How to use

An incident means an event such as a cyberattack or data leak. Choose a task in Start here or jump to a numbered section in Contents. Common questions helps with things that may be confusing, and the glossary explains unfamiliar words.

1. Start here

Check a service you use
1. Use the Services link below, then enter the service name.
2. Tick Pick next to the services you use.
3. In Your services above the list, open an incident title to read its details.
→ to “Services”
Check a company or organization
1. Use the Organizations link below, then enter a name or Japanese reading.
2. Choose the organization’s name in the list to open its page.
3. Open an event in its Incident history.
→ to “Organizations”
Find a particular incident
1. Use the Incidents link below, then enter a company or service name.
2. Narrow the list by disclosure date or method if needed. On a phone, open Filters.
3. Open a title for the details, then follow Sources to the original notice.
→ to “Incidents”
Explore regional counts and trends
1. Use the Statistics link below, then choose a Range.
2. Choose a prefecture on the map. On a phone, tap it, then tap View incidents.
3. Open an incident from that list. Return to Statistics for the monthly and method charts.
→ to “Statistics”

2. Home

→ to “Home”

The question buttons at the top lead to the incidents, services, organizations, statistics and About pages.
Spotlight shows major incidents picked by the operator, with the organizations affected, the latest source and a link to the details.
Latest disclosures and updates lists newly disclosed incidents (New) and incidents with a new official or regulator report (Update), newest first; within a day, the most severe come first.
The map shows incidents per prefecture over the past 12 months. Click a prefecture to list its incidents; on a phone, tap it, then tap View incidents. Prefectures with activity in the last 7 days pulse.
The chart shows incidents disclosed per month over the past 12 months. More statistics opens the statistics page.

3. Search

Use the search at the top. On narrow screens, first press the magnifier button to open it.
Choose Incidents, Services or Organizations in the select on the left. Enter your words, then press Enter or Search.
The initial search target follows the page you are on. Home, Guide, Statistics and About start with Incidents.
Words separated by spaces must all match.
Organizations are also found by their Japanese reading, short names, brands and the services they run, services by their reading and other names. Incidents are found by their title, summary and the names of the organizations and services involved.

4. Incident search

→ to “Incidents”

Each row is one incident. Click a title to open its details.
Filter by disclosure date, method, impact, status, severity and leak size.
You can also filter by the affected organizations’ location, industry/type, kind and employees. To choose a municipality, pick a prefecture first.
Press Clear filters to remove the conditions.
Click a column heading to sort by it, and again to reverse the order. The newest disclosures come first at the start.
The list shows 50 incidents at a time; switch pages above or below the table.
Filters and sorting are part of the page address (URL). Save or share it to reopen the same conditions; the results can change as entries are updated.
On a phone, every filter except the text search is behind the Filters button, and a select sets the order.

5. Incident details

The tags at the top show the status, severity, methods and impacts. Choose a tag to open the glossary page explaining it.
Incidents written up in detail show their text below the summary in sections such as What happened. Choose a number such as [1] in the text to jump to that source.
Words with a dotted underline in the summary and text are glossary terms. Choose one to see its meaning, and open its page from there. Only the first place of each term is underlined.
Organization, brand and service names in the summary and text link to their pages.
The page shows the disclosure date, the number of organizations involved, the leak size and the downtime (Unknown when not published), the timeline (started, detected, disclosed, resolved), the attack or cause, and the data exposed or at risk. Other published counts, such as affected accounts or files, have separate labels and do not establish how many people’s personal data leaked.
Services hit and Organizations involved show each one’s role (breached, through a supplier, precautionary halt) and impact level. Choose a name to open its page.
Long lists of services, organizations and sources show their first 10. Choose Show all, beside the heading or below the list, to see them all, and Show first 10 to fold them again.
When an incident involves more than one service or organization, Open in service search and Open in organization search show them in the list pages.
When the harm spread through a supplier, the Supply chain diagram shows which supplier reached which organizations.
Sources link to the official notices and news reports. Last updated is when the entry last changed.

6. Services

→ to “Services”

Service search finds services such as online shops, travel booking and payments by name, reading or other name, and filters them by operator name, category and who they are for (people or businesses).
Pick an incident involving many organizations under Large-scale incident to list only its services, the hardest hit first.
Tick Pick for the services you use: Your services appears above the table with the incidents that hit them in one list. You can pick up to 50.
Your services shows 50 incidents at a time. Press Show more below it to load the next set; wait while the button says Loading. Choose a title to read the details.
To remove a service, untick it or press × next to its name above the list. Clear all removes every pick.
Your picks are saved in this browser and are still there next time. Other browsers and devices do not see them.
Press Share to copy a link that opens the same picks. If copying fails, select and copy the displayed link.
Save this selection on a shared link replaces this browser’s existing picks; it does not add to them. Choose Back to my selection to return without saving.
Choose a service name to see its other names, operators, included services and incidents. Add to my services adds it to your picks.
On a service’s page, open Other incidents of the operator to see the operator’s other incidents.
A service that includes other services also shows their incidents.

