How to use

An incident means an event such as a cyberattack or data leak. Choose a task in Start here or jump to a numbered section in Contents. Common questions helps with things that may be confusing, and the glossary explains unfamiliar words.

1. Start here

Check a service you use
1. Use the Services link below, then enter the service name.
2. Tick Pick next to the services you use.
3. In Your services above the list, open an incident title to read its details.
→ to “Services”
Check a company or organization
1. Use the Organizations link below, then enter a name or Japanese reading.
2. Choose the organization’s name in the list to open its page.
3. Open an event in its Incident history.
→ to “Organizations”
Find a particular incident
1. Use the Incidents link below, then enter a company or service name.
2. Narrow the list by disclosure date or method if needed. On a phone, open Filters.
3. Open a title for the details, then follow Sources to the original notice.
→ to “Incidents”
Explore regional counts and trends
1. Use the Statistics link below, then choose a Range.
2. Choose a prefecture on the map. On a phone, tap it, then tap View incidents.
3. Open an incident from that list. Return to Statistics for the monthly and method charts.
→ to “Statistics”

2. Home

→ to “Home”

The question buttons at the top lead to the incidents, services, organizations, statistics and About pages.
Spotlight shows major incidents picked by the operator, with the organizations affected, the latest source and a link to the details.
Latest disclosures and updates lists newly disclosed incidents (New) and incidents with a new official or regulator report (Update), newest first; within a day, the most severe come first.
The map shows incidents per prefecture over the past 12 months. Click a prefecture to list its incidents; on a phone, tap it, then tap View incidents. Prefectures with activity in the last 7 days pulse.
The chart shows incidents disclosed per month over the past 12 months. More statistics opens the statistics page.

3. Search

Use the search at the top. On narrow screens, first press the magnifier button to open it.
Choose Incidents, Services or Organizations in the select on the left. Enter your words, then press Enter or Search.
The initial search target follows the page you are on. Home, Guide, Statistics and About start with Incidents.
Words separated by spaces must all match.
Organizations are also found by their Japanese reading, short names and brands, services by their reading and other names. Incidents are found by their title, summary and the names of the organizations and services involved.

4. Incident search

→ to “Incidents”

Each row is one incident. Click a title to open its details.
Filter by disclosure date, method, impact, status, severity and leak size.
You can also filter by the affected organizations’ location, industry/type, kind, employees and users. To choose a municipality, pick a prefecture first.
Press Clear filters to remove the conditions.
Click a column heading to sort by it, and again to reverse the order. The newest disclosures come first at the start.
The list shows 50 incidents at a time; switch pages above or below the table.
Filters and sorting are part of the page address (URL). Save or share it to reopen the same conditions; the results can change as entries are updated.
On a phone, every filter except the text search is behind the Filters button, and a select sets the order.

5. Incident details

The tags at the top show the status, severity, methods and impacts. Choose a tag to open the glossary page explaining it.
Incidents written up in detail show their text below the summary in sections such as What happened. Choose a number such as [1] in the text to jump to that source.
Words with a dotted underline in the summary and text are glossary terms. Choose one to see its meaning, and open its page from there. Only the first place of each term is underlined.
The page shows the leak size and the number of organizations involved, the timeline (started, detected, disclosed, resolved), the attack or cause, and the data exposed or at risk.
Services hit and Organizations involved show each one’s role (breached, through a supplier, precautionary halt) and impact level. Choose a name to open its page.
Long lists of services, organizations and sources show their first 10. Choose Show all, beside the heading or below the list, to see them all, and Show first 10 to fold them again.
To explore all the related organizations in a list, choose Open in organization search.
When the harm spread through a supplier, the Supply chain diagram shows which supplier reached which organizations.
Sources link to the official notices and news reports. Last updated is when the entry last changed.

6. Services

→ to “Services”

Service search finds services such as online shops, travel booking and payments by name, reading or other name, and filters them by category and by who they are for (people or businesses).
Tick Pick for the services you use: Your services appears above the table with the incidents that hit them in one list. You can pick up to 50.
Your services shows 50 incidents at a time. Press Show more below it to load the next set, and choose a title to read the details.
To remove a service, untick it or press × next to its name above the list. Clear all removes every pick.
Your picks are saved in this browser and are still there next time. Other browsers and devices do not see them.
Press Share to copy a link that opens the same picks. If copying fails, select and copy the displayed link.
Save this selection on a shared link replaces this browser’s existing picks; it does not add to them. Choose Back to my selection to return without saving.
Choose a service name to see its other names, operator, included services and incidents. Add to my services adds it to your picks.
On a service’s page, open Other incidents of the operator to see the operator’s other incidents.
A service that includes other services also shows their incidents.

