consumers across up to 1,329 brands
A breach of Taiwanese e-commerce platform 91APP's order database raised concerns that 4,798,255 consumers across up to 1,329 brands could be affected. Names, phone numbers, shipping addresses, email addresses, and order histories were potentially exposed, but the actual extent of unauthorized access or theft has not been confirmed. 91APP allowed consumers to apply for compensation even without financial losses and moved the application channel from Google Forms to its official website. Taiwan's Ministry of Digital Affairs suggested a link to the AI hacking tool ARTEX.
Related reports: 27 · last report →
Also affected: 2- MUJI Taiwan91APP breach may have leaked order data of about 180,000 MUJI Taiwan membersPossible leak of online order data of about 180,000 members
- COSMEDCOSMED affected by 91APP hack
Malware on Quantum Systems servers prompts German military to halt drone operations
Impact: Temporary suspension of the German armed forces’ operations of the manufacturer’s drones
German drone manufacturer Quantum Systems detected a cyberattack on its internal servers in late October 2026. Update files containing malware had been planted on the servers, reportedly in an attempt to affect drone operations through updates. The company launched a joint investigation with the authorities, and the German armed forces temporarily suspended operations of the manufacturer’s drones as a precaution.
Related reports: 12 · last report →
Also affected: 1- German Armed ForcesMalicious drone update temporarily grounds German military dronesTemporary suspension of Quantum Systems drone operations
Amicus Lex hack exposes personal data of 20,028 users
20KImpact: Personal information of 20,028 LawForm users
A hack at Amicus Lex at 5:38 a.m. on November 11 exposed the names, phone numbers, and email addresses of 20,028 LawForm users. A SQL injection attack targeting the administrator page and a vulnerable API were identified, and the vulnerable API code was deleted. The Ministry of SMEs and Startups disclosed the incident approximately 60 hours after becoming aware of it.
Read on 헤럴드경제 ↗
Also affected: 1- Ministry of SMEs and StartupsHack exposes data of 818 participants in ministry's Entrepreneurship for All programPersonal information of 818 Entrepreneurship for All participants
GMO Internet cloud breach leaks customer data and causes trading losses
Impact: Up to 26,739 servers affected; loss compensation claims totaling 2.99 billion yen for 2,943 accounts
GMO Internet's Onamae.com Desktop Cloud suffered a malware attack that affected up to 26,739 servers, resulting in customer data leaks and asset losses from unauthorized trades. The company advised customers to shut down their PCs and offered a bounty to track down the attackers, while acknowledging that it had not adequately responded to earlier warnings about security vulnerabilities. By November 12, claims for loss compensation totaling 2.99 billion yen had been submitted for 2,943 accounts, while the final loss amount remained undetermined.
Related reports: 70 · last report →
Also affected: 1- Sompo Japan InsuranceSompo Japan contractor breach may have exposed 65,000 policyholder recordsPossible exposure of approximately 65,000 policyholder records
Intrusion into Japanese security firm's development environment raises customer data concerns
Impact: Possible exposure of some customers' company names, names, email addresses, and service communications information
A Japanese security services provider detected suspected third-party access to its development administration environment after an employee's GitHub credentials were compromised. It is investigating whether some customers' company names, names, email addresses, and service communications information may have been viewed or obtained. The company said it would respond across the organization to prevent recurrence and restore trust.
Related reports: 14 · last report →
Also affected: 4- City of KurashikiTicket vendor breach raises concerns over Kurashiki buyers’ data
- Shinagawa CityShinagawa child care program exposes 195 email addresses in subcontractor breach195 email addresses leaked
- Toyo UniversityToyo University confirms alumni and parents’ email addresses leaked in external email service breach
- Kyoto City KYOCERA Museum of ArtKyoto City KYOCERA Museum of Art emails potentially exposed in ARTPASS contractor breach
Unauthorized access at Yamagata Prefecture newsletter contractor
Unauthorized access occurred at the company responsible for operating Yamagata Prefecture's email newsletter. The prefecture announced its investigation results on November 12, with no information leaks confirmed from services it operates.
Related reports: 10 · last report →
Unauthorized access to ReserVision bookings leads to customer phishing
Impact: Personal information and booking details of restaurant and hotel guests
Unauthorized access through customer accounts on reservation service ReserVision exposed the personal information and booking details of restaurant and hotel guests. The stolen information was used in phishing emails requesting payments or card details, and some businesses' actual email sending accounts were also misused.
