Industry
OTC-listed Hi-Lai Foods (1268) said in a November 10 material announcement that it was notified that day by its outsourced shopping mall vendor Cyberbiz of a security incident in which part of the vendor database was accessed without authorization, involving order data of some customers of its online mall .
CNA reports that Taiwanese online travel agency ezTravel detected an external attack on its member center on Nov 7, and some historical order contact data was improperly obtained, affecting more than 690,000 people .
Japanese indoor golf school operator Step Golf said in a second notice on Nov 10 that it was accessed without authorization on Oct 23 and 25, and database backup files containing personal data were very likely leaked .
According to Security NEXT, Denny's Japan discovered on October 30, 2026 that application-related systems had been breached by a third party, potentially exposing personal data of legacy app customers .
According to Security NEXT, the operator of Sukesan Udon stated that a server misconfiguration at contractor Caho Enterprise may have allowed external parties to view personal data of current and former employees .
According to Security NEXT, Club Tourism detected third-party access to its servers on October 30, 2026; subsequent investigation confirmed the intrusion vector and method, indicating that some personal data may have been exfiltrated .
According to Security NEXT, Matsuya Foods discovered on October 28, 2026, that its official app management system was breached by a third party, resulting in a leak of member information .
According to Security NEXT, Doutor Coffee detected a system intrusion on October 20, 2026, potentially exposing personal data of current and former employees .
According to Security NEXT, the official Fuji-Q Highland app and CLUB Fuji-Q membership website suffered a password list (credential stuffing) attack between September 4 and 7, 2026 .
According to Security NEXT, Rakuten Travel Xchange detected anomalies on certain overseas hotel booking pages on September 10, 2026, and an investigation confirmed a compromise .
According to iThome, on October 21, Gourmet Master Co.
Japan's Adventure Inc.
According to INTERNET Watch, Japan's Daiichi Kosho announced on October 8 that a PC of an employee at Nippon Columbia Group, which handles personal data on its behalf, was infected with malware on October 1-2, putting names, gender, birth dates, emails and phones of about 8,724,000 Big Echo and other store members and staff at risk, without passwords .
Japanese restaurant group Monogatari Corporation said on October 5 that the member management system of its Yakiniku King official app was accessed by a third party on October 2, and that it confirmed a leak of member data on October 3 .
IDScan.
According to The Independent, Chick-fil-A is notifying customers nationwide that unauthorized parties may have accessed personal and account information after an automated attack on its website and app in June; according to TechRadar, credential stuffing between June 17 and 19 breached thousands of accounts .
According to BleepingComputer, Carnival began notifying 5,995,277 people that attackers used social engineering in April to deceive an employee, accessed part of its IT systems and stole personal data, which the company confirmed was copied on April 22 .
According to TechCrunch, Booking.
According to The Register, Basic-Fit, Europe's largest gym chain, confirmed data of around one million customers including bank details was stolen, from the system that records members' club visits .
According to CyberInsider, Panera Bread suffered a breach in January 2026 exposing 14 million customer records containing 5.