coconala: unauthorized access to the coconala skill market
At 02:05 on 8 October, coconala detected and blocked unauthorized access to its skill market system, but detected it again at about 13:00 and found signs at about 15:00 that personal data had been taken. Some members who had uploaded resumes and CVs are affected: 449 resumes and 1,845 CV-related documents leaked. The attack path was blocked at 15:44, and the vulnerability was fixed by 21:27. Card data and passwords were not affected.
Disclosed
2026-10-09
Organizations involved
1
Leaked or at risk
1.8K
1,845
Downtime
Unknown
Timeline
- Started, Detected 2026-10-08
- Disclosed 2026-10-09
- 1 days
Attack or cause
- Method
- [Web app exploit]
- Impact
- [Data leak]
- Entry point
- Web app
Data exposed or at risk
Services hit
Organizations involved
[Breached][Major]Tokyo, ShibuyaInformation and communications1,845 leaked
coconala Inc.
Sources
- [1][Official]「ココナラスキルマーケット」への不正アクセスによる個人情報漏洩に関するお詫びとお知らせcoconala · 2026-10-09