정보 유출
10월 23일 (금)오늘
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet. But those big headlines are only half the story. Stolen passwords, exposed
10월 22일 (목)어제
PHP脆弱性でいち早くサービス停止したコドモン 背景に「被害が出てからでは取り消せない」
保育・教育施設向けITサービス「コドモン」を運営するコドモンは10月22日、ITmedia NEWSの取材に対し、21日からの全サービス停止はPHPの「緊急」レベルの脆弱性2件への予防措置だったと明らかにした。不正アクセスや情報漏えいは確認されていないという。
NEC委託先への不正アクセスについてまとめてみた
2026年10月20日、NECは委託先がサイバー攻撃を受け、顧客のシステム障害と個人情報を含む情報の漏えいが生じたと公表しました。ここでは関連する情報をまとめます。 委託先の正規アカウント悪用 NECは10月20日、システム開発と保守業務を委託している企業(委託先)が9月下旬にサイバー攻撃を受け、窃取された正規アカウントの認証情報が悪用されたと公表した。これにより顧客において、不正アクセスによる被害と個人情報を含む情報の漏えいを確認したとしている(出典: 1)。NECが挙げた主な被害は2つ。1つは顧客のシステム環境への不正アクセスで、委託先の端末から正規アカウントを用いて行われ、サーバー内のフ…
10월 21일 (수)
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents. The post High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 appeared first on SecurityWeek .
FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
The FBI and cyber agencies in the UK and Germany said SafePay is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and using phishing attacks.
10월 20일 (화)
Studioへの不正アクセスについてまとめてみた
2026年10月16日、ノーコードのWebサイト制作サービス「Studio」を運営するStudioは、同社が利用するクラウド環境への第三者による不正アクセスにより、登録している顧客の情報が外部に流出した可能性があると公表しました。ここでは関連する情報をまとめます。 社内調査で発覚 Studioは、第三者がStudioの一部機能の脆弱性を悪用して同社のクラウド環境に不正にアクセスし、環境内のデータを外部から取得できる状態にしていたと公表した。この状態は10月14日にStudioが対処するまで続いていた。現時点で確認できている不正アクセスの期間は9月30日から10月1日(日本時間)。実際に第三者に…
NECの委託先にサイバー攻撃 正規アカウント悪用し顧客のサーバ暗号化、個人情報の漏えいも
NECは10月20日、システム開発・保守業務の委託先が9月下旬にサイバー攻撃を受け、その影響でNECの顧客に不正アクセスや情報漏えいの被害が出たと発表した。漏えいした情報には個人情報も含まれるという。
ソースネクストへの不正アクセスについてまとめてみた
2026年10月15日、ソースネクストは、同社が管理する会員情報に対する第三者の不正アクセスで、会員の個人情報が外部に流出したことが判明したと公表しました。ここでは関連する情報をまとめます。 会員情報取得APIの不正利用 第三者は2026年10月9日10時頃から、会員情報取得APIを不正に利用して会員情報を取得していた(出典: 3)。10月13日9時頃、社員が会員情報を管理するシステムへの不正アクセスを見つけ、ソースネクストは外部からの不正な通信を遮断するなどの緊急措置を講じて13時36分までに封じ込めを完了した(出典: 3, 5)。以後、不正アクセスは確認されていないとしている(出典: 3)…
10월 9일 (금)
デンマークのCPR登録簿への不正アクセスについてまとめてみた
2026年10月5日、デンマークの研究、教育、デジタル化省は、同国の中央個人登録(CPR)で、大量の登録者の情報に第三者が不正にアクセスしたと公表しました。ここでは関連する情報をまとめます。 民間企業の正規アクセスを悪用した情報取得 研究、教育、デジタル化省(Forsknings-, Uddannelses- og Digitaliseringsministeriet)は10月5日、CPRの管理主体であるCPR-administrationenが、第三者が民間企業の正規アクセスを悪用してCPRを照会し、約880万人の登録者の氏名、住所、CPR番号ほかに不正にアクセスしたことを確認したと発表した…
10월 7일 (수)
Angel One: 6,765,054 件のアカウント情報が流出
angelone.in / 侵害日 2023-04-01 / 漏洩データ: Bank account numbers, Dates of birth, Email addresses, Financial investments, Government issued IDs, Names, Phone numbers, Physical addresses In July 2024, the Indian stock brokerage firm Angel One confirmed that data leaked online related to a breach that occurred in April 2023 . The leaked data included 7.9M user records containing 6.8M unique email addresses, along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs) and portfolio holdings. Angel One emphasised that the breach "has no impact on client se…
10월 6일 (화)
韓国の金融機関で相次いだ不正アクセスについてまとめてみた
2026年10月1日、新韓銀行は、顧客の融資申込に関する情報が外部に流出したと公表しました。その後、他の金融機関でも情報流出の公表が相次ぎ、金融当局による金融業界全体への緊急点検の要請も行われています。ここでは関連する情報をまとめます。 複数の金融機関で情報流出 新韓銀行は10月1日、融資募集人向けのサービスから約2万5,000人の情報が流出したと公表した(出典: 8, 9)。その後、金融当局が新韓銀行の攻撃に使われたIPなどの脅威情報を金融業界全体に共有し、各社が自社の接続記録と照合する過程で、他の金融機関の被害も相次いで判明した(出典: 31)。金融委員会は10月14日の第2次緊急状況対応…
10월 2일 (금)
ApplyNowの採用管理プラットフォームへの不正アクセスについてまとめてみた
2026年9月9日、ApplyNowは、同社が提供する採用管理プラットフォームで、利用しているデータ分析ツールの脆弱性を突いた第三者による不正アクセスが発生し、個人データが外部へ漏えいした可能性があると公表しました。その後、複数の自治体や企業が、自組織の応募者や受験者の情報が対象に含まれると公表しています。ここでは関連する情報をまとめます。 データ分析ツールの脆弱性を突いた不正アクセス ApplyNowは2026年9月9日、コーポレートサイトで「当社サービスをご利用いただいているお客様への重要なお知らせとお詫び」を公表した。面接シェアリングサービス「Interview Cloud」、録画面接「…
9월 22일 (화)
LimeLeads: 17,838,396 件のアカウント情報が流出