7. Organizations

→ to “Organizations”

Organization search finds organizations by name, reading, short name or brand, and filters them by location, industry/type, kind and size. Only organizations involved in an incident are listed.
Pick an incident under Incident involved to list only its organizations, the hardest hit first.
An organization’s page shows its profile (short names, brands, the services it runs, parent and so on), public figures with their sources, and its incident history.

8. Statistics

→ to “Statistics”

Under Range, pick this year, the past 12 months, the past 3 months, all, or a start and end month; every number, the map and the charts then count that period.
The period follows disclosure dates, which may differ from when an attack or leak happened.
Hover over a prefecture on the map to see its incidents and affected organizations; click it to list its incidents in the period.
On a phone, tap a prefecture to see its counts, then tap View incidents to open its incidents in the selected period.
The charts show incidents per month and per attack method or cause.
Prefectures count by registered office, so an incident that involves several prefectures counts in each.

9. Severity and impact levels

→ to “About”

Each organization involved gets an impact level: Minor, Moderate, Major or Critical. An incident’s severity usually follows the highest of them.
A Major incident is raised to Critical when it has at least one million records or 50 organizations breached or hit through a supplier.
Organizations that only halted services as a precaution do not count as affected.
The criteria are under Severity levels on the About page.

10. Other

→ to “About”

JA/EN at the top right switches between Japanese and English; this browser remembers the choice.
To report an error or send more information, use the link on the About page.
The data license (CC BY 4.0) and the disclaimer are on the About page.

11. Common questions

What if a search finds nothing?: Use Clear filters, then try part of a name or a Japanese reading. This site records selected incidents from public sources and does not cover every incident. No matching entry does not establish that a service or organization is safe.
Why have my picked services disappeared?: Check that you are using the same browser and device. Picks are stored in the browser and may be lost if its saved data is cleared or storage is restricted. If you kept a share link, you can reopen that selection.
Why does a shared link show different picks from mine?: It shows the selection of the person who made the link. Opening it does not change your saved picks. Back to my selection returns to them. Save this selection replaces your saved picks with those in the link.
Why do prefecture counts not add up to the national total?: An incident involving several prefectures counts in each one. The map uses organizations’ registered or main offices, so it does not show the exact places where attacks happened.
Does an unknown leak size mean zero?: No. It means the number is not established or published. Stated leak sizes may include records only at risk. A count of records is not necessarily a count of people.
Why do I see different results from a saved URL?: Reopening the URL applies your filters and sorting to the current entries. New entries and follow-up reports can change counts and information.
Can I check whether my own personal information was leaked?: This site cannot look up an individual’s email address or card number. It lists public information about organizations and services. Open the relevant incident and follow Sources to the operator’s official information.

12. Glossary: look up a word

Plain-language explanations of words used on this site and in incident reports. Enter a word or narrow the list with the topic buttons. Each term’s left border has the color of its topic button. Select a term to open its page. Some pages also explain how it works, how to prevent it and what to do if it happens, with real incidents and sources. You do not need to learn the whole list.

Find a term or phrase

Terms are listed alphabetically, A–Z.

