Benefit One: other companies' employee data in survey downloads
In the survey feature of Benefit One Platform, the employee benefits company's service for corporate HR staff, downloaded survey results included employees of other companies and organizations that the user should not have access to. A faulty program condition introduced in a June 2025 system change caused it; an internal check in October 2025 had found it but it was not fixed. A client's HR contact reported it on 30 July 2026. Staff numbers, names, genders, birth dates, departments, positions and joining and leaving details of 13,460 people at 2,322 organizations were affected. Only that one contact had downloaded the data, and it was deleted.
Disclosed
2026-09-30
Organizations involved
1
Leaked or at risk
13.5K
13,460
Downtime
Unknown
Timeline
- Detected 2026-07-30
- Disclosed 2026-09-30
- 62 days
Attack or cause
- Method
- [Misconfiguration]
- Impact
- [Data leak]
- Entry point
- Web app
Data exposed or at risk
Services hit
Organizations involved
[Breached][Major]Tokyo, ShinjukuOther services13,460 leaked
Benefit One Inc.
Sources
- [1][Official]当社システムにおける個人情報漏えいに関するお知らせとお詫びBenefit One · 2026-09-30
- [2][News]アンケート結果をダウンロードしたら他社の従業員情報が…… ベネフィット・ワン、1万3460人分漏えいITmedia NEWS · 2026-09-30