Every published advisory, newest first. Use search to filter by vendor, industry, country or severity.
According to Security NEXT, Giftee Group announced that its subsidiary Giftee suffered unauthorized access exploiting a system vulnerability on October 25, 2026, resulting in a third party illicitly issuing electronic gift vouchers .
Japanese flower-delivery operator Hana Cupid (花キューピット) said on October 28 that a third party gained unauthorized access to its management system on October 14-15, and that it confirmed during its investigation on October 19 that member data had leaked .
According to BleepingComputer, Japan Airlines said Amadeus notified it on October 23 of unauthorized access to its Passenger Service System between August 10, 2023 and September 23, 2026, exposing booking codes, names and flight details of about 92,000 JAL customers, plus emails, phones and passport numbers for about 2,000; ANA, Asiana and Korean Air also confirmed impact .
According to iThome, on October 27, biotech company Tien Liang Biotech (4127) issued a material announcement on the Market Observation Post System (MOPS), stating that it recently received consumer reports of suspected personal data leakage and that an investigation revealed an automated attack on the database provided by its outsourced service platform vendor, in which partial information was unlawfully scraped .
According to iThome, apparel and textile distributor Collins Co.
According to Security NEXT, Sony Network Communications announced that the So-net member database suffered an external intrusion on October 19, 2026, which was confirmed on October 23 .
According to Security NEXT, Rakuten Travel Xchange detected anomalies on certain overseas hotel booking pages on September 10, 2026, and an investigation confirmed a compromise .
On October 28, Orange Electronic issued a material information filing on MOPS stating that some of its local area network storage devices had been hit by a ransomware attack, and its cybersecurity team immediately activated defense mechanisms and network isolation .
Stockholm open-air museum Skansen said its ticketing provider Visit suffered a data breach that also affected several of Visit's other customers, and it was informed on October 27, 2026 .
On 2026-11-06, TWCERT/CC reported two heap-based buffer overflow vulnerabilities in WatchGuard Fireware OS, tracked as CVE-2026-112709 and CVE-2026-112710 (CVSS 4.
According to iThome, on October 23, fitness service company Power Wind Health Industry (8462) issued a material announcement on the Market Observation Post System (MOPS), stating that the outsourced vendor for its e-commerce platform experienced a cybersecurity incident and that members reported suspected leakage of e-commerce order data .
Query responses from the Central Election Commission (CEC) candidate asset declaration website included non-public National ID numbers of candidates that could be retrieved via browser developer tools; after a civic developer discovered and reported the issue on October 27, the CEC suspended the service that same day to fix the bug and stated on October 28 that preliminary findings pointed to an outsourced vendor error .
Mirae Asset Life said it detected anomalies in some systems on October 25, 2026, recognised a cyber intrusion, and confirmed a personal data leak early on October 26 after analysis with an outside firm .
Plenitude On The Road told customers it detected unauthorized access to its customer database between October 19 and 20, 2026, with some personal data exfiltrated .
Korean enterprise software vendor Douzone Bizon said on October 23, 2026 that attackers used a flaw in the backup solution behind its APO backup service to exfiltrate some encrypted data from backup servers, adding that it has found no sign the encryption keys leaked and has not yet identified affected customers or individuals .
On 2026-11-06, TWCERT/CC reported multiple high-risk vulnerabilities in HPE Networking AOS-10 and AOS-8, including authentication bypass, buffer overflow, SQL injection, command injection, and sensitive information disclosure .
According to iThome, on October 22, emerging stock outdoor apparel and mountaineering gear company Atunas (2940) issued a cybersecurity material announcement on the Market Observation Post System (MOPS), stating that the database of its outsourced service platform vendor suffered an automated attack in which partial information was unlawfully scraped, and that consumers reported suspected personal data leakage the same day .
BleepingComputer reports that cloud hosting provider Railway published an incident report confirming attackers obtained its internal source code and decrypted environment variables for at most 1.
CVERC warned of multiple Weaxor ransomware attacks in China, with files renamed with ".
Quest Diagnostics told the SEC it learned on October 21, 2026 of unauthorized access to its Quanum LSM system, which clients use to place test orders and look up results, and believes an unauthorized party accessed certain patient records .