情報漏洩
10月21日(水)昨日
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents. The post High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 appeared first on SecurityWeek .
FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
The FBI and cyber agencies in the UK and Germany said SafePay is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and using phishing attacks.
10月20日(火)
Studioへの不正アクセスについてまとめてみた
2026年10月16日、ノーコードのWebサイト制作サービス「Studio」を運営するStudioは、同社が利用するクラウド環境への第三者による不正アクセスにより、登録している顧客の情報が外部に流出した可能性があると公表しました。ここでは関連する情報をまとめます。 社内調査で発覚 Studioは、第三者がStudioの一部機能の脆弱性を悪用して同社のクラウド環境に不正にアクセスし、環境内のデータを外部から取得できる状態にしていたと公表した。この状態は10月14日にStudioが対処するまで続いていた。現時点で確認できている不正アクセスの期間は9月30日から10月1日(日本時間)。実際に第三者に…
NECの委託先にサイバー攻撃 正規アカウント悪用し顧客のサーバ暗号化、個人情報の漏えいも
NECは10月20日、システム開発・保守業務の委託先が9月下旬にサイバー攻撃を受け、その影響でNECの顧客に不正アクセスや情報漏えいの被害が出たと発表した。漏えいした情報には個人情報も含まれるという。
Assurance Retraite: 70,372 件のアカウント情報が流出
lassuranceretraite.fr / 侵害日 2024-09-01 / 漏洩データ: Dates of birth, Email addresses, Family members' names, Government issued IDs, Income levels, Marital statuses, Names, Phone numbers, Physical addresses In September 2024, the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries . The data included 70k unique email addresses along with names, dates of birth, physical addresses, phone numbers, income levels, marital statuses, French social security numbers (NIR) and contact details of relatives or other nominated contacts. In…
ソースネクストへの不正アクセスについてまとめてみた
2026年10月15日、ソースネクストは、同社が管理する会員情報に対する第三者の不正アクセスで、会員の個人情報が外部に流出したことが判明したと公表しました。ここでは関連する情報をまとめます。 会員情報取得APIの不正利用 第三者は2026年10月9日10時頃から、会員情報取得APIを不正に利用して会員情報を取得していた(出典: 3)。10月13日9時頃、社員が会員情報を管理するシステムへの不正アクセスを見つけ、ソースネクストは外部からの不正な通信を遮断するなどの緊急措置を講じて13時36分までに封じ込めを完了した(出典: 3, 5)。以後、不正アクセスは確認されていないとしている(出典: 3)…
10月18日(日)
Gîtes de France: 117,574 件のアカウント情報が流出
gites-de-france.com / 侵害日 2026-05-16 / 漏洩データ: Booking details, Email addresses, Names, Phone numbers, Physical addresses In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches. The incident exposed hundreds of thousands of customer records, including 118k unique email addresses alongside names, phone numbers, postal addresses and booking details.
10月14日(水)
Crunchbase: 559,908 件のアカウント情報が流出
crunchbase.com / 侵害日 2026-01-22 / 漏洩データ: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Social media profiles In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters "pay or leak" extortion attempt . Data allegedly obtained from the company was subsequently published publicly and included 560k unique email addresses, largely belonging to leads and business contacts. Other data included names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. Crunchbase later confirmed that a threat ac…
10月13日(火)
Sharecare: 318,185 件のアカウント情報が流出
sharecare.com / 侵害日 2026-08-12 / 漏洩データ: Dates of birth, Email addresses, Employers, Genders, Government issued IDs, Job titles, Marital statuses, Names, Phone numbers, Physical addresses In August 2026, the digital health company Sharecare was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consisted of B2B sales and marketing records with names, physical addresses, phone numbers, job titles and employers. The data also included a small…
10月9日(金)
Neogen: 435,963 件のアカウント情報が流出
neogen.com / 侵害日 2026-08-29 / 漏洩データ: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Salutations In August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters "pay or leak" extortion attempt . The group later published data it claimed had been obtained from Neogen. The data consisted largely of corporate contact records and included 436k unique email addresses from mailing lists, employee records and other contacts.