Glossary topics

Showing 84 of 84 terms

Account / ID: An account is a user's registration with a service. An ID identifies the user, often using an email address or membership number.
API (application programming interface): A fixed way for one program to ask another for information or an action, without a person in between. A booking site, for example, uses one to ask a payment company to charge a card.
API abuse: Misusing the channels that programs use to ask each other for information (APIs) in ways that were not meant to be allowed, such as pulling out other customers' data.
Attacker claim / attribution: A claim is attackers saying that they did it. Attribution is investigators judging from evidence who was behind an attack. A claim alone is not a proven fact.
Backdoor: A hidden way into a computer that skips the normal sign-in, often left by attackers so that they can come back later.
Backup: A separate copy kept so information can be restored if the original is damaged or lost.
Browser: The app you view web pages with, such as Chrome, Safari or Edge. Choices saved in one browser do not move to another browser or device by themselves.
Brute-force attack: Trying many possible passwords or other secrets to find one that works.
Certificate authority (CA): An organization that issues the digital certificates that websites and other services use to prove who they are, a bit like an office that issues ID cards. Browsers and phones keep a list of the certificate authorities they trust. If the secret key a certificate authority signs certificates with (a long secret number) gets out, anyone can make fake certificates, pass off a fake site as the real one, or read traffic through a man-in-the-middle attack. In October 2026 the secret keys of eight certificates of eMudhra, a certificate authority in India, turned out to be so weak that anyone could work them out. Browser makers quickly blocked them, and eMudhra said it would stop issuing certificates for websites worldwide.
Cloud service: Using a provider's computers over the internet to keep files or run programs, instead of only your own computer.
Contained: Steps have been taken to prevent further spread. Investigation or restoration may still be continuing.
Credential stuffing: Trying account IDs and passwords obtained elsewhere against another service, hoping that people reused them.
Credentials / password: Information that proves who you are when you sign in: usually an ID and a password, sometimes together with a code sent to your phone.
CVE identifier: A worldwide reference number for a published security flaw in software, such as CVE-2024-12345. It shows which reports are about the same flaw.
Cyberattack: An attempt to steal or change information, stop a service or otherwise cause harm, using computers or the internet.
Dark web / leak site: The dark web is the part of the internet that ordinary browsers and search sites such as Google cannot reach; it needs special software and is used to stay hidden. A leak site is where attackers publish stolen information or threaten to; some are on the dark web, some on the ordinary web.
Data at risk / possible leak: Information may have got out, but nobody has confirmed that it did. This is not the same as a confirmed leak.
Data center: A building full of the computers that run websites and online services (servers), with backup power and cooling to keep them running.
Data leak / data breach: Information being seen by or reaching people who should not have it. This may happen through an attack or an accident.
Data, records and leak size: Data is information kept on a computer. A record is one entry in it, like one person's line in a member list. One person can have several records, for example one per order, so a count of records is not always a count of people.
Database: An organized collection of information that can be searched or counted, like a list of names arranged so you can quickly find an entry.
Desktop app: An app you install on a computer (Windows or Mac), such as a word processor or a chat program. Like a mobile app it is installed on the device, unlike a web application, which runs inside a web page.
Device, USB and removable storage: A device is a machine such as a computer, tablet or phone. A USB memory stick is a small item you plug into a computer to save information and carry it elsewhere. Memory cards and similar items work the same way; together they are called removable storage.
Digital forensics: Examining computers, phones and the records on them to establish what happened and how far the effects reached, like crime-scene investigation for computers.
Directly breached: Shown when the attack or leak happened in systems the organization runs itself.
DoS / DDoS attack: An attack that sends a website or service far more visits than it can handle, so that it slows down or stops, like a crowd blocking a shop's door. In a DDoS attack the visits come from many devices at once, often other people's devices taken over by the attacker.
E-commerce, payment services and FX: E-commerce means buying or selling online; payment services handle paying for things. FX (foreign exchange margin trading) means buying and selling foreign money, such as dollars, with money left with a trading company; you gain or lose as exchange rates move. Consumer services are for individuals; business services are for organizations.
EDR (endpoint detection and response): Security software installed on an organization's computers that watches for signs of an attack. It raises an alarm and helps to cut off and examine a computer that harmful software (malware) has got into.
Email, attachments and forms: An attachment is a file sent along with a message, such as a document or a picture. A form is a page where you type in details, for example for an inquiry or an application, and send them.
Encryption: Turning information into a meaningless jumble of characters by a secret rule, so that only someone who holds the matching secret (the key) can turn it back. It protects information, but criminals also use it to lock other people's files and demand money to unlock them (ransomware).
Filters, search conditions and categories: Filters keep only entries matching your conditions. A category is a grouping, such as travel or payment services.
FTP / SFTP: Ways to send files between computers over the internet, for example to put a website's pages on the computer that shows them (the server). FTP sends the files and the password exactly as they are, so anyone watching along the way can read them. SFTP first turns them into a jumble that only the receiving computer can turn back (encryption).