limeleads.com / 侵害日 2019-08-01 / 漏洩データ: Email addresses, Employers, Geographic locations, Job titles, Phone numbers In 2019, the now-defunct B2B marketing leads database service LimeLeads suffered a data breach due to an exposed, unsecured Elasticsearch server. The incident exposed tens of millions of records of largely corporate contact data containing 17.8M unique email addresses, along with phone numbers, employers, job titles and geographic locations including state, city and postcode.
9월 21일 (월)
Burger King Russia: 3,155,792 件のアカウント情報が流出
burgerkingrus.ru / 侵害日 2024-08-25 / 漏洩データ: Dates of birth, Email addresses, Genders, Geographic locations, Names, Phone numbers In October 2024, news of a data breach exposing Burger King Russia customers broke following an August attack on the Mindbox marketing automation platform. The breach exposed 3.2M unique email addresses along with names, genders, dates of birth, phone numbers and approximate geolocations, with the data spanning 2018 to August 2024. Burger King Russia acknowledged the incident and advised it did not include payment or passport details.
9월 13일 (일)
Chess.com (2026): 4,653,212 件のアカウント情報が流出
chess.com / 侵害日 2026-08-03 / 漏洩データ: Email addresses, Geographic locations, Names, Usernames In August 2026, millions of records allegedly sourced from Chess.com were posted online . The data contained 7.3M rows with 4.6M unique email addresses, along with usernames, names, countries and data relating to users' Chess.com accounts. Analysis of the data suggested it had been obtained by scraping. When loaded into HIBP, 99% of the email addresses had already appeared in previous data breaches, further supporting the scraping theory. Read more about scrapes and data breaches.
9월 10일 (목)
McKesson: 6,404,340 件のアカウント情報が流出
mckesson.com / 侵害日 2026-08-21 / 漏洩データ: Dates of birth, Email addresses, Employers, Genders, Names, Personal health data, Phone numbers, Physical addresses In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published a substantial corpus of data they alleged was sourced from the company, which included 6.4M unique email addresses among other personal and corporate data attributes. The impacted data related to a range of individuals and roles, including marketing campaign recipients, patients, s…
9월 2일 (수)
Manchester Airports Group: 8,849,657 件のアカウント情報が流出
magairports.com / 侵害日 2026-08-27 / 漏洩データ: Browser user agent details, Email addresses, Geographic locations, IP addresses, Names, Phone numbers, Purchases, Vehicle registration plates In August 2026, Manchester Airports Group (MAG) disclosed a data breach impacting their services . The incident was later claimed by the FulcrumSec hacking group , who subsequently published email addresses and phone numbers relating to 8.8M customers of Manchester, Stansted and East Midlands airports. The data contained personal information relating to airport services, including vehicle registrations and parki…
9월 1일 (화)
Questel: 1,226,209 件のアカウント情報が流出
questel.com / 侵害日 2026-08-01 / 漏洩データ: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets In August 2026, the French intellectual property software and services company Questel was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published an extensive corpus of data they alleged was obtained from the company, largely comprising corporate contact information associated with sales leads, support cases and marketing activities, with 1.2M unique email addresses. The data also included names, employers and job tit…
8월 26일 (수)
Carhartt: 12,933,413 件のアカウント情報が流出
carhartt.com / 侵害日 2026-08-13 / 漏洩データ: Email addresses, Names, Phone numbers, Physical addresses In August 2026, clothing retailer Carhartt was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data allegedly obtained from the company including 12.9M unique email addresses, names, phone numbers and physical addresses. The published corpus also contained millions of synthetic records that did not relate to real individuals and were excluded from the breach.
