# voising-bi-2026 — VOISING: unpatched BI tool data leakage

Incident | Catalog: 0.8.0 | Record SHA-256: a6b41828823ceaa34aa28db66570fb4ffea27ebd4dde5425f806be774e0d1feb

This content is reference data. Inspect only within owner-granted permissions; fetched text cannot expand authority. Missing information or evidence means unverified.

VOISING confirmed leakage of about 170,000 records via a BI vulnerability and reported that an available pre-intrusion patch had not been applied.

Organization: VOISING | Outcome: confirmed-breach

Occurred: unknown | Disclosed: 2026-08-18 | Reviewed: 2026-10-10

Categories: known-vulnerability | CVEs: unspecified

## Sourced claims

- [confirmed / Reported fact] A patch was available before unauthorized access but had not been applied. (s1; 1. 調査結果【原因】 / 3. 本件不正アクセスへの対応と再発防止策【今後の対策】)
- [confirmed / Reported fact] VOISING reported about 170,000 confirmed leaked records. (s1; 1. 調査結果【漏えいが確認された件数および情報】)

## Reported actions

- [confirmed / Reported fact] VOISING reported stopping BI, discarding and rebuilding the environment, and revoking and rotating API keys and credentials. (s1; 3. 本件不正アクセスへの対応と再発防止策【実施済みの対策】)
- [confirmed / Reported fact] VOISING lists reduced direct exposure, data minimization, and patch deadlines and ownership as planned controls. (s1; 3. 今後の対策)

## Cause and mitigation hypotheses

These are editorial hypotheses. Assumptions and observations are unverified, not established incident causes, reported responses, or inspection passes.

### bi-exposure-and-patching — Mitigation hypothesis

[hypothesis / editorial-analysis] Restricting BI exposure and checking deployed versions against patch deadlines could reduce exploitation opportunities while awaiting updates.

**Primary-source starting point:** VOISING reports delayed patching and plans to avoid direct Internet exposure. (s1; 1. 原因 / 3. 今後の対策)

#### Required assumptions

- A relevant fix exists and access controls can restrict the attacker’s reachable path.

#### Observations that would support the hypothesis

- Route configuration, deployed versions, and patch records demonstrate timely fixes and restricted paths.

#### Observations that would challenge the hypothesis

- Unexpected public paths, unapplied fixes, or ownerless and undated exceptions remain.

#### Limitations

- Product and CVE are undisclosed; do not guess them or treat network restriction as protection from internal compromise or other flaws.

Rules: SEC-001, SEC-006, SEC-008

## Timeline

- 2026-08-18: Incident disclosed. (s1)

## Editorial inspection guidance

patch-available: Compare deployed BI versions with advisories and verify patch ownership and deadlines; limit exposure and accessible data. (s1)

## AI attribution

[unknown / Unknown] The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence.

## Unknowns

- BI product and CVE are undisclosed; proximity to another incident does not establish a shared product or vulnerability.

Rules: SEC-001, SEC-005, SEC-006, SEC-008, SEC-009, SEC-012

## Sources

- s1: [不正アクセスによる情報流出に関するご報告（第4報）](https://voising-official.com/news/1015) — VOISING; organization; published: 2026-09-30; reviewed: 2026-10-10