Read on Tageskarte ↗
Also affected: 2- BorchardtBorchardt warns of payment scams after external booking system hack
- Bremer Union BrauereiBremer Union Brauerei customer data potentially exposedPotential exposure of customer names, contact details, reservation information, and some allergy information
Fireworks AI breach exposes client information
In October 2026, Fireworks AI, an AI service provider for Uber, was breached, leading to a leak of client information. The attacker stole the service provider’s internal credentials and used them to access Uber’s account with the provider. Uber is notifying US drivers that their personal information and driver’s license information were exposed.
Related reports: 4 · last report →
Also affected: 1- UberFireworks AI breach exposes license data of thousands of US Uber driversPersonal information and driver's license data of thousands of US drivers, including 3,430 South Carolina residents
OPENLOGI breach exposes seven months of shipping data
Impact: Some shipment data covering approximately seven months leaked; the total number of records remains under investigation.
Japanese logistics company OPENLOGI suffered unauthorized access on November 8–9, and some shipping data received from April 8 through November 8 was exfiltrated. The data included recipients’ names, addresses, phone numbers, email addresses, and product information. By November 12, 13 client companies and services had announced impacts, while the full extent of the breach remained under investigation.
Related reports: 12 · last report →
Also affected: 2- Carry OnKimagure Cook's agency Carry On warns of possible buyer data leak after logistics provider hack
- REALITY StudiosOPENLOGI breach may have exposed REALITY Studios customer dataPossible exposure of recipient, shipping, contact and product information for official online store customers; affected customers and number of records under investigation
Dentsu Digital TONARIWA breach leaks personal data from two client companies
Impact: Personal data from two client companies leaked; number of affected records under investigation
Unauthorized access and privilege escalation using leaked administrator account credentials were confirmed on Dentsu Digital's marketing platform TONARIWA. A follow-up announcement on November 12 confirmed logs showing that personal data from two client companies had been exfiltrated, with names, dates of birth, contact details, and LINE integration access tokens among the information identified as leaked. All servers were shut down and isolated, and the number of affected records is under investigation.
Related reports: 10 · last report →
Also affected: 1- Japan PostDentsu Digital breach shuts down Japan Post’s LINE serviceSuspension of the official LINE service and possible leak of user information
Taiwan netiCRM provider’s management server breached, client data stolen
Impact: Theft of nonprofit clients’ contact details, contract and billing documents, and customer support records
An internal management server at Taiwan’s netiCRM provider was compromised, and nonprofit clients’ contact details, contract and billing documents, and customer support records were stolen. More than 30 nonprofit organizations warned donors about scams. The provider included servers belonging to around 500 clients in the scope of its inspections and rebuilding efforts, and as of November 12, no evidence of donor information theft had been found.
Related reports: 7 · last report →
Also affected: 1- Citizen Congress WatchCitizen Congress Watch warns of possible donor data breachPossible exposure of donor names, phone numbers, donation records, and other information
Asahi ransomware attack disrupts Japanese production, raises data leak concerns
2.3MImpact: Potential exposure of 2.28 million personal information records and disruptions to production and shipments in Japan
Asahi Group suffered a cyberattack in September 2025 that disrupted production and shipments in Japan, and later confirmed it was a ransomware attack. The ransomware group Qilin claimed responsibility, while the company continued operations using manual processes. By July 2026, the number of personal information records potentially exposed had risen to 2.28 million.
Related reports: 48 · last report →
Also affected: 1- Seven-Eleven JapanAsahi cyberattack leaves Seven-Eleven Japan short of beerShortage of Super Dry beer
Arara email service hack exposes 81.33 million email addresses
81.3MImpact: 81,329,467 email addresses and some customers' member information
Japan's Arara Message email delivery service was breached through a web server vulnerability, exposing email addresses and some customers' member information. Further investigation put the number of unique email addresses exposed at 81,329,467. The attacker also abused the service to send up to approximately 7.13 million emails impersonating credit card companies, and the company isolated the servers and completely suspended its email delivery service.