7. Organizations

→ to “Organizations”

Organization search finds organizations by name, reading, short name, brand or a service they run, and filters them by location, industry/type, kind and size. Only organizations involved in an incident are listed.
Pick an incident involving many organizations under Large-scale incident to list only its organizations, the hardest hit first.
An organization’s page shows its profile (short names, brands, the services it runs, parent and so on), public figures with their sources, and its incident history.

8. Statistics

→ to “Statistics”

Under Range, pick this year, the past 12 months, the past 3 months, all, or a start and end month; every number, the map and the charts then count that period.
The period follows disclosure dates, which may differ from when an attack or leak happened.
Hover over a prefecture on the map to see its incidents and affected organizations; click it to list its incidents in the period.
On a phone, tap a prefecture to see its counts, then tap View incidents to open its incidents in the selected period.
The charts show incidents per month and per attack method or cause.
Prefectures count by registered office, so an incident that involves several prefectures counts in each.

9. Severity and impact levels

→ to “About”

Each organization involved gets an impact level: Minor, Moderate, Major or Critical. An incident’s severity usually follows the highest of them.
A Major incident is raised to Critical when it has at least one million records or 50 organizations breached or hit through a supplier.
Organizations that only halted services as a precaution do not count as affected.
The criteria are under Severity levels on the About page.

10. Other

→ to “About”

JA/EN at the top right switches between Japanese and English; this browser remembers the choice.
To report an error or send more information, use the link on the About page.
The data license (CC BY 4.0) and the disclaimer are on the About page.
The Analytics section on the About page explains how Microsoft Clarity measures browsing, searches, service selection, sharing and other interactions.
Feed readers can subscribe to the 50 most recently disclosed incidents with the Atom feed linked in the footer.

11. Common questions

What if a search finds nothing?: Use Clear filters, then try part of a name or a Japanese reading. This site records selected incidents from public sources and does not cover every incident. No matching entry does not establish that a service or organization is safe.
Why have my picked services disappeared?: Check that you are using the same browser and device. Picks are stored in the browser and may be lost if its saved data is cleared or storage is restricted. If you kept a share link, you can reopen that selection.
Why does a shared link show different picks from mine?: It shows the selection of the person who made the link. Opening it does not change your saved picks. Back to my selection returns to them. Save this selection replaces your saved picks with those in the link.
Why do prefecture counts not add up to the national total?: An incident involving several prefectures counts in each one. The map uses organizations’ registered or main offices, so it does not show the exact places where attacks happened.
Does an unknown leak size mean zero?: No. It means the number is not established or published. Stated leak sizes may include records only at risk. A count of records is not necessarily a count of people.
Why do I see different results from a saved URL?: Reopening the URL applies your filters and sorting to the current entries. New entries and follow-up reports can change counts and information.
Can I check whether my own personal information was leaked?: This site cannot look up an individual’s email address or card number. It lists public information about organizations and services. Open the relevant incident and follow Sources to the operator’s official information.

12. Glossary: look up a word

Plain-language explanations of words used on this site and in incident reports. Enter a word or narrow the list with the topic buttons. The page address keeps the chosen topic, so you can share a link to it. Each term’s left border has the color of its topic button. Select a term to open its page. Some pages also explain how it works, how to prevent it and what to do if it happens, with real incidents and sources. You do not need to learn the whole list.

Find a term or phrase

Terms are listed alphabetically, A–Z.

