[Investigating][Severity: Critical][Credential abuse]

Scala Communications: unauthorized access to the i-ask FAQ system

Attackers logged in to the admin console of the i-ask FAQ system from the evening of 2 October to the morning of 3 October. Up to 713,126 inquiry records of up to five client companies may have leaked; Daiwa Securities, Citizen Watch, Sompo Japan and ORIX Life disclosed impact on their customers. On 16 October, Orix Life separately added possible exposure of about 2,100 company/contractor staff and retiree records, with names, emails and administrator IDs.

Disclosed

2026-10-05

Organizations involved

Leaked or at risk

713.1K

713,126

Downtime

Unknown

Timeline

Started 2026-10-02
Detected 2026-10-03
Disclosed 2026-10-05
3 days

Attack or cause

Method: [Credential abuse]
Impact: [Data leak]
Entry point: Stolen credentials
Affected, as stated: 5

Data exposed or at risk

[Name][E-mail address][Phone number]

Supply chain

Scala Communications, Inc.

[Breached]

Scala Communications, Inc.

[Breached]

Affected, as stated: 5
Organizations listed on this site: 6

Services hit

[Breached][Critical]
i-ask

Service	Role	Impact level	Note
i-ask	[Breached]	[Critical]

Organizations involved

[Through a supplier][Critical]Tokyo, ChiyodaFinance and insurance220,000 leaked
Daiwa Securities Co., Ltd.
About 110,000 people and 220,000 records; disclosed 5 October.
[Through a supplier][Critical]Tokyo, NishitokyoManufacturing100,000 leaked
Citizen Watch Co., Ltd.
[Breached][Critical]Tokyo, ShibuyaInformation and communications
Scala Communications, Inc.
[Through a supplier][Major]Tokyo, ShinjukuFinance and insurance60,000 leaked
Sompo Japan Insurance Inc.
[Through a supplier][Major]Tokyo, ChiyodaFinance and insurance26,500 leaked
ORIX Life Insurance Corporation
Separately from about 26,500 customer records, its 16 October follow-up added about 2,100 company/contractor staff and retiree records: names, emails and administrator IDs.
[Through a supplier][Moderate]Tokyo, SumidaTransport and postal services
Tobu Railway Co., Ltd.
No trace of a leak found.

						Note
Daiwa Securities Co., Ltd.	[Through a supplier]	[Critical]	Tokyo, Chiyoda	Finance and insurance	220,000	About 110,000 people and 220,000 records; disclosed 5 October.
Citizen Watch Co., Ltd.	[Through a supplier]	[Critical]	Tokyo, Nishitokyo	Manufacturing	100,000
Scala Communications, Inc.	[Breached]	[Critical]	Tokyo, Shibuya	Information and communications	Unknown
Sompo Japan Insurance Inc.	[Through a supplier]	[Major]	Tokyo, Shinjuku	Finance and insurance	60,000
ORIX Life Insurance Corporation	[Through a supplier]	[Major]	Tokyo, Chiyoda	Finance and insurance	26,500	Separately from about 26,500 customer records, its 16 October follow-up added about 2,100 company/contractor staff and retiree records: names, emails and administrator IDs.
Tobu Railway Co., Ltd.	[Through a supplier]	[Moderate]	Tokyo, Sumida	Transport and postal services	Unknown	No trace of a leak found.

Open in organization search

Sources

[1][News]スカラコミュニケーションズのFAQシステムに不正アクセスINTERNET Watch
[2][News]FAQシステム「i-ask」に不正アクセスITmedia NEWS · 2026-10-06
[3][News]大和証券、問い合わせ管理サービスへの不正アクセスで約11万人の利用者情報漏えいの可能性INTERNET Watch · 2026-10-05
[4][Official]当社連結子会社における不正アクセスによる個人情報漏えいに関するお詫びとお知らせScala · 2026-10-06
[5][Official]当社の委託先における個人情報漏えいの可能性について（続報）ORIX Life Insurance · 2026-10-16