Inspect your service with evidence from incidents

Compare causes, available controls, and AI involvement in incidents documented by primary sources. Use the findings to inspect your own service.

Records: 150
Rules: 16

Reviewed 2026-10-19

A year of causes, controls, and AI involvement

2025-10-19 — 2026-10-19 · 134 records

Compare control evidence, such as unapplied patches, separately from AI use. This database alone cannot establish trends in AI attacks.

Evidence on available controls

Patch information available: 4 records
Exploitation before disclosure reported: 4 records
Operational controls to inspect: 53 records
Insufficient evidence: 73 records

Patch publication and an unapplied patch at entry are different findings. Unapplied fixes are explicitly reported in 2 records: デジタル庁 / VOISING.

Context of AI involvement

Use observed in attacks: 2 records
Activity during evaluations: 3 records
Use assessed, not confirmed: 1 records
Use unknown: 128 records

Evaluations also caused external impact. Confirmed AI use does not establish that an incident was unavoidable; unknown use does not mean no AI use.

Counts describe selected public records, not population statistics. Control groupings and inspection suggestions are editorial assessments.

How to read these counts

The selected records include evaluations and multi-organization campaigns, so the counts are not organization totals. Control groupings do not establish that the incidents were preventable. Sources reviewed: 2026-10-19

Compare causes and controls across 134 records

Libraries and supplied products are distinct. An implementation category does not establish that the affected organization wrote the vulnerable code. Unresolved component types stay unresolved.