Glossary topics

Showing 37 of 100 terms

API (application programming interface): A fixed way for one program to ask another for information or an action, without a person in between. A booking site, for example, uses one to ask a payment company to charge a card.
Augmented reality (AR): Technology that overlays images or guidance on a real-world view, such as a phone camera showing characters or explanations at a tourist site.
Cache / CDN: A copy of a page or other information kept so that it shows faster the next time. Browsers keep one, and so do servers between you and a site. A CDN (content delivery network) is a service that keeps copies of a site on servers in many places and delivers them from there. A browser's private cache can store pages personalized for its user. A shared cache, such as a CDN, can expose names, addresses or other details if it is wrongly configured to return one member's page to another person.
Certificate authority (CA): An organization that issues the digital certificates that websites and other services use to prove who they are, a bit like an office that issues ID cards. Browsers and phones keep a list of the certificate authorities they trust. If the secret key a certificate authority signs certificates with (a long secret number) gets out, anyone can make fake certificates, pass off a fake site as the real one, or read traffic through a man-in-the-middle attack. In October 2026 the secret keys of eight certificates of eMudhra, a certificate authority in India, turned out to be so weak that anyone could work them out. Browser makers quickly blocked them, and eMudhra said it would stop issuing certificates for websites worldwide.
Cloud service: Using a provider's computers over the internet to keep files or run programs, instead of only your own computer.
CMS (content management system): Software for building and updating a website from on-screen forms, without writing programs. WordPress is the best-known example; EC-CUBE is one used for online shops in Japan. Because the same CMS runs on many sites, attackers who learn of a vulnerability automatically search for sites using it and attack them all at once. WordPress, the most widely used CMS in the world, is attacked especially often. Not updating the CMS and its add-ons (plugins), and weak passwords for its admin screen, are common causes of site defacement and data leaks.
Data center: A building full of the computers that run websites and online services (servers), with backup power and cooling to keep them running.
Desktop app: An app you install on a computer (Windows or Mac), such as a word processor or a chat program. Like a mobile app it is installed on the device, unlike a web application, which runs inside a web page.
Device, USB and removable storage: A device is a machine such as a computer, tablet or phone. A USB memory stick is a small item you plug into a computer to save information and carry it elsewhere. Memory cards and similar items work the same way; together they are called removable storage.
DNS (Domain Name System): The system that looks up the number of the computer you want to reach (its IP address) from a domain name, like finding a phone number by name in a phone book. Every time you open a site or send an email, your computer or phone asks a DNS server and then connects to the number in the answer. The answers come from each domain name's DNS records. Almost everything on the internet relies on DNS: if it stops, sites and email stop working too. An attacker who takes over the account that manages a domain name can change its DNS records, so that even the correct URL leads to a fake site (DNS hijacking). DNSSEC adds a mark that only the domain name's managers can make (a digital signature) to the answers, so that a forged answer swapped in along the way can be detected.
DNS record: One entry in the settings a domain name has on its DNS servers, like one listing in a phone book. The main kinds give the IP address of the site's server (A and AAAA records, for the two number formats), point to another name (CNAME records), name the server that receives the domain's email (MX records), or hold free text (TXT records). TXT records also publish the rules that help spot spoofed email (SPF, DKIM and DMARC). A record left pointing at a service no longer in use can let someone else sign up for that service again and show fake pages under the real domain name, such as shop.example.jp (subdomain takeover).
DNS server: A server that answers DNS questions. There are two kinds with different jobs. One takes questions from computers and phones, finds the answers and remembers them for a while; your internet provider or your organization's network usually supplies it (a caching DNS server, or resolver). The other holds the DNS records of particular domain names and gives the correct answers for them (an authoritative DNS server). When a DNS server stops, many people at once cannot reach sites or email, so DNS servers are frequent targets of DDoS attacks. In cache poisoning, an attacker makes a resolver remember a forged answer, so that everyone using it can be sent to a fake site.
Email, attachments and forms: An attachment is a file sent along with a message, such as a document or a picture. A form is a page where you type in details, for example for an inquiry or an application, and send them.
Firewall: A system or device at the entrance of a network that lets through only the traffic its rules allow and blocks the rest, like a reception desk that only lets in expected visitors. It can be built into a router or be a separate device or program. A UTM (unified threat management) device combines a firewall with other protections such as virus checks; a WAF (web application firewall) watches only for attacks on websites. A gap in the rules, or a vulnerability in the firewall itself, lets attackers through.
FTP / SFTP: Ways to send files between computers over the internet, for example to put a website's pages on the computer that shows them (the server). FTP sends the files and the password exactly as they are, so anyone watching along the way can read them. SFTP first turns them into a jumble that only the receiving computer can turn back (encryption).
Hosting / rented server: Renting space on a provider's computer (a server) to run a website or email.
