{
  "cutoff": "2026-10-29T05:01:25Z",
  "records": [
    {
      "id": "idcf-real-impact",
      "title": "IDCF Cloud: disruption and encryption affecting 495 companies and municipalities.",
      "confirmed": "VM shutdown and encryption across 4 zones in East Japan Region 1. Backup retrieval confirmed possible for 206 customers. Unauthorized queries affected portal registration information for up to 71 companies, with up to 4 unauthorized password changes.",
      "unknown": "206 is not the number of completed recoveries. The company says data inside VMs was not exfiltrated and traces of registration-information exfiltration remain unconfirmed. Final recovery dates for all customers and total losses are undisclosed.",
      "response": "Reset passwords. Support alternative-environment migration and backup retrieval.",
      "status": "confirmed-impact",
      "category": "Business, healthcare and service disruption",
      "sources": [
        {
          "name": "IDCF第7報・10月27日",
          "url": "https://www.idcf.jp/news/topics/20261027001/"
        }
      ],
      "event_date": "2026-10-07",
      "source_date": "2026-10-27",
      "as_of": "Source updated: 2026-10-27 / source rechecked; overall recovery not established",
      "total_loss_jpy": null,
      "monitoring_status": "rechecked-source",
      "checked_at": "2026-10-29T05:01:25Z",
      "recovery_state": "not-established"
    },
    {
      "id": "infoq-real-impact",
      "title": "infoQ: exfiltration of 89 ten-thousand and 4,082 records and unauthorized point exchanges",
      "confirmed": "Exfiltration of 894,082 personal information records confirmed. 611 unauthorized exchanges totaling 2,869,500 yen. Service suspended since 10/3, also affecting some commissioned surveys.",
      "unknown": "The initial maximum of 948,498 records is not a confirmed damage count. The vulnerability CVE, final recovery date, and total completed compensation remain unconfirmed in the text.",
      "response": "All member passwords invalidated. Policy is to fully reimburse fraudulently exchanged points. Change passwords on other services where the same password is used.",
      "status": "confirmed-impact",
      "category": "Confirmed financial impact",
      "sources": [
        {
          "name": "infoQ第2報・10月14日",
          "url": "https://gmo-research.ai/pressroom/notice/notice-20261014"
        }
      ],
      "event_date": "2026-10-03",
      "source_date": "2026-10-14",
      "as_of": "Source updated: 2026-10-14 / source rechecked; overall recovery not established",
      "total_loss_jpy": null,
      "reported_financial_impact": {
        "amount": 2869500,
        "currency": "JPY",
        "unit": "unauthorized point exchanges",
        "count": 611,
        "is_total_incident_loss": false
      },
      "monitoring_status": "rechecked-source",
      "checked_at": "2026-10-29T05:01:25Z",
      "recovery_state": "not-established"
    },
    {
      "id": "gmo-real-impact",
      "title": "Onamae.com: business environment shutdown and data exfiltration",
      "confirmed": "Service has been suspended since 10/21, with external removal of customer information confirmed. The company confirmed domain takedown around 04:00 on 10/28. Notice 15 says potentially useful leads are being assessed.",
      "unknown": "Authenticity of published content, victim counts, and total unauthorized transaction amounts remain undetermined. Domain suspension does not mean full recovery of information or service restoration.",
      "response": "The policy is to offer alternative services rather than restart the current infrastructure as is. Announced compensation for realized losses from confirmed unauthorized transactions and special relief payments.",
      "status": "confirmed-impact",
      "category": "Business, healthcare and service disruption",
      "sources": [
        {
          "name": "GMO第4報",
          "url": "https://group.gmo/info/alert/20261024/"
        },
        {
          "name": "GMO第12報",
          "url": "https://group.gmo/info/alert/2026102705/"
        },
        {
          "name": "GMO第13報・10月28日11時",
          "url": "https://group.gmo/info/alert/20261028/"
        },
        {
          "name": "GMO notice 15",
          "url": "https://group.gmo/info/alert/20261029/"
        }
      ],
      "event_date": "2026-10-21",
      "source_date": "2026-10-29",
      "as_of": "Source updated: 2026-10-29 / source rechecked; overall recovery not established",
      "total_loss_jpy": null,
      "monitoring_status": "updated",