8월 19일 (수)
Oz Hair and Beauty: 1,988,331 件のアカウント情報が流出
ozhairandbeauty.com / 侵害日 2026-08-15 / 漏洩データ: Email addresses, Geographic locations, Names, Phone numbers, Purchases In August 2026, Australian beauty retailer Oz Hair and Beauty was the target of an xpl0itrs extortion attack . The group subsequently published data allegedly obtained from the company, which included 2M unique email addresses along with names, phone numbers, geographic locations (suburb and postcode) and purchases.
8월 13일 (목)
RingCentral: 1,596,490 件のアカウント情報が流出
ringcentral.com / 侵害日 2026-07-27 / 漏洩データ: Email addresses, Names, Phone numbers, Physical addresses In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data they claimed was obtained from the platform, which included 1.6M unique email addresses along with names, physical addresses and phone numbers. In their disclosure notice , RingCentral advised that the incident affected "a limited portion of RingCentral customers" and that it was communicating directly with those aff…
8월 7일 (금)
Exact Sciences: 10,869,543 件のアカウント情報が流出
exactsciences.com / 侵害日 2026-07-15 / 漏洩データ: Dates of birth, Email addresses, Genders, Names, Personal health data, Phone numbers, Physical addresses In July 2026, Exact Sciences (now owned by Abbott Laboratories) was the target of a ShinyHunters "pay or leak" extortion campaign . The group claimed to have obtained data from the company's cancer diagnostics business, which they later published publicly. The breach contained 10.9M unique email addresses belonging to customers, patients and healthcare providers, along with names, addresses, phone numbers and health records. Abbott subsequently p…
7월 21일 (화)
Suno: 55,282,226 件のアカウント情報が流出
suno.com / 侵害日 2025-11-25 / 漏洩データ: Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases In November 2025, AI music generation tool Suno suffered a data breach that later came to light in July the following year . The data contained over 55M unique email addresses. Phone numbers were also present where they had been used as the sign-up method. Although representing a small portion of the corpus, the breach also included tens of thousands of Stripe records relating to purchases, containing names, physical addresses, purchase amounts and partial credit c…
7월 20일 (월)
Paidwork: 23,272,765 件のアカウント情報が流出
paidwork.com / 侵害日 2026-03-29 / 漏洩データ: Bank account numbers, Dates of birth, Device information, Education levels, Email addresses, Financial transactions, Genders, IP addresses, Names, Passwords, Personal interests, Phone numbers, Physical addresses, Profile photos In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale . Almost 11GB of data allegedly obtained from the platform was subsequently posted publicly in July and contained over 23M unique email addresses. The breach also included a broad range of other data relatin…
7월 15일 (수)
Goose Creek: 6,574,121 件のアカウント情報が流出
goosecreek.com / 侵害日 2026-06-09 / 漏洩データ: Email addresses, Names, Phone numbers, Physical addresses, Purchases In June 2026, a party claiming to have access to data from Goose Creek Candle Company sent emails to a number of the company's customers , claiming the company had a security vulnerability and suffered a data breach. The data was subsequently sent to Have I Been Pwned and contained 6.6M unique email addresses along with names, phone numbers, physical addresses, order IDs and total spent. The data appears to have been obtained from the company's Shopify instance. Goose Creek is aware o…
7월 4일 (토)
Moody Bible Institute: 2,303,416 件のアカウント情報が流出
moody.edu / 侵害日 2026-06-15 / 漏洩データ: Dates of birth, Email addresses, Genders, Marital statuses, Names, Phone numbers, Physical addresses In June 2026, Moody Bible Institute was targeted by a ShinyHunters "pay or leak" extortion campaign . Over 2.3M unique email addresses and other personal data were later published publicly, including names, physical addresses, phone numbers, dates of birth and other information relating to donors, supporters, students and alumni. In their disclosure notice , Moody advised that they had "engaged both internal and external cybersecurity experts to thoroughly i…
6월 29일 (월)
Sysco: 2,691,852 件のアカウント情報が流出
sysco.com / 侵害日 2026-06-15 / 漏洩データ: Customer feedback, Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Usernames In June 2026, the food distribution company Sysco was targeted by a ShinyHunters "pay or leak" extortion campaign . Data was subsequently published containing 2.7M unique email addresses belonging to staff and customers. The data also contained largely corporate contact information including names, phone numbers, physical addresses, internal job titles, and customer feedback.
6월 24일 (수)
Madison Square Garden Sports: 9,796,738 件のアカウント情報が流出
msgsports.com / 侵害日 2026-06-05 / 漏洩データ: Customer service records, Email addresses, Names, Phone numbers, Physical addresses In June 2026, the sports and entertainment company Madison Square Garden Sports was the target of a ShinyHunters "pay or leak" extortion campaign . The group later published the alleged data, which included almost 10M unique email addresses spanning staff and customers, along with extensive personal, employment and customer relationship information.