HTTPS: HTTP is the set of rules (a protocol) a browser and a website use to send pages back and forth. HTTPS is HTTP sent over a connection protected by TLS: TLS encrypts what is sent and uses a digital certificate to check that the browser is really talking to the server for the address shown. Sites whose address starts with "https://" use HTTPS. On a site that is only "http://", what is sent can be read or changed along the way. HTTPS shows only that the connection to that address is encrypted; it does not mean the site belongs to the company it claims to be or that it is safe, and many phishing sites use HTTPS too.
MDM (mobile device management): A tool an organization uses to manage its staff's phones and computers from one place: their settings, which apps are allowed, and erasing a lost one from afar.
Mobile app: An app you install on a smartphone or tablet, usually from the App Store or Google Play, such as a bank's or shop's own app. It is not the same as a web application, which runs inside a web page with nothing to install. Many services have both, and a flaw or leak can affect one and not the other.
Network: Computers, phones, printers and other machines joined by cables or by radio, such as Wi-Fi, so that they can exchange information. A network inside one building or organization is a LAN (local area network), and it connects to the internet through a router.
Network switch: A device with many sockets that connects computers, servers, printers and other machines by cable within a building or floor. It sends each piece of information only to the socket where the receiving machine is plugged in. A router passes information between networks; a switch passes it within one network. Switches are also set up to split an organization's network into sections, for example by department, so that machines in one section cannot reach another. If that split is weak, an attacker who gets into one computer can more easily spread to others.
Operating system (OS): The basic software that runs a computer or phone and that every other app runs on, such as Windows, macOS, iOS or Android. Its maker sends updates that fix security flaws, so keeping it up to date matters.
PDF / CSV: PDF is a kind of file that shows a document exactly like printed pages, on any device. CSV is a simple kind of file that holds a table, such as a list of names and addresses: each line is one row, with commas between the items. Excel and similar table programs open it. Notices and lists of people often use these formats.
PHP: A language for writing instructions for computers, often used to build websites. A security flaw in PHP itself does not mean that every site built with it was harmed.
Remote access / RDP: Using a computer from another place. RDP is a way to see another computer's screen and work on it as if you were sitting in front of it.
Router: A device that joins networks together and decides where each piece of information should go next, like a sorting office for mail. At home, the box that connects your computers and phones to the internet line is a router. In an organization it sits at the entrance from the internet, and many routers also provide VPN. A router left with its factory password or without updates can be taken over by attackers and used as a way in, or as a place for a man-in-the-middle attack.
SaaS (software as a service): Software you use over the internet, usually in a web page, while the company that makes it runs it on its own computers. Online accounting and customer lists are examples.
Server: A computer that stores information and sends it to other computers and phones when they ask for it. Websites and email run on servers.
Social network / SNS: An online service such as X (formerly Twitter), Instagram or LINE, for posting messages or pictures and talking with other people.
Software defect: A problem that makes a program behave differently from what was intended, such as showing the wrong information or stopping a task. It can happen without an attack.
Software, programs and apps: Instructions that tell a computer or phone what to do, step by step; a single set of them is a program. An app is software made for one purpose, such as shopping, sending messages or viewing a map. It may be a mobile app on a phone, a desktop app on a computer, or a web application used inside a web page.
Source code: The text of a program, written in a language people can read and write; the computer runs the program from it. If source code leaks, attackers can study how a system works and look for its weaknesses. Passwords or access keys that developers left written in the code leak with it. A common incident is source code accidentally made public on a service for storing and sharing code, such as GitHub.
TLS: A set of rules (a protocol) that protects information sent over the internet. It turns the information into a jumble that only the other end can turn back (encryption), so nobody along the way can read or change it, and it uses a digital certificate to check that the other end really is the server for that address. Websites use it through HTTPS, and email and many apps use it too. Its predecessor SSL is outdated and no longer used, but people still often say SSL when they mean TLS, as in "SSL certificate". It only protects information on the way; it does not show that whoever runs the other end can be trusted.
URL, domain name and IP address: A URL is the address of a web page or file: the text shown in the browser's address bar, such as https://www.example.jp/news. The www.example.jp part is the domain name, built on a name such as example.jp that the site's owner has registered. Computers on the internet actually find each other by number, like phone numbers; that number is the IP address. The system that looks up the number for a domain name is DNS. Fake sites often use a domain name that looks like the real one, so it helps to check the domain name in a URL.
VPN (virtual private network): A way to connect from home or elsewhere, over the internet, to the computers inside an organization. What is sent is turned into a jumble that only the machines at the two ends can turn back (encryption), so nobody in between can read it. The machine at the organization that lets these connections in can itself have flaws that attackers use to get in.
Web application: A service you use inside a web page, without installing an app, such as an online shop's order pages or a booking form. It runs in the app you view websites with (the browser).
Web, website and home page: The pages you look at over the internet, on a computer or phone, together make up the Web. A website is one shop's, company's or person's set of pages; its home page is the first page you see.

Check a service you use

Check a company or organization

Find a particular incident

Explore regional counts and trends