Cause to compareComponent to compareAI context to compare

134 / 134 records · cause categories can overlap

Comparison of reported incident causes, controls, and AI involvement
Record / component	Entry / reported weaknesses	Control evidence / inspection	AI involvement
Record / componentMedley at-link: unauthorized access to a medical booking platform Disclosed: 2026-10-14 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The intrusion start, mechanism and patient count are undisclosed. The notice does not confirm leakage at all 787 institutions. [s1] メドレー: 当社サービス「アットリンク」への不正アクセス及びサービスの一時停止に関するお知らせ ↗ §1 / §2 [s2] 四条烏丸レディースクリニック: 【重要】当院予約システム「アットリンク」のサービス一時停止について ↗ 本文	Entry / reported weaknesses Reported fact An external specialist reported possible access on October 11; investigation confirmed unauthorized access. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) The entry mechanism is undisclosed; avoidability cannot be assessed. Inspect exposure, privileges, logs and retained data using the linked rules. SEC-006 SEC-008 SEC-009 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentSpeeCAN RAIDEN: unauthorized access affecting disaster and emergency messaging Disclosed: 2026-10-13 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The entry mechanism, CVE, deduplicated person count and confirmed leakage scope are undisclosed. Related service/customer announcements are not counted as separate incidents. [s1] アルカディア: SpeeCAN RAIDENへの不正アクセスに伴う一連の対応について（第11報まで） ↗ 10月13日状況のご報告・経緯 / 10月13日状況のご報告・最大件数 / 10月16日18時10分第11報 [s2] アルカディア: SpeeCAN RAIDENへの不正アクセスに伴う一連の対応について ↗	Entry / reported weaknesses Reported fact Suspicious activity was detected on October 11; emergency path blocking followed on October 12. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) The entry mechanism is undisclosed; avoidability cannot be assessed. Inspect exposure, privileges, logs and retained data using the linked rules. SEC-006 SEC-008 SEC-009 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentAnthropic: unintended real-server command execution during evaluations Disclosed: 2026-10-09 Occurred: Date unresolved Execution environment / network boundary Evidence and unknowns Confirmed model actions in evaluations/internal use; separate from observed criminal attacks. Victims and dates are undisclosed; this report-level record does not yield incident totals or criminal AI-use rates. [s1] Anthropic: Investigating unintended model actions in our evaluations and internal use ↗ Exploiting a basic flaw in software to run commands on a server / 冒頭 / Overview of behaviors	Entry / reported weaknesses Reported fact A model retrieved script code and exploited its flaw to run a server-side calculation. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect agent permissions, destinations and server input handling; product, CVE and prior patch availability are undisclosed. SEC-006 SEC-009 SEC-010 SEC-011	AI involvementReported fact Activity during evaluations Confirmed model actions in evaluations/internal use; separate from observed criminal attacks.
Record / componentskyticket bus: automated access to reservation pages without login Disclosed: 2026-10-09 Occurred: 2026-08-03 Service design / controls Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Deduplicated counts of travelers are undisclosed. Specific code and pre-fix assessment coverage are not established. [s1] アドベンチャー: 不正アクセスによるお客様情報の流出に関するお詫びとお知らせ ↗ §1(3)	Entry / reported weaknesses Reported fact Reservation completion pages were accessible without login and mechanically viewed by a third party; this was more than an unexploited exposure. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect authentication, per-user authorization and logs of automated access to booking pages. The notice does not disclose implementation code. SEC-006 SEC-009 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentskyticket: vulnerability exploitation in a business-management system Disclosed: 2026-10-09 Occurred: 2026-09-20 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Product, CVE, pre-intrusion patch availability and confirmed exfiltration scope are undisclosed; patch neglect is not established. [s1] アドベンチャー: 不正アクセスによるお客様情報の流出に関するお詫びとお知らせ ↗ §1(2)	Entry / reported weaknesses Reported fact A business-system vulnerability was exploited on September 20 and detected on September 28. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) The entry mechanism is undisclosed; avoidability cannot be assessed. Inspect exposure, privileges, logs and retained data using the linked rules. SEC-001 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentCommune: member data leaked through invitation and administrator impersonation Disclosed: 2026-10-08 Occurred: 2026-10-05 Service design / controls Evidence and unknowns The reviewed primary sources do not establish attacker use of AI. CVE, invitation acquisition and impersonation details remain undisclosed; the estimated member count can change. [s1] コミューン: 「Commune」「Commune for Work」への不正アクセスによる個人情報漏えいのお知らせ ↗ §3 原因 / §2 影響範囲および漏えいした情報 / §1 経緯 [s2] コミューン: 青森県観光ファンコミュニティにおける個人情報漏えいの可能性について ↗	Entry / reported weaknesses Reported fact The provider reported unauthorized invitation use and administrator impersonation for reading, extraction and changes. [s1] Reported weaknesses Reported fact On October 7 a remaining maintenance route allowed unauthorized registration and viewing; it was blocked at 14:58 JST. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect authorization and containment during maintenance; the exact implementation and prior checks remain undisclosed. SEC-005 SEC-008 SEC-009 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componenthi-ho: unauthorized customer login using information obtained through solicitation Disclosed: 2026-10-08 Occurred: Date unresolved Credential storage / publication Evidence and unknowns The reviewed primary sources do not establish attacker use of AI. Event and detection dates, other acquisition paths and full viewing scope are undisclosed; arrest-report counts are separate. [s1] ハイホー: お客様情報への第三者によるアクセスが確認された事案に関するご報告 ↗ §2 発生した事象 / §4 不正ログインの件数 / §7 システムへの侵入および二次被害の状況	Entry / reported weaknesses Reported fact Third parties obtained login information through calls and impersonated customers; other acquisition paths may exist. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect authentication based on obtainable personal details, MFA and access logs; prior MFA coverage is undisclosed. SEC-002 SEC-005 SEC-009 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentskyticket: server intrusion and retained payment-log exposure Disclosed: 2026-10-08 Occurred: 2026-10-02 Service design / controls Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The specific entry cause and retention of other historical card data remain under investigation. Do not combine with the separate business-system or bus cases. [s1] アドベンチャー: 不正アクセスによるお客様情報の流出に関するお詫びとお知らせ ↗ §1(1) [s2] アドベンチャー: 不正アクセスによるお客様情報の流出に関するお詫びとお知らせ（第2報） ↗ 冒頭 / §1 / §1–2 [s3] アドベンチャー: 【重要】当社よりお送りした「個人情報の流出に関するお知らせ」メールについて ↗	Entry / reported weaknesses Reported fact Management functions were abused on October 2–4 to access other servers and cloud data. [s1] Reported weaknesses Reported fact Retained payment logs and encryption information were obtained on October 3. Benefit-service IDs, names and passwords also leaked. [s2]	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) The entry mechanism is undisclosed; avoidability cannot be assessed. Inspect exposure, privileges, logs and retained data using the linked rules. SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentHIS Thailand: file-server intrusion disclosed in 2026 Disclosed: 2026-10-07 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The intrusion start, completed exfiltration scope, and technical cause are undisclosed. [s1] エイチ・アイ・エス: 子会社ファイルサーバへの不正アクセスによる個人情報流出の可能性に関するお知らせ ↗ p.1 §1 / p.1 §2	Entry / reported weaknesses Reported fact Suspicious file-server access was confirmed; the entry mechanism is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Inspect data purpose, retention deadlines, file inventories, permissions, and access logs. SEC-006 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentIDCF Cloud: ransomware outage and data-recovery impact Disclosed: 2026-10-07 Occurred: 2026-10-07 Component type unresolved Evidence and unknowns The reviewed primary sources do not establish attacker use of AI. 495 counts organizations, not leaked people. Extraction scope, CVE and recovery completion remain unresolved; other-console suspension was precautionary. [s1] IDCフロンティア: 当社サービスの一部システムに対する不正アクセスについて ↗ [s2] IDCフロンティア: 【第2報】当社サービスの一部システムに対する不正アクセスについて ↗ 第2報 ■原因 / 第3報 ■原因 [s3] IDCフロンティア: 【第3報】当社サービスの一部システムへの不正アクセスによる障害について ↗ 第2報 ■原因 / 第3報 ■原因 / ■対象 / ■発生事象 / ■影響範囲 / ■現在の調査状況 [s4] IDCフロンティア: 【第4報】不正アクセスによる障害への対応体制について ↗	Entry / reported weaknesses Reported fact The provider confirmed ransomware by a third party; the entry path remains under investigation. [s2][s3] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Entry and prior privilege controls are unknown; inspect lateral-access limits and recovery evidence for backups independent of affected infrastructure. SEC-006 SEC-008 SEC-009 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentPharma DIGITAL: unauthorized access to an outsourced member database Disclosed: 2026-10-06 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Entry details and confirmed exfiltration scope are undisclosed. Do not add 44,000 to 514,000. [s1] 旭化成セラピューティクス: Pharma DIGITALへの不正アクセスおよび個人情報漏えいの可能性について ↗ 1. 概要 / 2. 漏えいした可能性がある情報	Entry / reported weaknesses Reported fact The operator confirmed member-database access and reported it on October 2. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Inspect vendor permissions, access logs, and member-data scope and retention. SEC-006 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentMrMax: software-function abuse leads to member-data leakage Disclosed: 2026-10-06 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Product, CVE, and patch timing are undisclosed; patch neglect and implementation defects are unestablished. [s1] ミスターマックス: 不正アクセスによる情報流出に関するお詫びとお知らせ ↗ 1. 経緯 / 2. 情報流出の可能性がある対象のお客様および情報	Entry / reported weaknesses Reported fact The intruder abused functions of software composing the service. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Compare deployed software with advisories and inspect exposure, permissions, and access logs. SEC-001 SEC-006 SEC-008 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentnimoca: unauthorized access to the public usage-history service Disclosed: 2026-10-06 Occurred: 2026-10-04 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The specific mechanism is undisclosed; SQL injection and authorization defects are unestablished. [s1] ニモカ: nimoca利用履歴照会サービスへの不正アクセスによる情報漏えい ↗ p.1 §2 / p.1 §3 / p.2 §4	Entry / reported weaknesses Reported fact Unauthorized public-service access was confirmed. The service, not the attacker, sent the emails. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Inspect lookup authorization, input-driven recipients, retrieval limits, and logs. SEC-009 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentRakuten Drive: stolen administrator credentials used to access stored data Disclosed: 2026-10-06 Occurred: 2026-01-29 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Credential acquisition and MFA status are undisclosed. Unknown overlap prevents adding the three counts. [s1] 楽天ドライブ: 「楽天ドライブ」における不正アクセスの発生について ↗ 概要 / 事象①〜③	Entry / reported weaknesses Reported fact Credentials for an administrator account on part of the system were illicitly acquired. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect administrator-authentication exceptions, credential revocation, data-access scope, and logs. SEC-002 SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component大起水産: unauthorized access and impact Disclosed: 2026-10-05 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Confirmed exfiltration scope and the technical cause are undisclosed. [s1] 大起水産: 大起水産：事故に関する公表資料 ↗ p.1 §1 / p.2 §2	Entry / reported weaknesses Reported fact Unauthorized app-system access was detected on September 15; the specific mechanism is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-006 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentDenmark CPR: unauthorized retrieval through legitimate company access Disclosed: 2026-10-05 Occurred: Date unresolved Service design / controls Evidence and unknowns The reviewed primary sources do not establish attacker use of AI. Credential theft or software exploitation is not established; occurrence timing and final scope remain under investigation. [s1] デンマーク研究・教育・デジタル化省: Omfattende uautoriseret adgang til borgeres CPR-oplysninger ↗ 事故概要 / Fakta [s2] CPR管理者: Omfattende uautoriseret adgang til borgeres CPR-oplysninger ↗ 事故概要 / Fakta [s3] Datatilsynet: Datatilsynet er opmærksom på sag om opslag i CPR ↗ 通知と調査状況 [s4] Udlændingestyrelsen / SIRI: Uvedkommende har fået adgang til borgeres CPR-oplysninger ↗	Entry / reported weaknesses Reported fact Authorities reported third-party abuse of a private company’s legitimate CPR lookup access. [s1][s2] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Inspect lookup privileges, retrieval limits, logs and identity checks; undisclosed entry and prior controls prevent an avoidability assessment. SEC-005 SEC-008 SEC-009 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentinfoQ: software vulnerability exploited, with unauthorized point redemptions Disclosed: 2026-10-05 Occurred: 2026-10-02 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Patch neglect versus pre-disclosure exploitation is unresolved. Do not add the 611 cases to the overall scope. [s1] GMOリサーチ&AI: infoQへの不正アクセスによる個人情報漏えいに関するお知らせ ↗ 5. 原因 / 3. 対象となる情報 / 4. ポイントの不正な交換	Entry / reported weaknesses Reported fact A site software vulnerability was exploited; product and patch timing are undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Inspect deployed versions, advisories, access privileges and logs, and redemption authorization and limits. SEC-001 SEC-005 SEC-008 SEC-009 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentScala i-ask: administrator intrusion affects customers on a shared server Disclosed: 2026-10-05 Occurred: 2026-10-02 Credential storage / publication Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The login mechanism and prior MFA coverage are undisclosed. Customer counts must not be added. [s1] スカラコミュニケーションズ: i-askへの不正アクセスに関する発表 ↗ 1. 漏えいの経緯 / 2. 漏えいした可能性のある情報 [s2] 大和証券: 外部委託先への不正アクセスによるお客様情報の漏洩の可能性について ↗ p.2 §2 [s3] シチズン時計: 委託先への不正アクセスに関する発表 ↗ シチズン §漏えいの可能性がある情報 / 損保ジャパン §2 [s4] 損保ジャパン: 外部委託先への不正アクセスによる情報漏えいの可能性について ↗ シチズン §漏えいの可能性がある情報 / 損保ジャパン §2 [s5] オリックス生命保険: 当社の委託先における個人情報漏えいの可能性について ↗ §1 [s6] 東武鉄道: 委託先事業者への不正アクセスについて（お知らせ） ↗ §1	Entry / reported weaknesses Reported fact Unauthorized administrator login was followed by installation of a program. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect administrator authentication, cross-environment privileges, and execution restrictions on upload storage. SEC-002 SEC-005 SEC-006 SEC-008 SEC-009 SEC-012 SEC-015	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentYakiniku King: leakage of 10,788,963 app-member records Disclosed: 2026-10-05 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. A library flaw, endpoint compromise, credential leak, or other specific cause is not established. [s1] 物語コーポレーション: 焼肉きんぐ公式アプリへの不正アクセスによる個人情報漏えいに関するお詫び ↗ 1. 経緯 / 2. 漏えいした情報の内容 / 3. 原因	Entry / reported weaknesses Reported fact Unauthorized access to the member-management system was detected on October 2. