komatsu-user-directory-exposure-2026 · Disclosed 2026-06-16
小松製作所: data exposure and authorization boundaries
Design, configuration and operational defects allowed authorized users to view personal information beyond the necessary scope. The first notice covered 139,302 people; further reviews found scopes of 214,916, 29,621, 86,015 and 46,445. Overlap prevents addition; the data was not publicly accessible on the internet.
Outcome: Exposure / potential leak. Third-party theft unconfirmed.
Entry path and evidence
- Reported fact
Design, configuration and operational defects allowed authorized users to view personal information beyond the necessary scope.
[s1]9月15日 §§1-3 / 6月16日 §§1-5 - Reported fact
The first notice covered 139,302 people; further reviews found scopes of 214,916, 29,621, 86,015 and 46,445. Overlap prevents addition; the data was not publicly accessible on the internet.
[s1]9月15日 §§1-3 / 6月16日 §§1-5
Timeline
Disclosure date established by the reviewed notice. [s1]
Reported response
- Reported fact
Permissions were changed and files hidden to stop unnecessary access.
Cause and mitigation hypotheses
Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.
Evidence relevant to prevention
Operational controls to inspect
Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation.
Editorial assessment; not a determination of liability. [s1]
Unknowns and AI involvement
The reviewed disclosures do not establish attacker use of AI.
The exact start date and overlap among affected user groups are unknown; additional scopes cannot be summed.
Sources
[s1] 小松製作所 · Primary source
小松製作所：事故に関する公表資料 ↗Reviewed 2026-10-09
[s2] 小松製作所 · Primary source
小松製作所：事故に関する公表資料 ↗Reviewed 2026-10-09