デンマークのCPR登録簿への不正アクセスについてまとめてみた
2026年10月5日、デンマークの研究、教育、デジタル化省は、同国の中央個人登録(CPR)で、大量の登録者の情報に第三者が不正にアクセスしたと公表しました。ここでは関連する情報をまとめます。 民間企業の正規アクセスを悪用した情報取得 研究、教育、デジタル化省(Forsknings-, Uddannelses- og Digitaliseringsministeriet)は10月5日、CPRの管理主体であるCPR-administrationenが、第三者が民間企業の正規アクセスを悪用してCPRを照会し、約880万人の登録者の氏名、住所、CPR番号ほかに不正にアクセスしたことを確認したと発表した…
10月8日(木)
CyrusOne: 373,460 件のアカウント情報が流出
cyrusone.com / 侵害日 2026-08-05 / 漏洩データ: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets In August 2026, data centre operator CyrusOne was the target of a ShinyHunters "pay or leak" extortion attempt . The group subsequently published data allegedly obtained from the company, which included 373k unique email addresses across records relating to users, sales leads and CyrusOne employees. The data largely consisted of corporate contact information, including names, physical addresses, phone numbers and job titles. It also included support tickets…
10月7日(水)
Double Counter: 274,922 件のアカウント情報が流出
doublecounter.gg / 侵害日 2026-10-04 / 漏洩データ: Email addresses, Geographic locations, Names, Usernames In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool . In its disclosure notice, Double Counter advised that attackers gained access to a subset of its data. A corpus of data was subsequently published publicly and contained 275k unique email addresses and Discord usernames. A small number of records belonging to paying subscribers whose purchases were processed via Stripe were also present and i…
Angel One: 6,765,054 件のアカウント情報が流出
angelone.in / 侵害日 2023-04-01 / 漏洩データ: Bank account numbers, Dates of birth, Email addresses, Financial investments, Government issued IDs, Names, Phone numbers, Physical addresses In July 2024, the Indian stock brokerage firm Angel One confirmed that data leaked online related to a breach that occurred in April 2023 . The leaked data included 7.9M user records containing 6.8M unique email addresses, along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs) and portfolio holdings. Angel One emphasised that the breach "has no impact on client se…
10月6日(火)
韓国の金融機関で相次いだ不正アクセスについてまとめてみた
2026年10月1日、新韓銀行は、顧客の融資申込に関する情報が外部に流出したと公表しました。その後、他の金融機関でも情報流出の公表が相次ぎ、金融当局による金融業界全体への緊急点検の要請も行われています。ここでは関連する情報をまとめます。 複数の金融機関で情報流出 新韓銀行は10月1日、融資募集人向けのサービスから約2万5,000人の情報が流出したと公表した(出典: 8, 9)。その後、金融当局が新韓銀行の攻撃に使われたIPなどの脅威情報を金融業界全体に共有し、各社が自社の接続記録と照合する過程で、他の金融機関の被害も相次いで判明した(出典: 31)。金融委員会は10月14日の第2次緊急状況対応…
10月2日(金)
ApplyNowの採用管理プラットフォームへの不正アクセスについてまとめてみた
2026年9月9日、ApplyNowは、同社が提供する採用管理プラットフォームで、利用しているデータ分析ツールの脆弱性を突いた第三者による不正アクセスが発生し、個人データが外部へ漏えいした可能性があると公表しました。その後、複数の自治体や企業が、自組織の応募者や受験者の情報が対象に含まれると公表しています。ここでは関連する情報をまとめます。 データ分析ツールの脆弱性を突いた不正アクセス ApplyNowは2026年9月9日、コーポレートサイトで「当社サービスをご利用いただいているお客様への重要なお知らせとお詫び」を公表した。面接シェアリングサービス「Interview Cloud」、録画面接「…
9月30日(水)
Medela: 423,947 件のアカウント情報が流出
medela.com / 侵害日 2026-09-07 / 漏洩データ: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Salutations, Support tickets In September 2026, Swiss medical device company Medela was the target of a ShinyHunters "pay or leak" extortion campaign . The data allegedly obtained in the breach was later published publicly and included 424k unique email addresses belonging predominantly to healthcare professionals, Medela staff and leads. The exposed data consisted primarily of corporate contact information, including names, physical addresses and phone numbers, with some rec…
9月22日(火)
LimeLeads: 17,838,396 件のアカウント情報が流出
limeleads.com / 侵害日 2019-08-01 / 漏洩データ: Email addresses, Employers, Geographic locations, Job titles, Phone numbers In 2019, the now-defunct B2B marketing leads database service LimeLeads suffered a data breach due to an exposed, unsecured Elasticsearch server. The incident exposed tens of millions of records of largely corporate contact data containing 17.8M unique email addresses, along with phone numbers, employers, job titles and geographic locations including state, city and postcode.