Related reports: 20 · last report →
Also affected: 25- AsoviewAsoview breach at service provider exposes 15,821,184 member records15,821,184 member records
- Solaseed AirAbout 490,000 Solaseed Air customer email addresses leakedAbout 490,000 customer email addresses
- TKCArara email service breach exposes up to 2.23 million TKC user email addressesUp to 2,230,812 user email addresses
- City of FukushimaUnauthorized access to Arara may have exposed up to 4,700 Fukushima personal data recordsPotential leak of up to 4,700 personal data records
- Sumitomo Mitsui Banking CorporationAbout 227,000 customer email addresses leaked at Sumitomo Mitsui Banking CorporationAbout 227,000 customer email addresses
- Sakai CityUp to around 290,000 email addresses potentially leaked from Sakai City's online application systemPotential leak of up to around 290,000 email addresses
- ShogakukanArara hack raises fears of nearly 2 million Shogakukan member records leakingPossible leak of 1,993,665 member records
- Yokohama RubberYokohama Rubber subscriber data leaked in Arara incidentCompany names and email addresses of news release and email newsletter subscribers exposed; the official announcement did not disclose the number of records
- City of YaitaUnauthorized access to Arara raises email leak concerns in Yaita
- TV Shin-HiroshimaUnauthorized access to Arara exposes 5,192 TV Shin-Hiroshima users’ email addressesEmail addresses belonging to 5,192 people
- City of HonjoHonjo warns of possible card appointment data leak after subcontractor breachPossible personal information leak
- City of Yokohama508 email addresses leaked from Yokohama facility booking system508 email addresses exposed: 443 belonging to user organizations and 65 belonging to facilities
- L’Arc-en-Ciel Fan ClubL’Arc-en-Ciel fan club email addresses leaked in Arara breach
- Cabinet Office of JapanAbout 62,000 email addresses of Japan Cabinet Office newsletter users leakedAbout 62,000 email addresses of newsletter users
- Mitsubishi UFJUnauthorized access to Arara exposes some Mitsubishi UFJ shareholders’ email addressesEmail addresses of some shareholders
- Bank of YokohamaBank of Yokohama loan customer data leak affects up to 60,505 recordsUp to 60,505 records belonging to some card loan and unsecured personal loan customers affected by the leak. The count may change following detailed investigation.
- Kewpie Group125,788 customer email addresses exposed at five Kewpie Group companies125,788 customer email addresses
- City of NahaNaha confirms 15,700 email addresses leaked in external email service hack15,700 user email addresses
- Tokyo GasUnauthorized access to Arara exposes 85,565 Tokyo Gas customer email addresses85,565 customer email addresses
- Akita Northern HappinetsAkita Northern Happinets fan club data leak affects 41 membersPersonal information of 41 fan club members
- City of OsakaArara breach leaks over 1.07 million Osaka administrative service email addresses1,078,713 email addresses belonging to users of the online administrative system, plus email addresses of users and participating merchants in a separate gift certificate program
- Sanfrecce Hiroshima2,900 Sanfrecce Hiroshima customer email addresses leaked2,900 customer email addresses
- Sasebo e CoinOver 35,600 registered Sasebo e Coin email addresses leakedMore than 35,600 registered email addresses leaked
- City of KobeAbout 85,700 email addresses leaked from Kobe's electronic application systemApproximately 85,700 email addresses
- Hokkaido Electric PowerHokkaido Electric Power reports 5,664 email addresses leaked in October Arara hack5,664 email addresses
SMBC Consumer Finance data breach affects up to 320,118 customers
320.1KImpact: Personal information of up to 320,118 customers
A third party breached Japan's SMBC Consumer Finance loan guarantee operations system and transmitted data containing the personal information of up to 320,118 people outside the company. The compromised information included names, addresses, dates of birth, phone numbers, email addresses, driver's license numbers, workplaces, annual incomes, and guarantee contract details. The company detected the intrusion on November 2, blocked access, and temporarily shut down the system, while some partner financial institutions also suspended loan applications.
Related reports: 21 · last report →
Also affected: 2- San-in Godo BankData of 1,585 San-in Godo Bank personal loan customers leakedCustomer information of 1,585 personal loan borrowers
- Hiroshima Bank747 Hiroshima Bank card loan customer records leaked747 card loan customer records
AllUnited hack exposes Dutch sports club members' data
Impact: More than 350 sports clubs reported the breach; members' personal information and bank account details were exposed
An attacker exploited a software flaw in AllUnited, a Dutch sports club membership management platform, to copy its membership database. The exposed information included names, addresses, dates of birth, passwords, and bank account details. The company initiated a reset of all passwords, and more than 350 sports clubs reported the breach to the data protection regulator.
Related reports: 6 · last report →
Also affected: 1- De Zoutkeet Draughts ClubAllUnited hack exposes De Zoutkeet club members’ dataClub members’ information exposed
Unauthorized network access and system encryption at Canadian child welfare agency
Unauthorized access and system encryption occurred on the network of Canada’s Highland Shores Children’s Aid Society. The agency was providing IT services to The Children’s Foundation. The foundation announced that personal information belonging to people associated with it may have been affected.
Read on DataBreaches.net ↗
Also affected: 1- The Children’s FoundationThe Children’s Foundation warns of possible personal data exposure after outsourced IT breachPossible exposure of names, addresses, phone numbers, email addresses and other personal information of people associated with the foundation