Security Knowledge
← Incident database

benefit-one-tenant-export-2026 · Disclosed 2026-09-30

ベネフィット・ワン: unauthorized access and impact

An export-condition defect included other tenants' employee data. A problem recognized in October 2025 had not been properly remediated. Affected data covers 2,322 organizations and 13,460 people; one representative from one customer downloaded it.

Implementation

Outcome: Confirmed breach

Entry path and evidence

  • Reported fact

    An export-condition defect included other tenants' employee data. A problem recognized in October 2025 had not been properly remediated.

    [s1]p.1 §1-2
  • Reported fact

    Affected data covers 2,322 organizations and 13,460 people; one representative from one customer downloaded it.

    [s1]p.1 §1-2

Timeline

  1. Disclosure date established by the reviewed notice. [s1]

Reported response

  • Reported fact

    The recipient deleted the data and reportedly had not forwarded or copied it.

    [s1]p.1 §1-2

Evidence relevant to prevention

Operational controls to inspect

Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation.

Editorial assessment; not a determination of liability. [s1]

Unknowns and AI involvement

AI involvementUnknown

The reviewed disclosures do not establish attacker use of AI.

This disclosure does not establish attacker intrusion; an unremediated application defect is not evidence of package patch neglect.

Sources

  1. [s1] ベネフィット・ワン · Primary source

    ベネフィット・ワン：事故に関する公表資料 ↗

    Reviewed 2026-10-09