9月21日(月)
Burger King Russia: 3,155,792 件のアカウント情報が流出
burgerkingrus.ru / 侵害日 2024-08-25 / 漏洩データ: Dates of birth, Email addresses, Genders, Geographic locations, Names, Phone numbers In October 2024, news of a data breach exposing Burger King Russia customers broke following an August attack on the Mindbox marketing automation platform. The breach exposed 3.2M unique email addresses along with names, genders, dates of birth, phone numbers and approximate geolocations, with the data spanning 2018 to August 2024. Burger King Russia acknowledged the incident and advised it did not include payment or passport details.
9月13日(日)
Chess.com (2026): 4,653,212 件のアカウント情報が流出
chess.com / 侵害日 2026-08-03 / 漏洩データ: Email addresses, Geographic locations, Names, Usernames In August 2026, millions of records allegedly sourced from Chess.com were posted online . The data contained 7.3M rows with 4.6M unique email addresses, along with usernames, names, countries and data relating to users' Chess.com accounts. Analysis of the data suggested it had been obtained by scraping. When loaded into HIBP, 99% of the email addresses had already appeared in previous data breaches, further supporting the scraping theory. Read more about scrapes and data breaches.
9月10日(木)
McKesson: 6,404,340 件のアカウント情報が流出
mckesson.com / 侵害日 2026-08-21 / 漏洩データ: Dates of birth, Email addresses, Employers, Genders, Names, Personal health data, Phone numbers, Physical addresses In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published a substantial corpus of data they alleged was sourced from the company, which included 6.4M unique email addresses among other personal and corporate data attributes. The impacted data related to a range of individuals and roles, including marketing campaign recipients, patients, s…
9月2日(水)
Manchester Airports Group: 8,849,657 件のアカウント情報が流出
magairports.com / 侵害日 2026-08-27 / 漏洩データ: Browser user agent details, Email addresses, Geographic locations, IP addresses, Names, Phone numbers, Purchases, Vehicle registration plates In August 2026, Manchester Airports Group (MAG) disclosed a data breach impacting their services . The incident was later claimed by the FulcrumSec hacking group , who subsequently published email addresses and phone numbers relating to 8.8M customers of Manchester, Stansted and East Midlands airports. The data contained personal information relating to airport services, including vehicle registrations and parki…
9月1日(火)
Questel: 1,226,209 件のアカウント情報が流出
questel.com / 侵害日 2026-08-01 / 漏洩データ: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets In August 2026, the French intellectual property software and services company Questel was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published an extensive corpus of data they alleged was obtained from the company, largely comprising corporate contact information associated with sales leads, support cases and marketing activities, with 1.2M unique email addresses. The data also included names, employers and job tit…
8月26日(水)
Carhartt: 12,933,413 件のアカウント情報が流出
carhartt.com / 侵害日 2026-08-13 / 漏洩データ: Email addresses, Names, Phone numbers, Physical addresses In August 2026, clothing retailer Carhartt was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data allegedly obtained from the company including 12.9M unique email addresses, names, phone numbers and physical addresses. The published corpus also contained millions of synthetic records that did not relate to real individuals and were excluded from the breach.
8月24日(月)
NIUS: 6,090 件のアカウント情報が流出
nius.de / 侵害日 2025-07-13 / 漏洩データ: Bank account numbers, Email addresses, Names, Partial credit card data, Physical addresses, Purchases In July 2025, the German news service NIUS suffered a data breach which was subsequently leaked publicly . The data included 6k unique email addresses along with names, physical addresses and payment details for purchases including either IBANs or partial credit card data (masked card number, type and expiry).
8月22日(土)
Golf Canada: 568,972 件のアカウント情報が流出
golfcanada.ca / 侵害日 2026-05-14 / 漏洩データ: Dates of birth, Email addresses, Genders, Geographic locations, Names, Usernames In mid-2026, hundreds of thousands of user records allegedly sourced from Golf Canada began circulating via Telegram. The data included 569k unique email addresses along with names, usernames, dates of birth, genders and approximate geographic locations (city, province and postcode). It remains unclear whether the data was obtained via unintentionally exposed website features or a security vulnerability.