Hashing: Turning information such as a password into a fixed jumble of characters by a calculation that cannot be run backwards. Sites store passwords this way so that a stolen list does not show the passwords themselves. Simple passwords can still be found, though: attackers put common passwords through the same calculation and compare the results.
Hosting / rented server: Renting space on a provider's computer (a server) to run a website or email.
HTTPS: HTTP is the set of rules (a protocol) a browser and a website use to send pages back and forth. HTTPS is HTTP sent over a connection protected by TLS: TLS encrypts what is sent and uses a digital certificate to check that the browser is really talking to the server for the address shown. Sites whose address starts with "https://" use HTTPS. On a site that is only "http://", what is sent can be read or changed along the way. HTTPS shows only that the connection to that address is encrypted; it does not mean the site belongs to the company it claims to be or that it is safe, and many phishing sites use HTTPS too.
Impact level: How strongly one organization or service was affected. Different organizations in the same incident can have different levels.
Incident: An event that puts information or online services at risk. It can be an attack, but also an email sent to the wrong person or a lost computer or phone.
Insider misuse: Someone allowed to handle the information, such as an employee or a worker from a company hired to help, misusing their position or permissions.
Link: Text, a button or a picture in a web page or message that opens another page or file when you press it. Where it goes is set by a URL, and the text you see can differ from where it really leads. Links in fake emails and SMS often lead to phishing sites.
Login / authentication: Logging in opens a service under your account. Authentication is the process of checking that you are who you say you are.
Logs / access history: Records of activity, such as when someone signed in or what a system did. Investigators use them to understand an incident.
Malware / computer virus: Malware is software designed to cause harm, such as stealing information or disrupting a device. A computer virus is one type of malware.
Man-in-the-middle attack: An attack in which the attacker gets between two parties that are talking to each other, so they can read or change what is sent, like someone opening a letter on its way, reading it and sealing it again. TLS encryption and digital certificates normally stop this, but if a certificate authority's key is weak or leaked and fake certificates can be made, the browser takes the attacker for the real site. Public Wi-Fi or a hijacked router is often where the attacker gets in between.
MDM (mobile device management): A tool an organization uses to manage its staff's phones and computers from one place: their settings, which apps are allowed, and erasing a lost one from afar.
Misconfiguration: Settings left wrong, for example a folder on the internet that anyone can open although only staff should see it, so information can be seen from outside.
Misdelivery: Sending email, post, a fax or other information to the wrong people. A typical email case is a message to many people with every address in the To or CC field, where all recipients can see each other's addresses, instead of the BCC field, which hides them from one another. Other common cases are picking the wrong person from the address suggestions while typing, or attaching the wrong file. It is not an attack, but it leaks personal information.
Mobile app: An app you install on a smartphone or tablet, usually from the App Store or Google Play, such as a bank's or shop's own app. It is not the same as a web application, which runs inside a web page with nothing to install. Many services have both, and a flaw or leak can affect one and not the other.
Multi-factor / two-factor authentication (MFA / 2FA): A way to check at sign-in that it is really you, using two or more different kinds of evidence; with exactly two kinds it is called two-factor authentication (2FA). There are three kinds: something you know (a password or PIN), something you have (a phone, an IC card or a small device called a security key) and something you are (a fingerprint or your face). Typical examples: after the password, you enter a verification code sent to your phone by SMS or shown in an authenticator app, tap Approve on a notice on your phone, or use a passkey, which you unlock with your fingerprint, face or the phone's screen lock. A stolen password alone is then no longer enough to sign in. Some phishing sites, however, also ask for the code and use it at once; passkeys resist this kind of attack too. Two-step verification means checking in two steps; when both steps use the same kind of evidence, such as a password and a secret question, it is not multi-factor authentication.
Network: Computers, phones, printers and other machines joined by cables or by radio, such as Wi-Fi, so that they can exchange information. A network may stay inside one organization or connect to the internet.
One-time password / verification code: A verification code that works once or for a short time, often used when signing in or confirming a payment.
Operating system (OS): The basic software that runs a computer or phone and that every other app runs on, such as Windows, macOS, iOS or Android. Its maker sends updates that fix security flaws, so keeping it up to date matters.
Parent, subsidiary, merger and successor: A parent controls another company, its subsidiary. A merger combines companies; a successor takes over a business or other responsibilities.
PDF / CSV: PDF is a kind of file that shows a document exactly like printed pages, on any device. CSV is a simple kind of file that holds a table, such as a list of names and addresses: each line is one row, with commas between the items. Excel and similar table programs open it. Notices and lists of people often use these formats.
Permissions / administrator: Permissions define what someone can view or change. An administrator has broader permissions, such as changing system settings.
Personal information: Information that tells who a person is, or helps find that out, such as their name, address, phone number or email address. It may also include health or shopping records.
Phishing: Pretending to be a trusted organization, often through messages or fake sites, to trick people into giving away passwords or other information.
PHP: A language for writing instructions for computers, often used to build websites. A security flaw in PHP itself does not mean that every site built with it was harmed.
