> JapanHacked_
[Contained][Severity: Major][Web app exploit]

coconala: unauthorized access to the coconala skill market

At 02:05 on 8 October, coconala detected and blocked unauthorized access to its skill market system, but detected it again at about 13:00 and found signs at about 15:00 that personal data had been taken. Some members who had uploaded resumes and CVs are affected: 449 resumes and 1,845 CV-related documents leaked. The attack path was blocked at 15:44, and the vulnerability was fixed by 21:27. Card data and passwords were not affected.

Disclosed

2026-10-09

Organizations involved

1

Leaked or at risk

1.8K

1,845

Downtime

Unknown

Timeline

  1. Started, Detected 2026-10-08
  2. Disclosed 2026-10-09
  3. 1 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Employment]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][Official]「ココナラスキルマーケット」への不正アクセスによる個人情報漏洩に関するお詫びとお知らせcoconala · 2026-10-09