8月19日(水)
Oz Hair and Beauty: 1,988,331 件のアカウント情報が流出
ozhairandbeauty.com / 侵害日 2026-08-15 / 漏洩データ: Email addresses, Geographic locations, Names, Phone numbers, Purchases In August 2026, Australian beauty retailer Oz Hair and Beauty was the target of an xpl0itrs extortion attack . The group subsequently published data allegedly obtained from the company, which included 2M unique email addresses along with names, phone numbers, geographic locations (suburb and postcode) and purchases.
Fanlore: 144,520 件のアカウント情報が流出
fanlore.org / 侵害日 2026-08-06 / 漏洩データ: Email addresses, Names, Passwords, Usernames In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates . The breach resulted in the exposure of 145k unique email addresses along with usernames and passwords stored as either MD5 or PBKDF2 hashes. OTW self-submitted the exposed data to HIBP.
8月13日(木)
RingCentral: 1,596,490 件のアカウント情報が流出
ringcentral.com / 侵害日 2026-07-27 / 漏洩データ: Email addresses, Names, Phone numbers, Physical addresses In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data they claimed was obtained from the platform, which included 1.6M unique email addresses along with names, physical addresses and phone numbers. In their disclosure notice , RingCentral advised that the incident affected "a limited portion of RingCentral customers" and that it was communicating directly with those aff…
8月9日(日)
Alcon: 218,395 件のアカウント情報が流出
alcon.com / 侵害日 2026-08-01 / 漏洩データ: Email addresses, Names, Phone numbers, Physical addresses In August 2026, the Alcon eye care company was named in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data allegedly sourced from Alcon containing 218k unique email addresses along with other largely corporate B2B contact fields, including name, phone number and physical address.
8月8日(土)
Brinks Home: 732,162 件のアカウント情報が流出
brinkshome.com / 侵害日 2026-07-13 / 漏洩データ: Dates of birth, Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases In July 2026, Brinks Home was targeted in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data they alleged was taken from the company, including 732k unique email addresses and other personal information relating to leads, customers and Brinks staff such as name, phone numbers and physical addresses. The data also included purchases from Brinks along with partial credit card data (last 4 digits, card type an…
8月7日(金)
Exact Sciences: 10,869,543 件のアカウント情報が流出
exactsciences.com / 侵害日 2026-07-15 / 漏洩データ: Dates of birth, Email addresses, Genders, Names, Personal health data, Phone numbers, Physical addresses In July 2026, Exact Sciences (now owned by Abbott Laboratories) was the target of a ShinyHunters "pay or leak" extortion campaign . The group claimed to have obtained data from the company's cancer diagnostics business, which they later published publicly. The breach contained 10.9M unique email addresses belonging to customers, patients and healthcare providers, along with names, addresses, phone numbers and health records. Abbott subsequently p…
8月6日(木)
Inter-Con Security: 276,114 件のアカウント情報が流出
icsecurity.com / 侵害日 2026-06-18 / 漏洩データ: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses In June 2026, Inter-Con Security was targeted in a ShinyHunters “pay or leak” extortion campaign . The group subsequently published data it alleged was taken from the company, including 276k unique email addresses along with names, physical addresses, job titles and phone numbers. The data encompassed a combination of contacts, internal users and leads.
8月1日(土)
SplitVPN: 865,336 件のアカウント情報が流出
splitvpn.io / 侵害日 2026-07-21 / 漏洩データ: Device information, Email addresses, Geographic locations, IP addresses, Partial credit card data In July 2026, the Russian VPN service SplitVPN (previously known as NotVPN) suffered a data breach . The incident exposed millions of customer records, including 865k unique email addresses. Other impacted data included IP addresses, the user's country, and partial payment card data (first 6 and last 4 digits plus expiry date).
7月28日(火)
Houston City College: 831,642 件のアカウント情報が流出
hccs.edu / 侵害日 2026-06-16 / 漏洩データ: Academic records, Citizenship statuses, Dates of birth, Email addresses, Genders, Names, Phone numbers, Physical addresses In June 2026, Houston City College was the target of a ShinyHunters "pay or leak" extortion campaign . Data allegedly obtained from the college was later published publicly and included 832k unique email addresses along with names, addresses, phone numbers, academic records, and other personal information relating to both current students and alumni.