Precautionary halt: An organization stopped a service itself to prevent harm, before anyone confirmed that attackers had got into its own systems. This site does not count these organizations as affected.
Ransom / double extortion: A ransom is money an attacker demands, for example to unlock files they have locked. Double extortion means locking the files and also threatening to publish information stolen from them.
Ransomware: Harmful software that locks an organization's files or computers and demands money to unlock them. Attackers often copy the files first and threaten to publish them.
Remote access / RDP: Using a computer from another place. RDP is a way to see another computer's screen and work on it as if you were sitting in front of it.
SaaS (software as a service): Software you use over the internet, usually in a web page, while the company that makes it runs it on its own computers. Online accounting and customer lists are examples.
Server: A computer that stores information and sends it to other computers and phones when they ask for it. Websites and email run on servers.
Service outage / system failure: A service being unavailable or not working properly. Outages can have many causes; this site excludes ordinary failures unrelated to attacks.
Severity: This site's Minor, Moderate, Major and Critical scale for the impact of an incident as a whole. It does not rate how well an organization responded.
Site defacement: Changing a site's text, images or links without permission, sometimes to show false information or send visitors elsewhere.
SMS / text message: A short message sent to a phone number, using a different system from email sent to an email address.
Social network / SNS: An online service such as X (formerly Twitter), Instagram or LINE, for posting messages or pictures and talking with other people.
Software, programs and apps: Instructions that tell a computer or phone what to do, step by step; a single set of them is a program. An app is software made for one purpose, such as shopping, sending messages or viewing a map. It may be a mobile app on a phone, a desktop app on a computer, or a web application used inside a web page.
Supplier, contractor and provider: A supplier or contractor carries out work or supplies a service for another organization. A provider supplies a service, such as internet access.
Supply chain / supply-chain attack: The chain of companies that help make or deliver a product or service, such as suppliers and contractors, and the software they provide. In a supply-chain attack, attackers break into one company in the chain, often a less protected one, and use it to reach or harm the others. On this site, "Through a supplier" marks an organization hit by an attack or leak at a contractor or external service it used; its own systems may not have been broken into.
Tags, title, summary and history: Tags are short labels for a type or status. A title names an event, a summary gives the main points, and a history lists past events.
Threat actor, state-sponsored group and hacktivist: A threat actor is a person or group that carries out attacks. A state-sponsored group is one said to attack for a country's government or with its help. Hacktivists attack to push a political or social message.
TLS: A set of rules (a protocol) that protects information sent over the internet. It turns the information into a jumble that only the other end can turn back (encryption), so nobody along the way can read or change it, and it uses a digital certificate to check that the other end really is the server for that address. Websites use it through HTTPS, and email and many apps use it too. Its predecessor SSL is outdated and no longer used, but people still often say SSL when they mean TLS, as in "SSL certificate". It only protects information on the way; it does not show that whoever runs the other end can be trusted.
Unauthorized access, intrusion and compromise: Getting into or using someone else's computers or information without permission. Compromise means that someone has taken control of a computer or account, so its information is no longer safe.
Unauthorized login / impersonation: Signing in to a service with someone else's ID and password, often stolen, while pretending to be that person.
Update / patch: A change from a program's maker that fixes mistakes or security flaws, or adds improvements. Installing it is called updating.
URL, domain name, IP address and DNS: A URL is the address of a web page or file: the text shown in the browser's address bar, such as https://www.example.jp/news. The www.example.jp part is the domain name, built on a name such as example.jp that the site's owner has registered. Computers on the internet actually find each other by number, like phone numbers; that number is the IP address. DNS works like a phone book that looks up the number for a domain name, so entering a URL reaches the right computer. Fake sites often use a domain name that looks like the real one, so it helps to check the domain name in a URL.
VPN (virtual private network): A way to connect from home or elsewhere, over the internet, to the computers inside an organization. What is sent is turned into a jumble that only the machines at the two ends can turn back (encryption), so nobody in between can read it. The machine at the organization that lets these connections in can itself have flaws that attackers use to get in.
Vulnerability: A security flaw in a device or program. Attackers can use it to get in, steal information or take control.
Web application: A service you use inside a web page, without installing an app, such as an online shop's order pages or a booking form. It runs in the app you view websites with (the browser).
Web vulnerability exploit / SQL injection: An attack through a flaw in the programs behind a website. In SQL injection, the attacker types instructions for the computer (written in a language called SQL) into a form instead of normal text, and a badly built site carries them out on the store of information behind it (its database), handing out or changing data.
Web, website and home page: The pages you look at over the internet, on a computer or phone, together make up the Web. A website is one shop's, company's or person's set of pages; its home page is the first page you see.
Zero-day attack: An attack on a flaw in software before its maker knows about it or has a fix out, so there is no update yet to protect against it.

Check a service you use

Check a company or organization

Find a particular incident

Explore regional counts and trends