      "checked_at": "2026-10-29T05:01:25Z",
      "recovery_state": "not-established"
    },
    {
      "id": "atlink-real-impact",
      "title": "@link: patient booking and related service suspension",
      "confirmed": "Suspended since late night on 10/14. Database information acquisition and personal information leakage from late September (month 9) to mid-October (month 10) were confirmed. Patient apps, web reservations, and other functions remained suspended as of the 28th at 12:30.",
      "unknown": "Leakage counts and the resumption date for all functions remain under investigation and verification. Starting beta testing at some medical institutions is not resumption of general availability.",
      "response": "Block intrusion paths and disable related credentials. Contact medical institutions directly to change reservations. Set a new password upon resumption.",
      "status": "confirmed-impact",
      "category": "Business, healthcare and service disruption",
      "sources": [
        {
          "name": "メドレー調査案内",
          "url": "https://www.medley.jp/notice/20261015.html"
        },
        {
          "name": "アットリンク調査状況",
          "url": "https://at-link.net/information/アットリンクへの不正アクセスに関する調査状況/"
        },
        {
          "name": "運営状況・10月28日12時30分",
          "url": "https://at-link.net/information/アットリンクへの不正アクセスおよびサービスの/"
        }
      ],
      "event_date": "2026-10-14",
      "source_date": "2026-10-28",
      "as_of": "Source updated: 2026-10-28 / source rechecked; overall recovery not established",
      "total_loss_jpy": null,
      "monitoring_status": "rechecked-source",
      "checked_at": "2026-10-29T05:01:25Z",
      "recovery_state": "not-established"
    },
    {
      "id": "aiiku-atlink-impact",
      "title": "Aiiku Hospital: vaccination and postpartum care reservations disrupted",
      "confirmed": "The Atlink suspension makes pediatric vaccination reservations, pediatric postpartum day care reservations, and consultation calling unavailable. Other web reservation systems remain available normally.",
      "unknown": "This announcement does not confirm a complete clinical shutdown or harm to life. It is a user-side impact of the Atlink incident, not an independent separate attack.",
      "response": "Check the hospital's alternative appointment guidance and contact the hospital directly about necessary procedures.",
      "status": "confirmed-impact",
      "category": "Business, healthcare and service disruption",
      "sources": [
        {
          "name": "愛育病院・10月23日更新",
          "url": "https://www.aiiku.net/news/news-3482/"
        }
      ],
      "source_date": "2026-10-23",
      "parent_incident": "atlink-real-impact",
      "as_of": "Source updated: 2026-10-23 / source rechecked; overall recovery not established",
      "total_loss_jpy": null,
      "monitoring_status": "rechecked-source",
      "checked_at": "2026-10-29T05:01:25Z",
      "recovery_state": "not-established"
    },
    {
      "id": "railway-real-impact",
      "title": "Railway: interrupted builds/deployments, suspended new registrations",
      "confirmed": "There were interruptions to builds/deployments and periods when the dashboard/API/CLI/support were unavailable. New registrations remained suspended as of 10/27 15:19 UTC. Existing customer deployments are described as continuing to run.",
      "unknown": "The maximum 1.85%, about 100,000 workspaces, is the potential scope of environment-variable exposure, not a confirmed count of people affected by leakage. Key-revocation notifications alone do not confirm compromise.",
      "response": "Revoke and reissue stored secrets, and audit GitHub and registries. The next status update, scheduled for 10/28 16:00 UTC, is after this cutoff.",
      "status": "confirmed-impact",
      "category": "Business, healthcare and service disruption",
      "sources": [
        {
          "name": "Railway一次報告",
          "url": "https://blog.railway.com/p/preliminary-report-october-security-incident"
        },
        {
          "name": "Railway status",
          "url": "https://status.railway.com/"
        }
      ],
      "event_date": "2026-10-20",
      "source_date": "2026-10-27",
      "as_of": "Source updated: 2026-10-27 / source rechecked; overall recovery not established",
      "total_loss_jpy": null,
      "monitoring_status": "rechecked-source",
      "checked_at": "2026-10-29T05:01:25Z",
      "recovery_state": "not-established"
    },
    {
      "id": "piccoma-blastmail-impact",
      "title": "Piccoma: 100 ten-thousand and 2,404 recipient records leaked",