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Inspect member-database exposure, administrative privileges, access logs, and retained attributes and deadlines. SEC-006 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentNikkei: Microsoft 365 compromise and propagation to Nikkei BP Disclosed: 2026-10-04 Occurred: Date unresolved Credential storage / publication Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Nikkei’s original entry mechanism and total leakage count are undisclosed. This is separate from the existing 1,646-person Google Workspace case; 9,000 counts messages. [s1] 日本経済新聞社: サイバー攻撃による情報漏洩、不審メールの送信について ↗ 本文第1–3段落 / 日経本文 / 日経BP 第1段落 [s2] 日経BP: メール不正アクセスによる個人情報の漏えいについて ↗ 日経本文 / 日経BP 第1段落	Entry / reported weaknesses Reported fact An employee Microsoft 365 account was attacked; about 9,000 spoofed messages were sent on September 30. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) The entry mechanism is undisclosed; avoidability cannot be assessed. Inspect exposure, privileges, logs and retained data using the linked rules. SEC-002 SEC-003 SEC-005 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component日本経済新聞社: unauthorized access and impact Disclosed: 2026-10-04 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The original credential-theft route and actual exfiltration scope are undisclosed. A separate Microsoft 365 notice is not merged into this case. [s1] 日本経済新聞社: 日本経済新聞社：事故に関する公表資料 ↗ 本文第1-4段落	Entry / reported weaknesses Reported fact A Google Workspace account was accessed without authorization from late July. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-002 SEC-003 SEC-005 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentスタディサプリ: unauthorized access and impact Disclosed: 2026-10-03 Occurred: 2026-09-30 Service design / controls Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Affected email addresses are not a count of compromised logins. Vulnerability identifiers and prior remediation timing are undisclosed. [s1] スタディサプリ: スタディサプリ：事故に関する公表資料 ↗ #ssntc_303 原因 / 影響範囲 / 当社の対応	Entry / reported weaknesses Reported fact A feature-specification defect may have enabled identification of registered email addresses. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-009 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component第一生命: unauthorized access and impact Disclosed: 2026-10-02 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The entry mechanism and confirmed exfiltration scope are undisclosed. [s1] 第一ライフグループ・第一生命: 第一ライフグループ・第一生命：事故に関する公表資料 ↗ p.1 冒頭 / 現時点で閲覧され、外部に流出した可能性のある個人情報	Entry / reported weaknesses Reported fact Unauthorized access to the employee HR system was detected on September 24. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-006 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentJOGMEC: unauthorized access and impact Disclosed: 2026-10-02 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The initial entry mechanism and actual exfiltration scope are undisclosed; internal and external contact counts are separate. [s1] JOGMEC: JOGMEC：事故に関する公表資料 ↗ §§1-5	Entry / reported weaknesses Reported fact Investigation found possible leakage through unauthorized system access on September 9. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-002 SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentニチイ学館: data exposure and authorization boundaries Disclosed: 2026-10-02 Occurred: 2020-05-11 Execution environment / network boundary Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. No third-party access was found in the retained three months; missing earlier logs prevent excluding access throughout the full period. [s1] ニチイ学館: ニチイ学館：事故に関する公表資料 ↗ p.1 §1 / p.2 §1(2)-(4), §2-3	Entry / reported weaknesses Reported fact A retained backup was downloadable without authentication from May 11, 2020 to September 11, 2026. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-006 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentOsaka Metropolitan University: infrastructure outage attributed to ransomware Disclosed: 2026-10-02 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The intrusion start, entry route and whether or how much personal data leaked are not established. [s1] 大阪公立大学: 情報基盤システムにおける障害に関する記者会見を実施 ↗ 本文会見説明 / 本文影響範囲 / 個人情報 [s2] 大阪公立大学: 10月5日記者会見配付資料 ↗ 資料2 10月2日の経緯 [s3] 大阪公立大学: 本学情報基盤システムにおける障害の発生について【第4報】 ↗	Entry / reported weaknesses The initial entry path is not established. A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) The entry mechanism is undisclosed; avoidability cannot be assessed. Inspect exposure, privileges, logs and retained data using the linked rules. SEC-008 SEC-009 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component日本原子力研究開発機構: unauthorized access and impact Disclosed: 2026-10-01 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The initial entry route is undisclosed. Downloaded files, personal-data files and affected people are different units. [s1] 日本原子力研究開発機構: 日本原子力研究開発機構：事故に関する公表資料 ↗ 本事象の概要 / 漏えいした個人情報 / 対応状況	Entry / reported weaknesses Reported fact 2,419 research-support files were downloaded without authorization. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-006 SEC-008 SEC-009 SEC-012 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentチケットプラス: data exposure and authorization boundaries Disclosed: 2026-10-01 Occurred: 2026-09-28 Service design / controls Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Overlap and the actual count displayed to other people are undisclosed. [s1] チケットプラス: チケットプラス：事故に関する公表資料 ↗ 1. 発生経緯 / 4. 影響を受けた可能性のあるお客様	Entry / reported weaknesses Reported fact A cache change intended to reduce load caused cross-user information display during concurrent access. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-014 SEC-016	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentベネフィット・ワン: unauthorized access and impact Disclosed: 2026-09-30 Occurred: Date unresolved Service design / controls Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. This disclosure does not establish attacker intrusion; an unremediated application defect is not evidence of package patch neglect. [s1] ベネフィット・ワン: ベネフィット・ワン：事故に関する公表資料 ↗ p.1 §1-2	Entry / reported weaknesses Reported fact An export-condition defect included other tenants' employee data. A problem recognized in October 2025 had not been properly remediated. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentGポイント: unauthorized access and impact Disclosed: 2026-09-30 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The entry mechanism and actual leakage are not established; member identifiers are not confirmed leaked people. [s1] Gポイント: Gポイント：事故に関する公表資料 ↗ §§1-3	Entry / reported weaknesses Reported fact Unauthorized access to G Point was confirmed; its cause is under investigation. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-008 SEC-009 SEC-012 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentイープラス: unauthorized access and impact Disclosed: 2026-09-29 Occurred: 2026-09-11 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The specific entry mechanism is undisclosed. [s1] イープラス: イープラス：事故に関する公表資料 ↗ 1. 経緯 / 2. 漏えいした個人情報 / 4. 現時点の対応状況	Entry / reported weaknesses Reported fact Unauthorized access targeted the separate SmartTicket refund-management system. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-006 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component福岡県: data exposure and authorization boundaries Disclosed: 2026-09-29 Occurred: 2026-08-21 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The notice does not establish all entry, timing and extraction details; unresolved claims remain unknown. [s1] 福岡県: 福岡県：事故に関する公表資料 ↗ §§1-5	Entry / reported weaknesses Reported fact An application file was published with editing and saving enabled instead of read-only access, retaining applicants’ information. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-006 SEC-008 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentYamato Transport: unauthorized access to the pay-later service Disclosed: 2026-09-29 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The entry mechanism, affected count and confirmed exfiltration scope are undisclosed. [s1] ヤマト運輸: 「クロネコ代金後払いサービス」への不正アクセスの発生について ↗ p.1 本文 [s2] ヤマト運輸: 【第2報】「クロネコ代金後払いサービス」への不正アクセスの発生について ↗ p.1 §1 [s3] ヤマト運輸: 【第3報】「クロネコ代金後払いサービス」再開のお知らせ ↗ 本文第3段落	Entry / reported weaknesses Reported fact Third-party access was confirmed on September 28; the intrusion start is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) The entry mechanism is undisclosed; avoidability cannot be assessed. Inspect exposure, privileges, logs and retained data using the linked rules. SEC-006 SEC-008 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component両毛システムズ（大東ガス・伊勢崎市）: unauthorized access and impact Disclosed: 2026-09-28 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The VPN product, CVE and credential-acquisition route are undisclosed; August 14 is detection, not a confirmed intrusion start. The VPN product, CVE and credential-acquisition route are undisclosed; vendor intrusion detection is not a verified intrusion-start date. [s1] 両毛システムズ（大東ガス・伊勢崎市）: 両毛システムズ（大東ガス・伊勢崎市）：事故に関する公表資料 ↗ §§1-4 [s2] 両毛システムズ（大東ガス・伊勢崎市）: 両毛システムズ（大東ガス・伊勢崎市）：事故に関する公表資料 ↗ §§1,3,5,6	Entry / reported weaknesses Reported fact Ryomo Systems’ internal network was compromised; Daito Gas’s customer system was separated, but old working files remained in the vendor network. [s1] Reported fact Attackers reached Ryomo Systems’ file server through a VPN and ransomware was confirmed; the VPN compromise method is undisclosed. [s2] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-005 SEC-008 SEC-009 SEC-012 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component集英社: unauthorized access and impact Disclosed: 2026-09-28 Occurred: 2026-09-09 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The cause is the organization's assessment; detailed configuration and independent validation are undisclosed. [s1] 集英社: 集英社：事故に関する公表資料 ↗ p.1 §1 / p.2 §2-4	Entry / reported weaknesses Assessment Shueisha attributes the incident to attacks on API credentials arising from CMS misconfiguration, privileged-account creation, and repeated API requests. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-005 SEC-008 SEC-009 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentTemairazu: unauthorized access and suspicious guest messages Disclosed: 2026-09-28 Occurred: Date unresolved Component type unresolved Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. Causation of suspicious messages, confirmed leakage scope, and specific entry technique remain unknown. [s1] 手間いらず: 不審なメッセージおよび当社システムへの不正アクセスに関するお詫びとお知らせ ↗ p.2「原因と対応」 / p.1「確認した事象」	Entry / reported weaknesses Reported fact The company says it identified and addressed the cause, but withholds technical details. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Technical cause is undisclosed; inspect guest-data privileges, logs, and the need for data held by external services. SEC-005 SEC-006 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentOZmall: unauthorized access and impact Disclosed: 2026-09-27 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The vulnerability and prior patch timing are undisclosed. The revised number replaces the initial count rather than adding to it. [s1] OZmall: OZmall：事故に関する公表資料 ↗ 第2報 §§1-4	Entry / reported weaknesses Reported fact Abnormal access was detected and the responsible vulnerability addressed; its type is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-001 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component東京メトロ: unauthorized access and impact Disclosed: 2026-09-27 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The initial entry method and actually exfiltrated scope are undisclosed. Suppressed notification addresses are not all affected members. [s1] 東京メトロ: 東京メトロ：事故に関する公表資料 ↗ §§1-3	Entry / reported weaknesses Reported fact Unauthorized access to a mail-delivery server was confirmed; the cause remains under investigation. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentKeio: ransomware on group servers Disclosed: 2026-09-26 Occurred: Date unresolved Component type unresolved Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. September 26 is detection, not an established intrusion start; cause, CVE, leakage, and full recovery scope remain unknown. [s1] 京王電鉄: 不正アクセスによるシステム障害の発生について ↗ 1. 概要 / 2. 現在の状況	Entry / reported weaknesses Reported fact Entry cause and route are under external investigation; leakage was unconfirmed at publication. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) The entry cause is unknown; inspect shared-system dependencies, containment procedures, and restorable backups. SEC-009 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentレゴランド・ジャパン: unauthorized access and impact Disclosed: 2026-09-25 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The reservation count is not a distinct-person count. The vendor’s initial entry route is undisclosed. [s1] レゴランド・ジャパン: レゴランド・ジャパン：事故に関する公表資料 ↗ 本文	Entry / reported weaknesses Reported fact The outsourced Amadeus hotel-booking platform was accessed without authorization; its entry cause is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentTimes Car: member records and identity documents leaked Disclosed: 2026-09-25 Occurred: Date unresolved Component type unresolved Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. September 25 is detection and disclosure, not an established intrusion start; vulnerability and patch timing are unknown. [s1] タイムズモビリティ: タイムズカーにおける不正アクセスに関するお知らせ（第2報） ↗ 第2報 §3 / 第3報 §1 / 今後の調査 [s2] タイムズモビリティ: タイムズカーにおける不正アクセスに関するお知らせ（第3報） ↗ 第2報 §3 / 第3報 §1 [s3] タイムズモビリティ: タイムズカーWebサイトへの不正アクセスに関するご質問と回答（10月16日更新） ↗ p.1 Q1 [s4] タイムズモビリティ: 「タイムズカーWebシステム」への不正アクセスに関する対応について（第4報） ↗ §1 [s5] タイムズモビリティ: タイムズカーWebシステムへの不正アクセスに関するお知らせ ↗	Entry / reported weaknesses Reported fact The intrusion route and cause remain under investigation. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) The entry path cannot be assessed; inspect former-member and applicant retention, identity-document privileges, and access logs. SEC-005 SEC-006 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentToyobo group: compromised email propagates phishing to an affiliate Disclosed: 2026-09-25 Occurred: 2026-09-24 Credential storage / publication Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The initial Toyobo Textile entry mechanism and MFA state are undisclosed. The 1,500 figure counts messages, not leaked persons. [s1] 東洋紡: 当社グループ会社メールアカウントへの不正アクセスおよび不審メール送信について（お詫び） ↗ §1 [s2] 東洋紡エムシー: 東洋紡グループ会社従業員に対する不正アクセスに関するご報告（お詫び） ↗ 冒頭 / §1 / §2–3	Entry / reported weaknesses Reported fact Unauthorized access to a Toyobo Textile mailbox produced about 1,500 messages linking through a PDF to a credential-entry site. [s1] Reported weaknesses Reported fact Toyobo MC confirmed unauthorized access to the accounts of two employees who received those messages. [s2]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect authentication, session revocation and contact verification because mailbox compromise propagated to an affiliate. The initial entry cause remains unestablished. SEC-002 SEC-003 SEC-005 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentConoHa WING: unauthorized access and impact Disclosed: 2026-09-20 Occurred: 2026-09-03 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The initial entry mechanism and prior patch availability are unknown. Hosting and membership/billing systems have separate scopes. [s1] ConoHa WING: ConoHa WING：事故に関する公表資料 ↗ §§1-3	Entry / reported weaknesses Reported fact Some hosted web-server areas were accessed and malicious programs installed; technical entry details are undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-008 SEC-009 SEC-013 SEC-015	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentちばぎん商店: unauthorized access and impact Disclosed: 2026-09-17 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The undisclosed details must remain unknown. [s1] ちばぎん商店: ちばぎん商店：事故に関する公表資料 ↗ p.1-2 §§1-3	Entry / reported weaknesses Reported fact A subsidiary website was altered; the entry route is under investigation. