How to use

• Check a service you use

  1. Use the Services link below, then enter the service name.
  2. Tick Pick next to the services you use.
  3. In Your services above the list, open an incident title to read its details.
  → to “Services”

• Check a company or organization

  1. Use the Organizations link below, then enter a name or Japanese reading.
  2. Choose the organization’s name in the list to open its page.
  3. Open an event in its Incident history.
  → to “Organizations”

• Find a particular incident

  1. Use the Incidents link below, then enter a company or service name.
  2. Narrow the list by disclosure date or method if needed. On a phone, open Filters.
  3. Open a title for the details, then follow Sources to the original notice.
  → to “Incidents”

• Explore regional counts and trends

  1. Use the Statistics link below, then choose a Range.
  2. Choose a prefecture on the map. On a phone, tap it, then tap View incidents.
  3. Open an incident from that list. Return to Statistics for the monthly and method charts.
  → to “Statistics”

What if a search finds nothing?

Use Clear filters, then try part of a name or a Japanese reading. This site records selected incidents from public sources and does not cover every incident. No matching entry does not establish that a service or organization is safe.

Why have my picked services disappeared?

Check that you are using the same browser and device. Picks are stored in the browser and may be lost if its saved data is cleared or storage is restricted. If you kept a share link, you can reopen that selection.

Why does a shared link show different picks from mine?

It shows the selection of the person who made the link. Opening it does not change your saved picks. Back to my selection returns to them. Save this selection replaces your saved picks with those in the link.

Why do prefecture counts not add up to the national total?

An incident involving several prefectures counts in each one. The map uses organizations’ registered or main offices, so it does not show the exact places where attacks happened.

Does an unknown leak size mean zero?

No. It means the number is not established or published. Stated leak sizes may include records only at risk. A count of records is not necessarily a count of people.

Why do I see different results from a saved URL?

Reopening the URL applies your filters and sorting to the current entries. New entries and follow-up reports can change counts and information.

Can I check whether my own personal information was leaked?

This site cannot look up an individual’s email address or card number. It lists public information about organizations and services. Open the relevant incident and follow Sources to the operator’s official information.

Plain-language explanations of words used on this site and in incident reports. Enter a word or narrow the list with the topic buttons. The page address keeps the chosen topic, so you can share a link to it. Each term’s left border has the color of its topic button. Select a term to open its page. Some pages also explain how it works, how to prevent it and what to do if it happens, with real incidents and sources. You do not need to learn the whole list.

API abuse

Misusing the channels that programs use to ask each other for information (APIs) in ways that were not meant to be allowed, such as pulling out other customers' data.

Backdoor

A hidden way into a computer that skips the normal sign-in, often left by attackers so that they can come back later.

Brute-force attack

Trying many possible passwords or other secrets to find one that works.

Credential stuffing

Trying account IDs and passwords obtained elsewhere against another service, hoping that people reused them.

CVE identifier

A worldwide reference number for a published security flaw in software, such as CVE-2024-12345. It shows which reports are about the same flaw.

Dark web / leak site

The dark web is the part of the internet that ordinary browsers and search sites such as Google cannot reach; it needs special software and is used to stay hidden. A leak site is where attackers publish stolen information or threaten to; some are on the dark web, some on the ordinary web.

DoS / DDoS attack

An attack that sends a website or service far more visits than it can handle, so that it slows down or stops, like a crowd blocking a shop's door. In a DDoS attack the visits come from many devices at once, often other people's devices taken over by the attacker.

Insider misuse

Someone allowed to handle the information, such as an employee or a worker from a company hired to help, misusing their position or permissions.

Malware / computer virus

Malware is software designed to cause harm, such as stealing information or disrupting a device. A computer virus is one type of malware.

Man-in-the-middle attack

An attack in which the attacker gets between two parties that are talking to each other, so they can read or change what is sent, like someone opening a letter on its way, reading it and sealing it again. TLS encryption and digital certificates normally stop this, but if a certificate authority's key is weak or leaked and fake certificates can be made, the browser takes the attacker for the real site. Public Wi-Fi or a hijacked router is often where the attacker gets in between.

Misconfiguration

Settings left wrong, for example a folder on the internet that anyone can open although only staff should see it, so information can be seen from outside.

Misdelivery

Sending email, post, a fax or other information to the wrong people. A typical email case is a message to many people with every address in the To or CC field, where all recipients can see each other's addresses, instead of the BCC field, which hides them from one another. Other common cases are picking the wrong person from the address suggestions while typing, or attaching the wrong file. It is not an attack, but it leaks personal information.

Phishing

Pretending to be a trusted organization, often through messages or fake sites, to trick people into giving away passwords or other information. Phishing by SMS is called smishing.

Ransomware

Harmful software that locks an organization's files or computers and demands money to unlock them. Attackers often copy the files first and threaten to publish them.

Spam

Email or other messages sent in bulk to people who never asked for them. Besides advertising, many lure people to phishing sites or carry malware. In incidents, a hijacked email account or mail server is often used to send large amounts of spam; receivers may then treat the organization's mail as spam, so even its normal email stops getting through.

Spoofing

Faking the sender's name, email address or phone number so that a message seems to come from a real company or someone you know. Email lets the sender write any sender address, like writing any return address on an envelope. SMS sender names and caller phone numbers can be faked too, and phishing often relies on this. Receivers can check a message against rules that the domain name's owner publishes in DNS records: SPF lists the servers allowed to send email for the domain, DKIM is a digital signature the sending server adds to each message, and DMARC says what to do with mail that fails these checks. The malware Emotet, for example, spread through spoofed emails that replied to real past conversations stolen from infected computers.

Unauthorized access, intrusion and compromise

Getting into or using someone else's computers or information without permission. Compromise means that someone has taken control of a computer or account, so its information is no longer safe.

Unauthorized login / impersonation

Signing in to a service with someone else's ID and password, often stolen, while pretending to be that person.

Vulnerability

A security flaw in a device or program. Attackers can use it to get in, steal information or take control.

Web exploit / SQL injection / XSS

An attack through a flaw in the programs behind a website. In SQL injection, the attacker types instructions for the computer (written in a language called SQL) into a form instead of normal text, and a badly built site carries them out on the store of information behind it (its database), handing out or changing data. In cross-site scripting (XSS), the attacker gets a site to include a malicious program that then runs in the browsers of other people who open the page, to steal their information or show them fake screens.

Web skimming

Tampering with an online shop's payment page so that the card numbers customers type in are also sent to the attacker. It is named after skimming, the copying of card data with a hidden card reader, done here through a website; Japanese notices usually call it tampering with the payment application. The attacker either hides a stealing program in the real page or shows a fake payment form before the card number is entered. The page looks normal either way, so card numbers, expiry dates and security codes are taken without anyone noticing. It often starts with a vulnerability in the shop's CMS or an unauthorized login to its admin screen, and it is behind many card data leaks from Japanese online shops.

Zero-day attack

An attack on a flaw in software before its maker knows about it or has a fix out, so there is no update yet to protect against it.