INCIDENTS → INSPECTION
What happened, how access was gained, and where to look in your own environment. A ledger connecting primary evidence to practical inspection steps.
A curated database of 31 domestic and international records disclosed during 2025-10-02–2026-10-02, plus 10 earlier records. Evaluation incidents and multi-organization campaigns are included; counts are not organization totals or representative incident statistics. Read the year review and collection scope ↗
31 / 41 records · newest disclosure first
Temairazu confirmed unauthorized system access. Suspicious reservation messages to guests were reported, while their relationship to the intrusion and data-access scope remained under investigation.
Sources: 手間いらず · 5 rules
Ransomware on group servers affected some business systems; rail operations and information leakage were not reported as affected at disclosure.
Sources: 京王電鉄 · 2 rules
The company confirmed leakage of 6.6 million member records, including 1.6 million identity-document images, covering withdrawn members and incomplete applicants.
Sources: タイムズモビリティ · 5 rules
An upload-server vulnerability enabled access to user records and image metadata. The reported user records include anonymous users and registered-email users.
Sources: Helpfeel · 7 rules
Unauthorized access used a known VPN vulnerability in a GSS maintenance environment. The patch was unapplied, with about 246,000 records potentially leaked.
Sources: デジタル庁 · 6 rules
Unit 42 reported an intrusion that expanded from an exposed service to cloud systems through repository secrets, with LLM calls observed during the attack.
Sources: Palo Alto Networks Unit 42 · 7 rules
The Rust team reported malicious dependencies in updates to arrayref and related crates. Build-time code retrieved a payload; malicious versions were removed.
Sources: Rust Project · 6 rules
Sakura disclosed billing-database access spanning April 2023 to March 2026 in August 2026, with potential information leakage reported separately from its hosting incident.
Sources: さくらインターネット · 6 rules
VOISING confirmed leakage of about 170,000 records via a BI vulnerability and reported that an available pre-intrusion patch had not been applied.
Sources: VOISING · 6 rules
Sakura disclosed unauthorized access and malware on a hosting management server. Its relationship to a separate billing-database intrusion is unestablished.
Sources: さくらインターネット · 5 rules
Metabase investigated abnormal API-key activity on August 3 and confirmed zero-day exploitation. Input handling and ORM behavior enabled administrator sessions and data access.
Sources: Metabase · 6 rules
Anthropic disclosed three incidents of evaluation models reaching external organizations. Misconfigured connectivity enabled abuse of weak authentication and implementation flaws.
Sources: Anthropic · 9 rules
NIDEK reported exploitation of website software. Member and inquiry data may have been accessed; the cited FAQ does not confirm external disclosure.
Sources: NIDEK · 4 rules
An OpenAI prototype under evaluation used restricted package connectivity to reach external systems. OpenAI reported zero-day exploitation, credential theft, and intrusion into Hugging Face.
Sources: OpenAI / Hugging Face · 7 rules
Aflac reported missed detection of ordinary-looking requests and inadequate bulk-query controls. Personal information of about 4.4 million customers leaked, including bank-account information for about 220,000 of them.
Sources: アフラック生命保険 · 4 rules
A software vulnerability exploited from May 16 led to ISP data leakage. KDDI says the vendor was unaware of it when detected on June 17.
Sources: KDDI · 5 rules
Unauthorized cloud access enabled compute misuse. The company assesses an exposed management server vulnerability as the likely cause.
Sources: Prontest · 5 rules
A test environment due for retirement and data deletion remained for AI-related verification. Credential-based unauthorized access led to reported customer and shareholder data leakage.
Sources: 阿波銀行 · 5 rules
GitHub credentials mistakenly uploaded to a personal development server were misused. CAMPFIRE confirmed internal cloud administration access and querying of one personal-information record.
Sources: CAMPFIRE · 5 rules
Google investigators reported a compromised Axios publisher account and releases carrying a malicious dependency whose install script distributes cross-platform backdoors.
Sources: Google Threat Intelligence Group · 6 rules
Aqua reports privileged-token theft through GitHub Actions misconfiguration, incomplete initial rotation, and renewed release tampering. Existing action tags were redirected to malicious commits.
Sources: Aqua Security / Trivy maintainers / Aqua Security · 6 rules
The company reported entry using a VPN vulnerability and account information, with encryption and leakage addressed by VPN removal and environment reinitialization.
Sources: 西山製作所 · 6 rules
Fortinet disclosed FortiCloud SSO abuse affecting fully patched FortiOS and attacker-created administrator accounts.
Sources: Fortinet / NIST / Fortinet · 6 rules
Microsoft reported hundreds of machines compromised through unauthenticated RSC code execution. The vulnerability and fixes were disclosed on December 3.
Sources: Microsoft / React · 5 rules
Mixpanel reported a smishing incident; OpenAI reported export of user analytics data from the supplier. OpenAI says passwords, API keys, and chat content were not involved.
Sources: OpenAI / Mixpanel · 6 rules
A CI build without an appropriate lockfile installed infected dependencies, enabling misuse of an npm publishing token. Postman reported 17 hijacked packages, with production apps and customer data unaffected.
Sources: Postman · 6 rules
Attackers tested old integration tokens and used still-valid credentials against Salesforce APIs. The original acquisition path is unidentified.
Sources: Gainsight · 4 rules
Anthropic reported attacker use of Claude Code for reconnaissance, exploit development, credential harvesting, and exfiltration. About 30 organizations were targeted, with success reported at a small number.
Sources: Anthropic · 4 rules
A virus on an employee’s personal PC leaked work credentials, followed by unauthorized access to that employee’s account.
Sources: QUICK · 5 rules
Stolen credentials for a contractor administrator account without MFA enabled a ransomware intrusion.
Sources: ASKUL · 6 rules
Discord reported unauthorized access to support information through a provider compromise. About 70,000 users potentially had identity-document photos exposed; this is not a confirmed image-leak count.
Sources: Discord · 3 rules
These are editorial inspection guides derived from incidents. Check applicability first; preserve unverified results when evidence is missing.