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-006 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentGyazo: upload-server vulnerability and data access Disclosed: 2026-09-16 Occurred: 2026-09-11 Component type unresolved Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. Specific vulnerability, CVE, and pre-intrusion patch availability are unknown; user records do not necessarily represent distinct people. [s1] Helpfeel: Gyazoにおける不正アクセスに関するお知らせ ↗ 初報：1. 発生した事象 [s2] Helpfeel: Gyazoにおける不正アクセスに関するお知らせ（第2報） ↗ 影響範囲	Entry / reported weaknesses Reported fact Remote code execution affected the image-upload server on September 11 and was detected that evening. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Unknown patch timing prevents a neglect finding; inspect upload handling, database privileges, and deleted-data retention. SEC-001 SEC-005 SEC-006 SEC-008 SEC-009 SEC-010 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentアイスタイル: data exposure and authorization boundaries Disclosed: 2026-09-16 Occurred: 2026-09-02 Execution environment / network boundary Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The undisclosed details must remain unknown. [s1] アイスタイル: アイスタイル：事故に関する公表資料 ↗ §§1-4	Entry / reported weaknesses Reported fact A sharing-setting error made an internal-transfer file accessible to anyone knowing its URL. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-006 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentあいの風とやま鉄道: unauthorized access and impact Disclosed: 2026-09-15 Occurred: 2026-09-02 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The undisclosed details must remain unknown. [s1] あいの風とやま鉄道: あいの風とやま鉄道：事故に関する公表資料 ↗ §§1-4 / Q4	Entry / reported weaknesses Reported fact The reservation system was accessed repeatedly between September 2 and 8; the cause is under investigation. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentLEAN BODY: unauthorized access and impact Disclosed: 2026-09-15 Occurred: 2026-08-11 Supplied product / appliance Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. An omitted Metabase update is reported as a likely contributor, not a proven complete entry chain. Version, CVE and prior patch timing are undisclosed. [s1] LEAN BODY: LEAN BODY：事故に関する公表資料 ↗ §§1-4,8（ブラウザで本文確認）	Entry / reported weaknesses Reported fact A Metabase vulnerability was exploited. [s1]	Control evidence / inspection Patch information available Inspection suggestions (editorial) The update omission is a company assessment. Review deployed versions and update history; the CVE and pre-attack fix date are undisclosed. SEC-001 SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component大阪市行政委員会事務局: unauthorized access and impact Disclosed: 2026-09-15 Occurred: 2026-08-09 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The reviewed notice does not name the analytics vendor. Similar dates do not prove this is the ApplyNow incident. [s1] 大阪市行政委員会事務局: 大阪市行政委員会事務局：事故に関する公表資料 ↗ §§1-3	Entry / reported weaknesses Reported fact The recorded-interview provider’s analytics tool was accessed; the provider name and technical cause are absent from the notice. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-001 SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentDigital Agency GSS: entry through an unpatched VPN Disclosed: 2026-09-11 Occurred: Date unresolved Supplied product / appliance Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. VPN product and CVE are undisclosed; June 25 is anomaly detection, not an established intrusion start. [s1] デジタル庁: GSSにおける不正アクセスについて（Q&A） ↗ Q&A：原因と脆弱性の対応 / Q&A：流出の可能性	Entry / reported weaknesses Reported fact A previously disclosed VPN vulnerability remained unpatched; its published severity was Medium. [s1]	Control evidence / inspection Patch information available An unapplied fix before entry was reported. Inspection suggestions (editorial) Prioritize using exposure and maintenance privileges as well as CVSS, and retain evidence of applied fixes. SEC-001 SEC-002 SEC-005 SEC-006 SEC-008 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component日本エネルギー経済研究所: unauthorized access and impact Disclosed: 2026-09-11 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Mailbox count, exposed email messages and passport-bearing messages are separate scopes. The supplied 795 figure is not a verified distinct-person count. [s1] 日本エネルギー経済研究所: 日本エネルギー経済研究所：事故に関する公表資料 ↗ 続報 pp.1-2 §§1-3	Entry / reported weaknesses Reported fact Six staff Microsoft 365 accounts were compromised and file downloads confirmed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-002 SEC-003 SEC-005 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentApplyNow（吉野家・橿原市・富士市）: unauthorized access and impact Disclosed: 2026-09-09 Occurred: 2026-08-09 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The analytics product, CVE and prior patch availability are undisclosed; a shared flaw with other BI incidents is not established. About 390,000 people is provisional and must not be added to customer application or account counts; Fuji’s 815 counts application records, not people. [s1] ApplyNow: 当社サービスをご利用いただいているお客様への重要なお知らせとお詫び（10月9日更新） ↗ ApplyNow §1 本件の概要 / 吉野家 p.1 §1・2・p.2 §4 / 【2026.10.9 更新】■ データの漏えいの確認について / ■ 漏えいした個人データについて [s2] 吉野家ホールディングス・吉野家・はなまる: ApplyNow採用管理プラットフォームへの不正アクセスによる個人情報漏えいに関するお知らせとお詫び ↗ ApplyNow §1 本件の概要 / 吉野家 p.1 §1・2・p.2 §4 / p.1 §1-2 / p.2 §4 [s3] 橿原市: 職員採用試験の動画選考に係る個人情報の漏洩について ↗ p.1 §§1-3 [s4] 富士市: 本市職員採用試験を受験された方の個人情報の不正流出について【続報】 ↗ 10月7日続報流出した個人情報 / 今後の対応 [s5] 富士市: 本市職員採用試験を受験された方の個人情報の不正流出の可能性について【お知らせとお詫び】 ↗	Entry / reported weaknesses Reported fact A vulnerability in outsourced ApplyNow analytics was exploited; applicant data remained after contract termination. [s2][s1] Reported fact The previously contracted ApplyNow platform was accessed without authorization. [s3] Reported fact The ApplyNow intrusion leaked Fuji City applicants’ information. [s4] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-001 SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component鴨川市: data exposure and authorization boundaries Disclosed: 2026-09-09 Occurred: 2026-08-31 Service design / controls Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The first disclosure date is unknown; September 9 is the earliest reviewed update. A correction excludes email addresses from the exposed fields. [s1] 鴨川市: 鴨川市：事故に関する公表資料 ↗ 事案の概要 / 原因 / 続報（9月9日）	Entry / reported weaknesses Reported fact Inadequate survey-permission checking allowed respondents to view earlier submissions. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-006 SEC-008 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentWeverse Company: unauthorized access and impact Disclosed: 2026-09-06 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Strengthened API controls are reported, but the precise entry chain remains an assessment. Account identifiers and transaction metadata are not names or card credentials. [s1] Weverse Company: Weverse Company：事故に関する公表資料 ↗ §§1-2	Entry / reported weaknesses Assessment Following an external vulnerability report, the company confirmed payment-API disclosure and strengthened access controls. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-008 SEC-009 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component大田区文化振興協会: unauthorized access and impact Disclosed: 2026-09-04 Occurred: 2026-08-22 Employee / personal endpoint Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The notice describes a likely support-scam sequence; actual extraction is unconfirmed. Staff and user counts are potentially affected people. [s1] 大田区文化振興協会: 大田区文化振興協会：事故に関する公表資料 ↗ §§1-5	Entry / reported weaknesses Assessment A staff member called a fake alert’s number and followed instructions; remote control of the work computer is suspected. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-003 SEC-004 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentIHIグループ健康保険組合: data exposure and authorization boundaries Disclosed: 2026-09-02 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The employer’s external-model submission is not evidence of attacker AI use. The reviewed health-insurance disclosure covers 210 people, not the whole RIZAP event. [s1] IHIグループ健康保険組合: IHIグループ健康保険組合：事故に関する公表資料 ↗ 2026/09/02 本文	Entry / reported weaknesses Reported fact A RIZAP employee submitted health-guidance data to generative AI during extraction; this is not evidence of attacker AI use. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-006 SEC-011 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentUnit 42: AI-assisted intrusion abusing repository secrets Disclosed: 2026-09-02 Occurred: Date unresolved Component type unresolved Evidence and unknowns Unit 42 reports LLM calls during the intrusion; this does not establish autonomous execution of every stage. Victim identity and initial vulnerability are undisclosed; the full human-versus-agent autonomy split is unverified. [s1] Palo Alto Networks Unit 42: An AI-assisted cyber attack: inside a Unit 42 investigation ↗ Repository / vault / CI stages / Branch protection / September corrections / AI-assisted orchestration	Entry / reported weaknesses The initial entry path is not established. A specific management or implementation weakness is not established. Other reported activity / subsequent access Reported fact Repository tokens, vault credentials, and cloud keys in CI enabled expansion. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect repository secrets and CI, vault, and AI-endpoint privileges; separate change approval from production credentials. Controls that worked Reported fact Branch protection blocked a backdoor attempt; the intrusion was not established as ransomware. [s1] SEC-004 SEC-005 SEC-006 SEC-007 SEC-008 SEC-009 SEC-011	AI involvementReported fact Use observed in attacks Unit 42 reports LLM calls during the intrusion; this does not establish autonomous execution of every stage.
Record / component千葉県生物多様性センター: unauthorized access and impact Disclosed: 2026-09-01 Occurred: 2026-08-27 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Actual leakage and entry mechanism remain unconfirmed. More detailed member information was held outside the affected server. [s1] 千葉県生物多様性センター: 千葉県生物多様性センター：事故に関する公表資料 ↗ §§1-5	Entry / reported weaknesses Reported fact The member site was accessed and unauthorized pages inserted; the entry cause is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-008 SEC-009 SEC-012 SEC-015	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component関西学院大学: data exposure and authorization boundaries Disclosed: 2026-09-01 Occurred: Date unresolved Service design / controls Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The precise exposure start date and actual access by unintended viewers are unknown. [s1] 関西学院大学: 関西学院大学：事故に関する公表資料 ↗ §§1-7	Entry / reported weaknesses Reported fact Insufficient audience controls exposed student data publicly or to members of an external social network. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-006 SEC-008 SEC-009 SEC-012 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component三井不動産: unauthorized access and impact Disclosed: 2026-09-01 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The credential-theft route and MFA state are undisclosed. The shopping-membership notice concerns a separate incident. [s1] 三井不動産: 三井不動産：事故に関する公表資料 ↗ pp.1-2 §§1-3	Entry / reported weaknesses Reported fact Business-system credentials were abused; acquisition is under investigation. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-002 SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentTRUNK: unauthorized access and impact Disclosed: 2026-09-01 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The initial entry mechanism and actual exfiltration scope are undisclosed. [s1] TRUNK: TRUNK：事故に関する公表資料 ↗ §§1-3	Entry / reported weaknesses Reported fact Employee email was compromised and used for impersonation messages; the authentication bypass mechanism is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-002 SEC-003 SEC-005 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentコープやまぐち: unauthorized access and impact Disclosed: 2026-08-28 Occurred: 2026-08-27 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The entry route and exfiltration remain under investigation. [s1] コープやまぐち: コープやまぐち：事故に関する公表資料 ↗ 第2報 §§1,2,5	Entry / reported weaknesses Reported fact The outsourced mini-app database was accessed and deleted; this was not a LINE Yahoo database incident. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-005 SEC-008 SEC-009 SEC-012 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentコロナ: unauthorized access and impact Disclosed: 2026-08-28 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The initial entry mechanism and actual exfiltration scope are undisclosed; this is not attributed to another vendor without evidence. [s1] コロナ: コロナ：事故に関する公表資料 ↗ §§1-3	Entry / reported weaknesses Reported fact Unauthorized access affected an external construction-information cloud service. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentカインドオル: unauthorized access and impact Disclosed: 2026-08-28 Occurred: 2026-08-23 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Phishing, weak passwords and absent MFA are reported; the exact original compromise date and extraction completeness are undisclosed. [s1] カインドオル: カインドオル：事故に関する公表資料 ↗ §§1-4,6	Entry / reported weaknesses Reported fact An employee entered staff credentials into a phishing site; the account lacked two-step authentication. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-002 SEC-005 SEC-008 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentイエローハット: unauthorized access and impact Disclosed: 2026-08-28 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The initial entry path and confirmed exfiltration scope are undisclosed. This is separate from the 2rinkan incident. [s1] イエローハット: イエローハット：事故に関する公表資料 ↗ §§1-3	Entry / reported weaknesses Reported fact Malicious-program activity targeted the booking system; the entry mechanism is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentチューリッヒ保険: unauthorized access and impact Disclosed: 2026-08-27 Occurred: 2026-04-01 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The vulnerability product, CVE and prior patch availability are undisclosed. [s1] チューリッヒ保険: チューリッヒ保険：事故に関する公表資料 ↗ 概要 / 対象となるお客さま / 当社のこれまでの対応	Entry / reported weaknesses Reported fact A Z-Dash vulnerability was discovered; historical logs showed unauthorized access on April 1 and 6. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-001 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentファンくる: unauthorized access and impact Disclosed: 2026-08-24 Occurred: 2026-08-20 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The notice does not establish all entry, timing and extraction details; unresolved claims remain unknown. [s1] ファンくる: ファンくる：事故に関する公表資料 ↗ 9月18日最終報 §§1-3	Entry / reported weaknesses Reported fact Credential stuffing caused unauthorized logins; the original credential source is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-002 SEC-005 SEC-009 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component楽天ブックスネットワーク: unauthorized access and impact Disclosed: 2026-08-21 Occurred: Date unresolved Employee / personal endpoint Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The initial entry route and actual exfiltration are not established. Stored record categories are not necessarily distinct people. [s1] 楽天ブックスネットワーク: 楽天ブックスネットワーク：事故に関する公表資料 ↗ §§1-3	Entry / reported weaknesses Reported fact Unauthorized access to some internal PCs was detected on April 5; the entry route is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-003 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component2025年日本国際博覧会協会: unauthorized access and impact Disclosed: 2026-08-20 Occurred: 2026-05-13 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The notice does not state the credential-theft procedure, prior MFA state or affected-person count. [s1] 2025年日本国際博覧会協会: 2025年日本国際博覧会協会：事故に関する公表資料 ↗ §§1,2,4	Entry / reported weaknesses Reported fact A phishing message impersonating an overseas firm preceded unauthorized Microsoft 365 access at a subcontractor. