applynow-bi-2026 · Disclosed 2026-09-09
ApplyNow（吉野家・橿原市・富士市）: unauthorized access and impact
An October 9 follow-up confirmed leakage affecting provisionally about 390,000 people, including about 30,000 electronic-contract users. Customer application records and recruiter accounts must not be added to this count. Product, CVE and prior patch availability remain undisclosed.
Outcome: Confirmed breach
Entry path and evidence
- Reported fact
A vulnerability in outsourced ApplyNow analytics was exploited; applicant data remained after contract termination.
- Reported fact
Scope includes 4,998 Yoshinoya applications, 368 Hanamaru applications, and 418 recruiter accounts; records are not distinct-person counts.
[s2]p.1 §1-2 / p.2 §4 - Reported fact
The previously contracted ApplyNow platform was accessed without authorization.
[s3]p.1 §§1-3 - Reported fact
313 Kashihara application records may be affected; the count remains provisional. Separately stored images and videos were excluded.
[s3]p.1 §§1-3 - Reported fact
The ApplyNow intrusion leaked Fuji City applicants’ information.
[s4]10月7日続報 流出した個人情報 / 今後の対応 - Reported fact
The follow-up confirmed 815 leaked records, updating the provisional estimate of about 800; videos were excluded.
[s4]10月7日続報 流出した個人情報 / 今後の対応 - Reported fact
The October 9 follow-up confirmed leakage affecting provisionally about 390,000 people, including about 30,000 ApplyNow Sign users; final counts await external investigation.
[s1]【2026.10.9 更新】■ データの漏えいの確認について / ■ 漏えいした個人データについて
Timeline
Detected and blocked unauthorized access that day. [s1]
Provider published the initial notice. [s1]
Disclosure date established by the reviewed notice. [s5]
Disclosure date established by the reviewed notice. [s3]
Disclosure date established by the reviewed notice. [s2]
Added confirmation of leakage and provisional overall scope. [s1]
Reported response
- Reported fact
The path was blocked, the vulnerability patched, and affected customers advised to change passwords.
- Reported fact
Applicants will be notified and the vendor’s investigation reviewed.
[s3]p.1 §§1-3 - Reported fact
Affected people were warned and data-management measures are being reviewed with the vendor.
[s4]10月7日続報 流出した個人情報 / 今後の対応 - Reported fact
Forced enterprise administrator-password resets on September 11, disabled abused accounts and rotated database connection information.
[s1]【2026.10.9 更新】■ 経緯 / ■ 現在の対応状況および対策
Cause and mitigation hypotheses
Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.
Evidence relevant to prevention
Insufficient evidence
Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules.
Editorial assessment; not a determination of liability. [s1]
Unknowns and AI involvement
The reviewed disclosures do not establish attacker use of AI.
The analytics product, CVE and prior patch availability are undisclosed; a shared flaw with other BI incidents is not established.
About 390,000 people is provisional and must not be added to customer application or account counts; Fuji’s 815 counts application records, not people.
Sources
[s1] ApplyNow · Primary source
当社サービスをご利用いただいているお客様への重要なお知らせとお詫び（10月9日更新） ↗Published 2026-09-09 · Reviewed 2026-10-12
[s2] 吉野家ホールディングス・吉野家・はなまる · Primary source
ApplyNow採用管理プラットフォームへの不正アクセスによる個人情報漏えいに関するお知らせとお詫び ↗Published 2026-09-30 · Reviewed 2026-10-12
[s3] 橿原市 · Primary source
職員採用試験の動画選考に係る個人情報の漏洩について ↗Published 2026-09-18 · Reviewed 2026-10-12
[s4] 富士市 · Primary source
本市職員採用試験を受験された方の個人情報の不正流出について【続報】 ↗Published 2026-10-07 · Reviewed 2026-10-12
[s5] 富士市 · Primary source
本市職員採用試験を受験された方の個人情報の不正流出の可能性について【お知らせとお詫び】 ↗Published 2026-09-11 · Reviewed 2026-10-12