In a third report on 31 March, Mynavi said it detected an anomaly on 5 December 2025 in a cloud service it uses and immediately blocked external access, and that on 16 January 2026 it confirmed unauthorized third-party access may have caused some personal data of general users, corporate contacts, and company and group employees to leak [1]. The possible totals are 74,224 general-user records (names, email addresses, addresses and similar), 21,609 corporate-contact records (names, employer names, email addresses and similar) and 15,672 employee records (names, work phone numbers and work email addresses), or 111,505 in all; items vary by record, and the company said credit-card data and Individual Numbers were not included. It said this was not an intrusion into its service sites or their databases, so services were unaffected, and it had not confirmed secondary harm or misuse [1]. It said it has been notifying affected people individually and that this publication stands in for anyone it could not reach; questions should go through the official temporary inquiry site, and form-operation issues can be emailed to kr-inq@mynavi.jp [1].
Backfill: this event became public on Feb 12, 2026 and we added it on Nov 12, 2026. It is not a new event.
MediumMonitoringBackfillOfficially confirmed
Mynavi says a cloud-service breach may have exposed 111,505 user, client and employee records
1 min read
- Disclosed
- Feb 12, 2026
- Occurred
- Dec 5, 2025
- Published
- Nov 12, 2026
- Last updated
- Nov 12, 2026
- Scale
- 111,505 records[1]
- CVSS basis
- Our assessment
- Attack vector
- Unknown
- Impact
- Data exfiltration
- Actor type
- Unknown
- Motivation
- Unknown
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Professional services
What to do nowOur advice
- Watch for an individual notice from Mynavi; if you did not receive one, the company said the 31 March third report stands in for that notice [1].
- If you have questions, use the official temporary inquiry site (the form published on survey.mynavi.jp) [1].
- If you have trouble with the form, email kr-inq@mynavi.jp [1].
Timeline
Technical details
Remediation
Vendor guidance
- 1Use the official temporary inquiry site if you have questions about whether you are affected mitigate[1]
Watch for an official individual notice, and use only the official temporary inquiry site or kr-inq@mynavi.jp if you have questions.
References
Official / primary1
- [1]株式会社マイナビ2026-03-31Accessed 2026-11-12Snapshot 2026-11-12 sha256 f0262f4457c0
“クレジットカード情報、マイナンバーは含まれておりません”
Expert help
Still not sure whether this affects you?
Tell us about your environment. We'll check it against this advisory, assess the risk, and give you concrete patch and monitoring steps.
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.