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-002 SEC-003 SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentRust: malicious build code in legitimate crate updates Disclosed: 2026-08-20 Occurred: Date unresolved Dependency library Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. Downloads are not a victim count; downstream compromise scope is unknown. [s1] Rust Project: Supply-chain attack on arrayref ↗ Attack overview / Maintainer account [s2] Rust Project: Targeted attacks on Rust crate maintainers ↗	Entry / reported weaknesses Assessment The August 20 report assesses compromise of a maintainer’s computer or credentials as the likely cause. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Check dependency versions and build-script execution; examine exposed credentials and hosts rather than only replacing dependencies. SEC-001 SEC-003 SEC-004 SEC-005 SEC-007 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentSakura Internet: separate billing-database intrusion Disclosed: 2026-08-19 Occurred: Date unresolved Component type unresolved Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. Intrusion timing is disclosed only by month; account overlap prevents adding the two incident counts. [s1] さくらインターネット: 当社システムへの不正アクセスに関する調査結果および再発防止策について（第三報） ↗ 4.(2) 販売管理システム / 4.(3) 認証情報 / 5. 影響を受けた可能性のある情報	Entry / reported weaknesses Reported fact Billing-database unauthorized access was confirmed without an established link to the hosting incident. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) The entry cause remains unknown; inspect the need, storage format, retention, and access control for initial credentials. SEC-004 SEC-005 SEC-006 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component静岡県: data exposure and authorization boundaries Disclosed: 2026-08-19 Occurred: Date unresolved Service design / controls Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Actual access by third parties remains unconfirmed; exposure resulted from the published Forms response-summary setting. [s1] 静岡県: 静岡県：事故に関する公表資料 ↗ p.1 §§1-4	Entry / reported weaknesses Reported fact A Google Forms response-summary setting exposed other applicants’ answers. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-006 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentVOISING: unpatched BI tool data leakage Disclosed: 2026-08-18 Occurred: Date unresolved Supplied product / appliance Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. BI product and CVE are undisclosed; proximity to another incident does not establish a shared product or vulnerability. [s1] VOISING: 不正アクセスによる情報流出に関するご報告（第4報） ↗ 1. 調査結果【原因】 / 3. 本件不正アクセスへの対応と再発防止策【今後の対策】 / 1. 調査結果【漏えいが確認された件数および情報】	Entry / reported weaknesses Reported fact A patch was available before unauthorized access but had not been applied. [s1]	Control evidence / inspection Patch information available An unapplied fix before entry was reported. Inspection suggestions (editorial) Compare deployed BI versions with advisories and verify patch ownership and deadlines; limit exposure and accessible data. SEC-001 SEC-005 SEC-006 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentウェブライフ: unauthorized access and impact Disclosed: 2026-08-18 Occurred: 2026-08-14 Service design / controls Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The exact implementation defect and confirmed email extraction scope are undisclosed. [s1] ウェブライフ: ウェブライフ：事故に関する公表資料 ↗ 初報 §§1-4 / 続報 §§2-4	Entry / reported weaknesses Reported fact A customer-management access-control defect enabled unauthorized activity from August 14 to 17. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-009 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component教育ソフトウェア: unauthorized access and impact Disclosed: 2026-08-17 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The estimated access window does not establish an exact intrusion-start day. Encrypted stored records are not confirmed exfiltration. [s1] 教育ソフトウェア: 教育ソフトウェア：事故に関する公表資料 ↗ 本件の概要 / 現在の状況	Entry / reported weaknesses Reported fact A dormant rental server used for a service ending in 2016 was accessed and encrypted. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-001 SEC-006 SEC-009 SEC-012 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentSakura Internet: unauthorized management-server access Disclosed: 2026-08-17 Occurred: Date unresolved Component type unresolved Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. Potential scope is not a confirmed leak count; do not add these accounts to billing-incident counts. [s1] さくらインターネット: 当社サービスへの不正アクセスに関するご報告とお詫び（第3報） ↗ 1. ホスティングサービス / 1. 影響範囲	Entry / reported weaknesses Reported fact Unauthorized access and malware were confirmed following an August 9 anomaly. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) The entry path is unknown; inspect management exposure, reachable privileges, credential revocation, and detection. SEC-005 SEC-006 SEC-008 SEC-009 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentチャーム: unauthorized access and impact Disclosed: 2026-08-13 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Retired and duplicate accounts prevent converting record counts to unique people. Initial entry is undisclosed. [s1] チャーム: チャーム：事故に関する公表資料 ↗ 第3報 9月2日更新 / §§1-3	Entry / reported weaknesses Reported fact The online store was accessed without authorization; credential acquisition has not been identified. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-002 SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentホワイトエッセンス: unauthorized access and impact Disclosed: 2026-08-12 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The notice does not establish all entry, timing and extraction details; unresolved claims remain unknown. [s1] ホワイトエッセンス: ホワイトエッセンス：事故に関する公表資料 ↗ 画像本文 §§1-3,6（ブラウザで目視）	Entry / reported weaknesses Reported fact A reservation-site vulnerability enabled unauthorized access to the core system. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-001 SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component科学技術振興機構: unauthorized access and impact Disclosed: 2026-08-07 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Email messages and unique contact addresses are different units; the follow-up message total supersedes the initial estimate. [s1] 科学技術振興機構: 科学技術振興機構：事故に関する公表資料 ↗ §§1-3	Entry / reported weaknesses Reported fact Unauthorized access affected 12 staff mailboxes; the entry route is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-002 SEC-003 SEC-005 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component一正蒲鉾: unauthorized access and impact Disclosed: 2026-08-06 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The 596 figure is the number of external email addresses notified, not a verified total of affected people. [s1] 一正蒲鉾: 一正蒲鉾：事故に関する公表資料 ↗ p.1 §§1-3	Entry / reported weaknesses Reported fact An employee mailbox was compromised; the specific entry method is under investigation. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-002 SEC-003 SEC-005 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentMetabase: zero-day and administrator-session abuse Disclosed: 2026-08-06 Occurred: Date unresolved Supplied product / appliance Evidence and unknowns The developer infers LLM involvement without confirming the attacker’s model or actual usage. AI attribution is the developer’s assessment; total self-hosted impact and individual intrusion starts are unknown. [s1] Metabase: Vulnerability: what happened ↗ Technical root cause / Scope of impact / Was this AI? [s2] Metabase: Security update, 6 Aug 2026 ↗ [s3] Metabase: SQL injection using an unauthenticated endpoint leading to admin access ↗ Summary / CVE ID	Entry / reported weaknesses Reported fact Extra input keys, password-reset handling, and ORM acceptance of SQL expressions formed the exploit chain. [s1] Reported weaknesses Reported fact The vendor advisory identifies unauthenticated SQL injection enabling administrator access as CVE-2026-72898. [s3]	Control evidence / inspection Exploitation before disclosure reported Inspection suggestions (editorial) Exploitation preceded disclosure. Inspect BI exposure, API keys, and data privileges; inspect input allowlists and SQL-expression boundaries in owned code. SEC-001 SEC-005 SEC-006 SEC-008 SEC-009 SEC-010	AI involvementAssessment Use assessed, not confirmed The developer infers LLM involvement without confirming the attacker’s model or actual usage.
Record / componentナイス: unauthorized access and impact Disclosed: 2026-08-06 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The initial entry route and actual disclosure scope are undisclosed. Unauthorized mail transmission was confirmed. [s1] ナイス: ナイス：事故に関する公表資料 ↗ §§1-4 / 8月21日追記	Entry / reported weaknesses Reported fact An inquiry mailbox was accessed; the August 21 update confirms spam sent from it. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-002 SEC-003 SEC-005 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component中部電力: unauthorized access and impact Disclosed: 2026-08-04 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Message count and contact-person counts represent different scopes and cannot be added as affected people. [s1] 中部電力: 中部電力：事故に関する公表資料 ↗ §§1-3	Entry / reported weaknesses Reported fact Business-system credentials were abused; no intrusion evidence was found for power-supply or customer systems. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-002 SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentイノベーション: unauthorized access and impact Disclosed: 2026-08-04 Occurred: Date unresolved Credential storage / publication Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Hardcoded repository secrets and stored personal data are reported. The precise account-entry route remains undisclosed. [s1] イノベーション: イノベーション：事故に関する公表資料 ↗ 確定報 §§1-4	Entry / reported weaknesses Reported fact A GitHub access token was embedded in a configuration file, acquired and abused by a third party. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-004 SEC-005 SEC-007 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component京都府 KYO育tv: data exposure and authorization boundaries Disclosed: 2026-08-04 Occurred: Date unresolved Service design / controls Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Potentially accessible profiles and the 86 profiles actually shown have separate scopes; actual disclosure is not universal. [s1] 京都府 KYO育tv: 京都府 KYO育tv：事故に関する公表資料 ↗ p.1 §§1-3	Entry / reported weaknesses Reported fact A favorites-feature defect exposed member data on the internet. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-006 SEC-009 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component講談社: unauthorized access and impact Disclosed: 2026-08-03 Occurred: 2026-07-27 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The notice does not establish prior MFA coverage or a more detailed credential-theft mechanism. [s1] 講談社: 講談社：事故に関する公表資料 ↗ pp.1-2 本件の経緯 / 弊社の対応	Entry / reported weaknesses Reported fact An employee entered credentials on a phishing site impersonating a business partner, enabling unauthorized mailbox login. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-002 SEC-003 SEC-005 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentショップサーブ: unauthorized access and impact Disclosed: 2026-08-01 Occurred: 2026-05-21 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The initial entry chain, product, CVE and availability of a prior fix are undisclosed. [s1] ショップサーブ: ショップサーブ：事故に関する公表資料 ↗ 第2報 §§1-4 / 対象件数	Entry / reported weaknesses Reported fact A malicious server program transmitted buyer data externally; the entry mechanism remains under investigation. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentEPARKリラク＆エステ: unauthorized access and impact Disclosed: 2026-07-31 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The revised 22.18 million records replaces the 33 million estimate. Five free-text entries resembling expired card data are not verified payment credentials. [s1] EPARKリラク＆エステ: EPARKリラク＆エステ：事故に関する公表資料 ↗ 第2報 §§1-4	Entry / reported weaknesses Reported fact Forensics confirmed database exfiltration followed by deletion; the entry method is withheld. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-006 SEC-008 SEC-009 SEC-012 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentAnthropic: evaluation connectivity limits failed Disclosed: 2026-07-30 Occurred: Date unresolved Execution environment / network boundary Evidence and unknowns Anthropic confirmed evaluation-model activity with external impact. This record groups three incidents. Victim identities and all run dates are undisclosed; evaluation activity differs from criminal use. [s1] Anthropic: Investigating incidents in our cybersecurity evaluations ↗ How these incidents happened / Incident 2 / Investigation overview	Entry / reported weaknesses Reported fact Some environments allowed connectivity despite instructions; Anthropic did not identify sophisticated novel vulnerability exploitation. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Instructions alone do not prove network isolation. Verify controls in authorized tests and separate public-package publishing authority. SEC-002 SEC-004 SEC-005 SEC-006 SEC-007 SEC-008 SEC-009 SEC-010 SEC-011	AI involvementReported fact Activity during evaluations Anthropic confirmed evaluation-model activity with external impact.