7月21日(火)
Suno: 55,282,226 件のアカウント情報が流出
suno.com / 侵害日 2025-11-25 / 漏洩データ: Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases In November 2025, AI music generation tool Suno suffered a data breach that later came to light in July the following year . The data contained over 55M unique email addresses. Phone numbers were also present where they had been used as the sign-up method. Although representing a small portion of the corpus, the breach also included tens of thousands of Stripe records relating to purchases, containing names, physical addresses, purchase amounts and partial credit c…
7月20日(月)
Paidwork: 23,272,765 件のアカウント情報が流出
paidwork.com / 侵害日 2026-03-29 / 漏洩データ: Bank account numbers, Dates of birth, Device information, Education levels, Email addresses, Financial transactions, Genders, IP addresses, Names, Passwords, Personal interests, Phone numbers, Physical addresses, Profile photos In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale . Almost 11GB of data allegedly obtained from the platform was subsequently posted publicly in July and contained over 23M unique email addresses. The breach also included a broad range of other data relatin…
7月15日(水)
Fluke: 821,100 件のアカウント情報が流出
fluke.com / 侵害日 2026-07-01 / 漏洩データ: Email addresses, Employers, Job titles, Names, Physical addresses, Support tickets In July 2026, electronic test and measurement equipment company Fluke was targeted in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published more than 100GB of data allegedly taken from the company. The corpus contained largely corporate contact information, including over 800k unique email addresses, names, phone numbers and physical addresses. A large collection of support cases was also present.
Goose Creek: 6,574,121 件のアカウント情報が流出
goosecreek.com / 侵害日 2026-06-09 / 漏洩データ: Email addresses, Names, Phone numbers, Physical addresses, Purchases In June 2026, a party claiming to have access to data from Goose Creek Candle Company sent emails to a number of the company's customers , claiming the company had a security vulnerability and suffered a data breach. The data was subsequently sent to Have I Been Pwned and contained 6.6M unique email addresses along with names, phone numbers, physical addresses, order IDs and total spent. The data appears to have been obtained from the company's Shopify instance. Goose Creek is aware o…
7月11日(土)
Glendale Community College: 793,925 件のアカウント情報が流出
glendale.edu / 侵害日 2026-06-15 / 漏洩データ: Academic records, Dates of birth, Email addresses, Genders, Government issued IDs, Names, Phone numbers, Physical addresses In June 2026, Glendale Community College was the target of a ShinyHunters "pay or leak" extortion campaign . Data allegedly obtained from Glendale was later published online and included almost 800k unique email addresses along with various other data fields, including names, addresses, phone numbers, Social Security numbers and other information relating to student enrolments. In its disclosure notice , the college advised that "th…
7月4日(土)
Moody Bible Institute: 2,303,416 件のアカウント情報が流出
moody.edu / 侵害日 2026-06-15 / 漏洩データ: Dates of birth, Email addresses, Genders, Marital statuses, Names, Phone numbers, Physical addresses In June 2026, Moody Bible Institute was targeted by a ShinyHunters "pay or leak" extortion campaign . Over 2.3M unique email addresses and other personal data were later published publicly, including names, physical addresses, phone numbers, dates of birth and other information relating to donors, supporters, students and alumni. In their disclosure notice , Moody advised that they had "engaged both internal and external cybersecurity experts to thoroughly i…
6月29日(月)
Sysco: 2,691,852 件のアカウント情報が流出
sysco.com / 侵害日 2026-06-15 / 漏洩データ: Customer feedback, Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Usernames In June 2026, the food distribution company Sysco was targeted by a ShinyHunters "pay or leak" extortion campaign . Data was subsequently published containing 2.7M unique email addresses belonging to staff and customers. The data also contained largely corporate contact information including names, phone numbers, physical addresses, internal job titles, and customer feedback.
6月26日(金)
American Tower: 216,601 件のアカウント情報が流出
americantower.com / 侵害日 2026-06-12 / 漏洩データ: Email addresses, Job titles, Names, Phone numbers, Physical addresses In June 2026, telecommunications tower infrastructure company American Tower was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data allegedly taken from the company containing more than 200k unique email addresses belonging to employees, contractors, customers, and leads. Exposed data also included names, addresses, and phone numbers.
6月24日(水)
Madison Square Garden Sports: 9,796,738 件のアカウント情報が流出
msgsports.com / 侵害日 2026-06-05 / 漏洩データ: Customer service records, Email addresses, Names, Phone numbers, Physical addresses In June 2026, the sports and entertainment company Madison Square Garden Sports was the target of a ShinyHunters "pay or leak" extortion campaign . The group later published the alleged data, which included almost 10M unique email addresses spanning staff and customers, along with extensive personal, employment and customer relationship information.