      "confirmed": "Confirmed leakage of email addresses for 1,002,404 recipients of 1 newsletter mailing. Newsletter suspended.",
      "unknown": "These are recipient counts, not global victim counts or counts across all Blastmail customers. Piccoma itself, passwords, and purchase information are described as unaffected, with normal use available.",
      "response": "Individual notifications, regulatory reports, and changes to sender authentication settings. Watch for impersonation emails.",
      "status": "confirmed-impact",
      "category": "Personal information and secrets",
      "sources": [
        {
          "name": "ピッコマ第1報・10月24日",
          "url": "https://jp.piccoma.com/web/notice_detail/7503"
        }
      ],
      "source_date": "2026-10-24",
      "parent_incident": "blastmail",
      "as_of": "Source updated: 2026-10-24 / source rechecked; overall recovery not established",
      "total_loss_jpy": null,
      "monitoring_status": "rechecked-source",
      "checked_at": "2026-10-29T05:01:25Z",
      "recovery_state": "not-established"
    },
    {
      "id": "environment-blastmail-impact",
      "title": "Ministry of the Environment: related newsletter delivery/management suspended",
      "confirmed": "Delivery and management operations are unavailable for 6 related email newsletters. Management screens/API stopped at 10/21 00:30, and delivery stopped around 01:00.",
      "unknown": "Leakage of recipient information is unconfirmed. Do not generalize Piccoma's findings to the Ministry of the Environment. Affected counts are unspecified.",
      "response": "Confirm whether leakage occurred based on the operator's investigation. Resumption timing is stated as undetermined.",
      "status": "confirmed-impact",
      "category": "Business, healthcare and service disruption",
      "sources": [
        {
          "name": "環境省・10月23日",
          "url": "https://www.env.go.jp/press/press_05784.html"
        }
      ],
      "source_date": "2026-10-23",
      "parent_incident": "blastmail",
      "as_of": "Source updated: 2026-10-23 / source rechecked; overall recovery not established",
      "total_loss_jpy": null,
      "monitoring_status": "rechecked-source",
      "checked_at": "2026-10-29T05:01:25Z",
      "recovery_state": "not-established"
    },
    {
      "id": "studio-real-impact",
      "title": "Studio: externally retrievable information and notification/key-rotation burdens.",
      "confirmed": "Intrusion from 9/30 to 10/1; data remained externally retrievable until 10/14. Decryption keys were also read, potentially revealing form contents, API keys, and other information.",
      "unknown": "Actual acquisition of information is unconfirmed. Affected counts and secondary harm are under investigation. Alteration/deletion is unconfirmed.",
      "response": "Fix paths and rotate keys. Revoke external API keys with their issuers. The 10/28 00:30 update schedules joint-report acceptance for early November (month 11); individual notification is separate.",
      "status": "potential",
      "category": "Personal information and secrets",
      "sources": [
        {
          "name": "Studio公式ポータル",
          "url": "https://studio.design/ja/security/notice/2026-10-incident"
        }
      ],
      "source_date": "2026-10-28",
      "as_of": "Source updated: 2026-10-28 / source rechecked; overall recovery not established",
      "total_loss_jpy": null,
      "monitoring_status": "rechecked-source",
      "checked_at": "2026-10-29T05:01:25Z",
      "recovery_state": "not-established"
    },
    {
      "id": "yotsuya-itsuaki-impact",
      "title": "Yotsuya Medical Cube: leakage of old appointment data",
      "confirmed": "Unauthorized acquisition of reservation data through an intrusion on 9/21–22 into the former outsourced reservation system “Itsuaki.” Leakage of names, phone numbers, and email addresses confirmed.",
      "unknown": "Dates of birth, gender, and additional reservation fields remain under investigation. Counts are undisclosed. Impact on the current reservation system used since March (month 3) 2025 and electronic medical records, and secondary harm, are unconfirmed.",
      "response": "Fines is contacting affected individuals in sequence. The hospital requests authority reporting, recurrence prevention, and detailed investigation, and warns against opportunistic contacts.",
      "status": "confirmed-impact",
      "category": "Personal information and secrets",
      "sources": [
        {
          "name": "四谷メディカルキューブ・10月20日",