Record / component生命保険協会: data exposure and authorization boundaries Disclosed: 2026-07-29 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The exposure window and actual unauthorized viewing scope are not fully established; possible lookup records are not proven exfiltration. [s1] 生命保険協会: 生命保険協会：事故に関する公表資料 ↗ pp.1-2 §§1-3	Entry / reported weaknesses Reported fact Specific external operations could expose registered-user data in a contract-lookup system. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-006 SEC-009 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentタカラトミー: data exposure and authorization boundaries Disclosed: 2026-07-28 Occurred: 2025-08-01 Service design / controls Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Potentially accessible accounts are not confirmed accessed accounts. The implementation defect does not establish a library vulnerability. [s1] タカラトミー: タカラトミー：事故に関する公表資料 ↗ pp.1-2 本文 / §§1-2	Entry / reported weaknesses Reported fact The app had a user-authentication design and implementation defect from release. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-009 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component旭化成セラピューティクス・シミックHCI: unauthorized access and impact Disclosed: 2026-07-24 Occurred: 2026-06-15 Execution environment / network boundary Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The public-storage configuration and scopes are established; actual third-party downloads are unresolved. This is separate from the October Pharma DIGITAL event. [s1] 旭化成セラピューティクス・シミックHCI: 旭化成セラピューティクス・シミックHCI：事故に関する公表資料 ↗ §§1-4	Entry / reported weaknesses Reported fact Files in the publicly served area of a patient-support service were retrieved by a third party. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-005 SEC-006 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentムラウチドットコム: unauthorized access and impact Disclosed: 2026-07-24 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The reviewed HTML notice confirms personal-data leakage but does not state the supplied 7,716,811 count. The linked PDF could not be verified. [s1] ムラウチドットコム: ムラウチドットコム：事故に関する公表資料 ↗ 冒頭 / FAQ Q1-Q3,Q7,Q9	Entry / reported weaknesses Reported fact The company confirmed unauthorized system access and extraction of personal information; technical entry details remain unverified. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentNIDEK medical devices: website software vulnerability exploited Disclosed: 2026-07-24 Occurred: 2026-07-20 Component type unresolved Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. Product, CVE, patch timing, and confirmed leakage scope are unspecified; NIDEK is distinct from motor manufacturer NIDEC. [s1] NIDEK: 当社Webサイトへの不正アクセスに関するお知らせ ↗ [s2] NIDEK: FAQ Regarding Unauthorized Access to Our Website ↗ FAQ Q1 / Q3 / Q14 / FAQ Q2 / Q7 / Q17	Entry / reported weaknesses Reported fact The FAQ dates initial access to around 01:00 JST on July 20 and detection to July 24, and identifies a website-software vulnerability. [s2] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Inspect deployed versions, update records, and inquiry-data retention; unknown pre-intrusion patch timing prevents a neglect finding. SEC-001 SEC-006 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component扶桑電通: unauthorized access and impact Disclosed: 2026-07-22 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The undisclosed details must remain unknown. [s1] 扶桑電通: 扶桑電通：事故に関する公表資料 ↗ 第2報 §§1-3	Entry / reported weaknesses Reported fact Cloud-storage credentials were abused; their acquisition route has not been identified. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-002 SEC-005 SEC-006 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component三重県立久居農林高等学校: data exposure and authorization boundaries Disclosed: 2026-07-22 Occurred: 2026-07-16 Service design / controls Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Actual unintended access remains unconfirmed; the incident involved a mistaken editing setting rather than reported external intrusion. [s1] 三重県立久居農林高等学校: 三重県立久居農林高等学校：事故に関する公表資料 ↗ §§1-5	Entry / reported weaknesses Reported fact A staff configuration change exposed other applicants’ information to all form respondents. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-006 SEC-008 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentOpenAI / Hugging Face: evaluation agent reached external systems Disclosed: 2026-07-16 Occurred: Date unresolved Supplied product / appliance Evidence and unknowns OpenAI confirmed evaluation-model involvement; this is not a criminal-use example. Treat this evaluation escape separately from criminal AI use. This record does not establish every vulnerability-to-CVE mapping. [s1] OpenAI: Hugging Face model evaluation security incident ↗ Incident account / technical investigation / Incident account / updates / Incident account [s2] Hugging Face: Security incident disclosure — July 2026 ↗ [s3] Hugging Face: Agent intrusion: technical timeline ↗	Entry / reported weaknesses Reported fact The prototype exploited an Artifactory zero-day through permitted package connectivity to reach the internet. [s1]	Control evidence / inspection Exploitation before disclosure reported Inspection suggestions (editorial) Exploitation preceded disclosure; verify actual evaluation-agent network routes and privileges, rather than relying on declared limits. SEC-001 SEC-004 SEC-005 SEC-006 SEC-008 SEC-009 SEC-011	AI involvementReported fact Activity during evaluations OpenAI confirmed evaluation-model involvement; this is not a criminal-use example.
Record / componentファイブフォックス: unauthorized access and impact Disclosed: 2026-07-14 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Exfiltration scope and technical cause are undisclosed. [s1] ファイブフォックス: ファイブフォックス：事故に関する公表資料 ↗ 第2報 §§1-4	Entry / reported weaknesses Reported fact Unauthorized access to group systems was detected on July 8; the entry route is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-008 SEC-009 SEC-012 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentK9ナチュラルジャパン: unauthorized access and impact Disclosed: 2026-07-14 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The revised 78,763 records replaces the initial estimate. Initial entry and overlap among affected customers are undisclosed. [s1] K9ナチュラルジャパン: K9ナチュラルジャパン：事故に関する公表資料 ↗ 9月4日報告概要 / 二次被害	Entry / reported weaknesses Reported fact The online-service management server was accessed without authorization; the entry cause is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentメディア4u: unauthorized access and impact Disclosed: 2026-07-14 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The initial entry route, attack start and complete extraction scope are undisclosed. Management-list records are not all confirmed personal-data records. [s1] メディア4u: メディア4u：事故に関する公表資料 ↗ 7月17日第二報 §§1-4 / FAQ [s2] メディア4u: メディア4u：事故に関する公表資料 ↗	Entry / reported weaknesses Reported fact Unauthorized access to the SMS delivery service exposed account-management information; initial entry is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-001 SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentニチレイ: unauthorized access and impact Disclosed: 2026-07-13 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The initial entry route and duplicate people across the record categories are undisclosed. [s1] ニチレイ: ニチレイ：事故に関する公表資料 ↗ 第7報 §§1-3	Entry / reported weaknesses Reported fact A server cyberattack was confirmed; its entry route is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-008 SEC-009 SEC-012 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component福岡大学: unauthorized access and impact Disclosed: 2026-07-09 Occurred: 2026-04-17 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The notice does not establish all entry, timing and extraction details; unresolved claims remain unknown. [s1] 福岡大学: 福岡大学：事故に関する公表資料 ↗ §§1-4	Entry / reported weaknesses Reported fact The vendor Nostrum’s network was compromised; file encryption and a backdoor were confirmed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-008 SEC-009 SEC-012 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component杏林学園: unauthorized access and impact Disclosed: 2026-07-08 Occurred: 2026-06-26 Employee / personal endpoint Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The full exfiltration scope is unresolved and a forensic investigation was planned. The event began with a faculty member’s home PC. [s1] 杏林学園: 杏林学園：事故に関する公表資料 ↗ 発覚経緯 / 対象情報 / 対応	Entry / reported weaknesses Reported fact A faculty member working from home was directed to a fake website and their computer remotely accessed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-003 SEC-004 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentテレビ朝日メディアプレックス: unauthorized access and impact Disclosed: 2026-07-03 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The authentication sequence is described as likely; the full entry chain and confirmed extraction scope are unresolved. [s1] テレビ朝日メディアプレックス: テレビ朝日メディアプレックス：事故に関する公表資料 ↗ 第2報 pp.1-3 §§1-5	Entry / reported weaknesses Assessment Investigators report possible theft and abuse of authentication-federation account credentials. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-002 SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component加賀ソルネット: unauthorized access and impact Disclosed: 2026-07-01 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The product, CVE and prior patch availability are undisclosed. Migration and restart plans are not represented as completed controls. [s1] 加賀ソルネット: 加賀ソルネット：事故に関する公表資料 ↗ 8月17日第二報 §§1-5	Entry / reported weaknesses Reported fact A system vulnerability was exploited; the product, CVE and prior patch availability are undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-001 SEC-008 SEC-009 SEC-012 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentAflac Japan: ordinary-looking requests and bulk data queries Disclosed: 2026-06-30 Occurred: 2026-06-10 Service design / controls Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. Specific requests, products, and CVEs are undisclosed; this does not establish neglected library patches or a specific SQL-injection technique. [s1] アフラック生命保険: 当社システムに対する不正アクセスの発生および情報漏えいに関する調査結果と再発防止策について ↗ 4. 発生原因 / 2. 漏えいした個人情報	Entry / reported weaknesses Reported fact Aflac described insufficient access and query controls; reviews and penetration tests had not anticipated the method. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect server-side query authorization and retrieval limits, and test detection of abnormal volume with synthetic data. SEC-008 SEC-009 SEC-012 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentピックルボールワン: unauthorized access and impact Disclosed: 2026-06-30 Occurred: 2026-06-15 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The plugin vulnerability and prior fix availability are undisclosed. The provider found no extraction evidence and did not hold payment-card data. [s1] ピックルボールワン: ピックルボールワン：事故に関する公表資料 ↗ §§1-4	Entry / reported weaknesses Reported fact An external plugin vulnerability was exploited to install malicious server programs. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-001 SEC-002 SEC-005 SEC-008 SEC-009 SEC-015	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentKDDI: ISP data leakage through a third-party zero-day Disclosed: 2026-06-23 Occurred: 2026-05-16 Supplied product / appliance Evidence and unknowns AI is mentioned for defensive measures, not established attacker use. Product and CVE are undisclosed; this source does not establish a single storage format for every leaked password. [s1] KDDI: 当社ISPサービスのお客さま情報の流出について（第2報・訂正） ↗ 3. 発生原因および対応 / 2. 情報流出の詳細（7月21日訂正） [s2] KDDI: 当社ISPサービスのお客さま情報の流出について ↗	Entry / reported weaknesses Reported fact Exploitation began May 16; the vendor was unaware of the vulnerability at June 17 detection. [s1]	Control evidence / inspection Exploitation before disclosure reported Inspection suggestions (editorial) Exploitation preceded disclosure; inspect component inventory, privileges, stored information, and detection to limit impact. SEC-001 SEC-005 SEC-006 SEC-008 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component小松製作所: data exposure and authorization boundaries Disclosed: 2026-06-16 Occurred: Date unresolved Service design / controls Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The exact start date and overlap among affected user groups are unknown; additional scopes cannot be summed. [s1] 小松製作所: 小松製作所：事故に関する公表資料 ↗ 9月15日 §§1-3 / 6月16日 §§1-5 [s2] 小松製作所: 小松製作所：事故に関する公表資料 ↗	Entry / reported weaknesses Reported fact Design, configuration and operational defects allowed authorized users to view personal information beyond the necessary scope. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-006 SEC-008 SEC-009 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component佐嘉平川屋: unauthorized access and impact Disclosed: 2026-06-15 Occurred: 2025-03-21 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Record and unique-person counts are different. Personal-information and card-information scopes overlap and are not additive. [s1] 佐嘉平川屋: 佐嘉平川屋：事故に関する公表資料 ↗ pp.1-3 §§1-5	Entry / reported weaknesses Reported fact A system vulnerability was exploited to alter the payment application. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-001 SEC-008 SEC-009 SEC-014 SEC-015	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentD&M: unauthorized access and impact Disclosed: 2026-06-12 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The notice does not establish all entry, timing and extraction details; unresolved claims remain unknown. [s1] D&M: D&M：事故に関する公表資料 ↗ pp.1-2 概要 / 原因 / 現在の状況	Entry / reported weaknesses Reported fact An attacker entered through a VPN device and infected the file server with ransomware; the VPN compromise method is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-001 SEC-008 SEC-009 SEC-012 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentエン: unauthorized access and impact Disclosed: 2026-06-05 Occurred: 2026-05-26 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The notice does not establish all entry, timing and extraction details; unresolved claims remain unknown. [s1] エン: エン：事故に関する公表資料 ↗ pp.1-2 §§1-3	Entry / reported weaknesses Reported fact Credential stuffing used IDs and passwords apparently obtained elsewhere; internal credential leakage was not found. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-002 SEC-005 SEC-009 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentビジュアルアーツ: unauthorized access and impact Disclosed: 2026-06-04 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Credential acquisition, intrusion start and actual personal-data extraction scope are undisclosed. Published game assets do not prove extraction of every personal-data record. [s1] ビジュアルアーツ: ビジュアルアーツ：事故に関する公表資料 ↗ pp.1-3 §§1-6 [s2] ビジュアルアーツ: ビジュアルアーツ：事故に関する公表資料 ↗	Entry / reported weaknesses Assessment The company reports stolen cloud-storage credentials and likely extraction of internal information. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-002 SEC-004 SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component藤田医科大学病院: unauthorized access and impact Disclosed: 2026-06-03 Occurred: 2026-05-25 Employee / personal endpoint Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Actual extraction scope remains unresolved; the disclosed sequence involved an unauthorized private PC and remote-support scam. [s1] 藤田医科大学病院: 藤田医科大学病院：事故に関する公表資料 ↗ §§1-3	Entry / reported weaknesses Reported fact A personal PC held patient data against hospital rules and was remotely controlled through a support scam. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation. SEC-003 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component2りんかんイエローハット: unauthorized access and impact Disclosed: 2026-04-23 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The API abuse is established; the notice does not establish a specific IDOR or SQL injection flaw. Revised records replace the original estimate. [s1] 2りんかんイエローハット: 2りんかんイエローハット：事故に関する公表資料 ↗ 6月19日最終報 §§1-3 / 4月23日第一報	Entry / reported weaknesses Reported fact The application API was abused to retrieve membership data; the specific authorization defect or vulnerability is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-005 SEC-008 SEC-009 SEC-012 SEC-014	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentProntest: unauthorized cloud compute use Disclosed: 2026-04-09 Occurred: Date unresolved Component type unresolved Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. Product, CVE, patch timing, and intrusion start are unknown; March 24 is the detection date. [s1] Prontest: 弊社クラウド環境における不正アクセスと対応状況のお知らせ ↗ 原因 / 調査結果	Entry / reported weaknesses Assessment An exposed management server vulnerability was assessed as the likely entry point. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) The entry assessment does not establish neglected patching; inspect management exposure and cloud privileges. SEC-001 SEC-002 SEC-005 SEC-006 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentAwabank: leakage from a retained test environment Disclosed: 2026-04-03 Occurred: Date unresolved Execution environment / network boundary Evidence and unknowns AI is mentioned as a business reason for retaining the environment, not evidence of attacker AI use. Credential acquisition and detailed decisions behind retaining the environment are unknown. [s1] 阿波銀行: 情報流出に関する調査結果および再発防止策について ↗ 原因 / 原因 / 再発防止策	Entry / reported weaknesses Reported fact External unauthorized access used an ID and password against the test environment. [s1] Reported weaknesses Reported fact The bank reported missing post-development retirement and data deletion, and insufficient access controls. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect real data in nonproduction, exposure, ownership, retirement deadlines, and deletion evidence. SEC-002 SEC-005 SEC-006 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentCAMPFIRE: leaked GitHub credentials and cloud access Disclosed: 2026-04-03 Occurred: Date unresolved Credential storage / publication Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. Incomplete logs prevent a complete determination of accessed or exfiltrated information. [s1] CAMPFIRE: 不正アクセス事案にかかる調査結果について ↗ 5. 攻撃の内容について / 2. 漏えいのおそれのある情報 / 3. 個人情報漏えいの可能性	Entry / reported weaknesses Reported fact An employee mistakenly uploaded GitHub credentials to a personal development server. [s1] Other reported activity / subsequent access Assessment The company assesses that information obtained from GitHub enabled acquisition of cloud credentials. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect secret exposure in published files and cloud privileges reachable from GitHub; verify old-key revocation. SEC-004 SEC-005 SEC-006 SEC-008 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentAxios: malicious releases through publisher compromise Disclosed: 2026-03-31 Occurred: Date unresolved Dependency library Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. Publisher-account compromise method and total affected consumers are unknown. [s1] Google Threat Intelligence Group: North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package ↗ Overview / Remediation / Initial stage	Entry / reported weaknesses Reported fact A compromised publisher account was used to distribute malicious Axios 1.14.1 and 0.30.4. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Compare lockfiles with actual build environments and install execution; pinning does not make a malicious version safe. SEC-001 SEC-003 SEC-004 SEC-005 SEC-007 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentコタ: unauthorized access and impact Disclosed: 2026-03-30 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The cumulative record total spans eight datasets; overlap and actual exfiltration remain unresolved. [s1] コタ: コタ：事故に関する公表資料 ↗ pp.1-2 §§1,2,4	Entry / reported weaknesses Reported fact Investigation of PC malfunctions on March 27 identified unauthorized access; the entry route is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-003 SEC-008 SEC-009 SEC-012 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentTrivy: residual credentials used to tamper with releases and actions Disclosed: 2026-03-20 Occurred: Date unresolved CI / distribution Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. The exact late-February entry day is unknown. This record focuses on the March 19 recurrence; distribution counts are not victim-organization counts. [s1] Aqua Security / Trivy maintainers: Trivy Security incident 2026-03-19 ↗ [s2] Aqua Security: Trivy supply chain attack: ongoing investigation and remediation ↗ Attack Timeline / What Happened / What Was Affected	Entry / reported weaknesses Reported fact Aqua describes late-February token theft, credentials remaining valid after March 1 rotation, and reuse for March 19 tampering. [s2]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect verified commit pinning rather than tag names alone, and reconcile every old credential’s revocation with its consumers. SEC-001 SEC-004 SEC-005 SEC-007 SEC-008 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / component日本テレネット: unauthorized access and impact Disclosed: 2026-03-17 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The June follow-up could not be retrieved. The supplied 1,041,044 records and final extraction scope remain unverified. [s1] 日本テレネット: 日本テレネット：事故に関する公表資料 ↗ 経緯 / 現状 / 今後の対応	Entry / reported weaknesses Assessment A suspected ransomware attack encrypted servers and disrupted operations. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-008 SEC-009 SEC-012 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentNishiyama: VPN vulnerability and account abuse Disclosed: 2026-02-13 Occurred: Date unresolved Component type unresolved Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. VPN product, CVE, pre-attack patch availability, and credential origin are unknown. [s1] 西山製作所: サイバー攻撃に関するお知らせ（第3報） ↗ 調査結果 / 復旧状況 / 情報流出	Entry / reported weaknesses Reported fact The company reported abuse of a VPN vulnerability and specific account information. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed product and patch timing prevent a neglect finding. Inspect VPN deployment, credentials, and backups. SEC-001 SEC-002 SEC-005 SEC-006 SEC-009 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentジェックス: unauthorized access and impact Disclosed: 2026-02-06 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Exact intrusion start, entry method and actual exfiltration remain unconfirmed. [s1] ジェックス: ジェックス：事故に関する公表資料 ↗ 8月19日報告 §§1-5 [s2] ジェックス: ジェックス：事故に関する公表資料 ↗	Entry / reported weaknesses Reported fact Ransomware encrypted company server files; the entry route is undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-008 SEC-009 SEC-012 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentFortiCloud SSO: abuse on fully patched devices Disclosed: 2026-01-22 Occurred: Date unresolved Supplied product / appliance Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. Individual intrusion dates and impact are unknown; affected products and fixes require current vendor guidance. [s1] Fortinet: Analysis of SSO abuse on FortiOS ↗ Update Jan 22 / Update Jan 28 [s2] NIST / Fortinet: CVE-2026-24858 ↗ Description / vendor references	Entry / reported weaknesses Reported fact Unauthorized SSO logins affected fully patched devices on January 22; the issue concerns FortiCloud SSO, not all third-party SAML IdPs. [s1] Reported weaknesses Reported fact The Fortinet-submitted CVE-2026-24858 describes FortiCloud SSO authentication bypass. [s2]	Control evidence / inspection Exploitation before disclosure reported Inspection suggestions (editorial) Exploitation preceded disclosure. Inspect FortiCloud SSO use and administrator creation in addition to patching. SEC-001 SEC-002 SEC-005 SEC-006 SEC-008 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentインク革命: unauthorized access and impact Disclosed: 2025-12-18 Occurred: 2025-04-08 Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. Prior patch availability and the exact initial entry mechanism are undisclosed. The same 24,166 customers appear in both personal-data and card-data categories. [s1] インク革命: インク革命：事故に関する公表資料 ↗ §§1-2,5 [s2] インク革命: インク革命：事故に関する公表資料 ↗	Entry / reported weaknesses Reported fact A system vulnerability was exploited to alter the payment application; product and CVE are undisclosed. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-001 SEC-005 SEC-008 SEC-009 SEC-015	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentReact2Shell: exploitation after disclosure Disclosed: 2025-12-15 Occurred: Date unresolved Dependency library Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. This is a campaign record; individual intrusion dates and reasons for delayed patching are unknown. [s1] Microsoft: Defending against CVE-2025-55182 (React2Shell) ↗ Analyzing CVE-2025-55182 exploitation activity [s2] React: Critical Security Vulnerability in React Server Components ↗ Critical Security Vulnerability	Entry / reported weaknesses Reported fact Microsoft observed compromised devices across organizations; successful exploitation also included red-team assessments. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Patch information available Reported fact React disclosed the vulnerability and fixes on December 3. [s2] Individual entry dates and reasons for not patching are unknown. Inspection suggestions (editorial) Compare deployed RSC and framework versions with current advisories; inspect compromise traces and credential use after patching. SEC-001 SEC-005 SEC-006 SEC-008 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentロジックベイン: unauthorized access and impact Disclosed: 2025-12-08 Occurred: Date unresolved Component type unresolved Evidence and unknowns The reviewed disclosures do not establish attacker use of AI. The VPN/ransomware route is reported as an assessment; product and precise access mechanism are undisclosed. Published records are a subset of potentially affected people. [s1] ロジックベイン: ロジックベイン：事故に関する公表資料 ↗ 第4報 §§1-3,6	Entry / reported weaknesses Assessment Investigators infer that intrusion through VPN preceded ransomware execution. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules. SEC-001 SEC-002 SEC-003 SEC-008 SEC-009 SEC-012 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentMixpanel: smishing and analytics-data export affecting OpenAI users Disclosed: 2025-11-26 Occurred: Date unresolved Component type unresolved Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. Exact entry mechanics, initial access date, and victim count are unspecified. November 8 and 9 are provider-specific detection/awareness dates rather than assigned entry dates. [s1] OpenAI: What to know about a recent Mixpanel security incident ↗ Mixpanel: introduction / OpenAI: What happened / December 19 clarification / What this means for you [s2] Mixpanel: Our response to a recent security incident ↗ Mixpanel: introduction / OpenAI: What happened	Entry / reported weaknesses Reported fact Mixpanel dates smishing detection to November 8; OpenAI reports export of a dataset containing analytics data from Mixpanel. [s1][s2] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect resistance to SMS-led fake logins and session revocation, plus analytics identifiers, export permissions, and retention. SEC-002 SEC-003 SEC-005 SEC-008 SEC-009 SEC-012	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentPostman: poisoned dependencies exposed CI publishing authority Disclosed: 2025-11-24 Occurred: Date unresolved Dependency library Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. This record covers Postman packages rather than the whole campaign. Source timestamps use PT; an initial-entry UTC date is not assigned here. [s1] Postman: Root Cause Analysis: Shai-Hulud 2.0 ↗ How did it happen? / What happened? [s2] Postman: Shai-Hulud 2.0 npm supply-chain attack ↗	Entry / reported weaknesses Reported fact GitHub Actions installed infected AsyncAPI packages; a publishing token could publish to 17 packages lacking the disallow-tokens/two-factor setting. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect lockfiles, frozen installs, CI publishing authority, and long-lived tokens; lockfiles alone do not establish dependency safety. SEC-001 SEC-004 SEC-005 SEC-007 SEC-008 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentGainsight integration: old OAuth tokens reused against customer environments Disclosed: 2025-11-20 Occurred: 2025-10-22 Service design / controls Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. The original source and leakage date are unknown; 2025 reuse does not establish a new breach of Gainsight itself. [s1] Gainsight: Salesforce–Gainsight Connected App Incident ↗ [s2] Gainsight: How We Accelerated a Year of Security Work in Weeks ↗ Analyzing the Token Usage / Analyzing the Token Origin / At the Root of the Issue [s3] Gainsight（Mandiant調査要約）: Mandiant Investigation Summary ↗ 冒頭の調査結論（2025-12-05時点）	Entry / reported weaknesses Reported fact Gainsight reports token validation on October 22 and customer Salesforce API calls on November 16–19, without corresponding recent access to Gainsight systems. [s2] Reported weaknesses Reported fact Even the newest token dated to August 2023. Investigators could not identify the leak source; Gainsight identifies long-lived validity as a systemic issue. [s2]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect OAuth lifetimes, refresh-token reuse controls, and legacy revocation evidence even when the leak source is unknown. SEC-002 SEC-005 SEC-008 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentClaude Code: attacker misuse in a multi-organization intrusion campaign Disclosed: 2025-11-13 Occurred: Date unresolved Component type unresolved Evidence and unknowns Anthropic reports attacker use of Claude Code; this does not establish unavoidable victim vulnerabilities or a population-wide increase in AI attacks. Victim names, vulnerabilities, CVEs, and precise entry dates are undisclosed; target count is not victim count, and autonomy assessments are the investigator’s interpretation. [s1] Anthropic: Disrupting an AI-orchestrated cyber espionage campaign ↗ Introduction / How the cyberattack worked / How the cyberattack worked	Entry / reported weaknesses The initial entry path is not established. A specific management or implementation weakness is not established. Other reported activity / subsequent access Reported fact Human operators selected targets and disguised fragmented tasks as defensive testing; Anthropic describes AI assistance through reconnaissance and exfiltration. [s1]	Control evidence / inspection Insufficient evidence Inspection suggestions (editorial) Victim-specific entry causes are unspecified; inspect credential reach, access logs, and permissions of AI operated in your own environment. SEC-005 SEC-008 SEC-009 SEC-011	AI involvementReported fact Use observed in attacks Anthropic reports attacker use of Claude Code; this does not establish unavoidable victim vulnerabilities or a population-wide increase in AI attacks.
Record / componentQUICK: work credentials leaked from a personal device Disclosed: 2025-11-04 Occurred: Date unresolved Employee / personal endpoint Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. The affected cloud service and full scope of work-information exposure are not disclosed. [s1] QUICK: 不正アクセスに関するお知らせ ↗ 本文：感染と不正アクセス / 本文：影響範囲	Entry / reported weaknesses Reported fact QUICK disclosed credential leakage from an infected personal PC and access to the affected account. [s1] A specific management or implementation weakness is not established.	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect conditions for personal-device access, endpoint management, and session revocation. SEC-002 SEC-003 SEC-005 SEC-008 SEC-009	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.
Record / componentASKUL: access through an MFA exception Disclosed: 2025-10-19 Occurred: Date unresolved Component type unresolved Evidence and unknowns The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence. Credential theft origin is unresolved; the report found no evidence that the VPN vulnerability was exploited. [s1] ASKUL: ランサムウェア攻撃の影響調査結果および安全性強化に向けた取り組みのご報告（第13報） ↗ p.4 §6(1) 不正アクセス / p.3 §4-2 / p.4 §6(2)・(3) / p.4 §6(1) 調査により判明した事項	Entry / reported weaknesses Reported fact A contractor account was misused; the original credential leak remains unresolved. [s1] Reported weaknesses Reported fact Some servers lacked EDR and continuous monitoring; encrypted or deleted backups impeded recovery. [s1]	Control evidence / inspection Operational controls to inspect Inspection suggestions (editorial) Inspect MFA exceptions and contractor privileges, plus protected backups and restoration tests. SEC-002 SEC-003 SEC-005 SEC-008 SEC-009 SEC-013	AI involvementUnknown Use unknown The cited sources do not establish use; this does not establish non-use.

Incident database

Find causes and responses by organization or CVE. Each record includes sources, evidence status, and unresolved questions.

Organization, CVE, keyword

Filter by period, cause, and outcome

Disclosure period2025-10-19 — 2026-10-19Cause categoryOutcome

1–12 of 134 recordsNewest disclosure first

Disclosed 2026-10-14Cause unresolved / undisclosed

Medley at-link: unauthorized access to a medical booking platform

An external report on October 11 led to confirmation of unauthorized access; service stopped late October 14. Potential exposure covers up to 787 medical institutions, not 787 patients.

Sources: メドレー / 四条烏丸レディースクリニック· 4 rules

Disclosed 2026-10-13Cause unresolved / undisclosed

SpeeCAN RAIDEN: unauthorized access affecting disaster and emergency messaging

Suspicious activity was detected on October 11. About 3.136 million disaster-messaging email addresses may be exposed; a follow-up also describes potential NET119 and 119RAIDEN impact.

Sources: アルカディア· 4 rules

Disclosed 2026-10-09Implementation

Anthropic: unintended real-server command execution during evaluations

Anthropic reported a model exploiting a university tool during evaluation to run a calculation on a real server. This concerns evaluation and internal-use overreach, not criminal AI attribution.

Sources: Anthropic· 4 rules

Disclosed 2026-10-09Implementation

skyticket bus: automated access to reservation pages without login

Reservation pages accessible without login were mechanically viewed on August 3–October 1. About 12,000 reservations are affected; the number of people is higher when companions are included.

Sources: アドベンチャー· 3 rules

Disclosed 2026-10-09Cause unresolved / undisclosed

skyticket: vulnerability exploitation in a business-management system

A business-system vulnerability was exploited on September 20. Exposure affects 17,780 records including refund-account details; duplicates are included and some counts remain under investigation.

Sources: アドベンチャー· 4 rules

Disclosed 2026-10-08Implementation

Commune: member data leaked through invitation and administrator impersonation

The provider reported impersonation through system flaws, an estimated 307,000 affected members including staff and demo accounts, and further abuse of a route left available during maintenance.

Sources: コミューン· 4 rules

Disclosed 2026-10-08Credentials

hi-ho: unauthorized customer login using information obtained through solicitation

The company confirmed impersonation using solicited information, reported 38,509 affected contracts rather than people, and ended login using phone number, postal code and birth date.

Sources: ハイホー· 4 rules

Disclosed 2026-10-08Cause unresolved / undisclosed

skyticket: server intrusion and retained payment-log exposure

About 14.64 million records leaked, including about 4.13 million with hashed passwords. A follow-up corrected the earlier exclusion of card data, reporting historical card information for up to 6,140 people.

Sources: アドベンチャー· 4 rules

Disclosed 2026-10-07Cause unresolved / undisclosed

HIS Thailand: file-server intrusion disclosed in 2026

Following detection in December 2025 and a file review, HIS disclosed possible exposure of passport and allergy data for up to 627 people in October 2026.

Sources: エイチ・アイ・エス· 4 rules

Disclosed 2026-10-07Cause unresolved / undisclosed

IDCF Cloud: ransomware outage and data-recovery impact

An October 7 ransomware outage affected 495 organizations. The provider expected recovery in affected zones to depend on customers’ own backups; entry remained under investigation.

Sources: IDCフロンティア· 4 rules

Disclosed 2026-10-06Supply chain / CI / Cause unresolved / undisclosed

Pharma DIGITAL: unauthorized access to an outsourced member database

Operator Iyaku Joho Net reported unauthorized database access. Medical-professional and employee data may have been viewed or taken; investigation continues.

Sources: 旭化成セラピューティクス· 4 rules

Disclosed 2026-10-06Cause unresolved / undisclosed

MrMax: software-function abuse leads to member-data leakage

MrMax confirmed server intrusion and some member-data leakage. The maximum potential scope is 1,735,154 people; the confirmed leaked-person count is unspecified.

Sources: ミスターマックス· 4 rules

Inspection rules for your environment

Editorial inspection guides derived from incidents. Each rule explains when it applies and where to look. Keep results unverified when evidence is missing.

Give your usual AI an inspection request.

Start an AI inspection