          "url": "https://www.mcube.jp/news/20261020.html"
        }
      ],
      "event_date": "2026-09-21",
      "source_date": "2026-10-20",
      "as_of": "Source updated: 2026-10-20 / source rechecked; overall recovery not established",
      "total_loss_jpy": null,
      "monitoring_status": "rechecked-source",
      "checked_at": "2026-10-29T05:01:25Z",
      "recovery_state": "not-established"
    },
    {
      "id": "connectwise-real-impact",
      "title": "ConnectWise: backup restoration, monitoring, and management functions disrupted.",
      "confirmed": "Unauthorized access to application credentials and service interruption were confirmed. Backup storage, archive access, restore, SaaS monitoring, and management functions are disrupted.",
      "unknown": "Customer counts, damages, and full recovery time are undisclosed. Completion of preparations for phased recovery does not confirm restoration has started.",
      "response": "Awaiting third-party validation as of 10/27 14:30 UTC. Keep affected connections disabled until individual guidance.",
      "status": "confirmed-impact",
      "category": "Backups and business continuity",
      "as_of": "Updated 10/27 14:30 UTC / source rechecked; overall recovery not established",
      "total_loss_jpy": null,
      "sources": [
        {
          "name": "ConnectWise Trust Center",
          "url": "https://www.connectwise.com/company/trust/advisories"
        }
      ],
      "monitoring_status": "rechecked-source",
      "checked_at": "2026-10-29T05:01:25Z",
      "recovery_state": "not-established"
    },
    {
      "id": "litellm-distribution-impact",
      "title": "LiteLLM: malicious package distribution and environment rebuilding burden",
      "confirmed": "Malicious 1.107.0 and containers were actually distributed on 10/21, confirming compromise of release infrastructure.",
      "unknown": "Key leakage affecting all users, affected organization counts, and total theft are undisclosed. Do not reuse damage statistics from the separate incident in March (month 3).",
      "response": "Investigate affected installations, isolate and rebuild environments. Revoke and reissue keys that were reachable. Check the risk of startup hooks executing again before performing a simple update.",
      "status": "confirmed-impact",
      "category": "Software supply chain",
      "as_of": "10/21 incident / 10/23 analysis / source rechecked; overall recovery not established",
      "total_loss_jpy": null,
      "sources": [
        {
          "name": "LiteLLM公式事件報告",
          "url": "https://docs.litellm.ai/blog/security-incident-oct-21-2026"
        },
        {
          "name": "公式攻撃連鎖分析",
          "url": "https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain"
        }
      ],
      "monitoring_status": "rechecked-source",
      "checked_at": "2026-10-29T05:01:25Z",
      "recovery_state": "not-established"
    },
    {
      "id": "brotli-exploitation",
      "title": "Brotli: exploitation confirmed; total downstream-product harm unknown",
      "confirmed": "CISA KEV lists CVE-2026-111497 as a known exploited vulnerability.",
      "unknown": "This catalog does not establish individual affected organizations, people, actual losses, or the first attack time. Installation alone does not establish compromise.",
      "response": "Check fixes by product and series, and investigate compromise indicators separately from updates. Compare downstream embedded versions with supported versions.",
      "status": "exploitation-confirmed",
      "category": "Exploited vulnerabilities",
      "as_of": "KEV2026.10.27 edition / source rechecked; overall recovery not established",
      "total_loss_jpy": null,
      "sources": [
        {
          "name": "CISA公式KEV",
          "url": "https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json"
        }
      ],
      "monitoring_status": "rechecked-source",
      "checked_at": "2026-10-29T05:01:25Z",
      "recovery_state": "not-established"
    },
    {
      "id": "commerce-exploitation",
      "title": "Adobe Commerce: increased priority for existing fixes",
      "confirmed": "CISA KEV lists CVE-2026-48356 as a known exploited vulnerability.",
      "unknown": "This catalog does not establish individual affected organizations, people, actual losses, or the first attack time. Installation alone does not establish compromise.",
      "response": "Check fixes by product and series, and investigate compromise indicators separately from updates. Compare downstream embedded versions with supported versions.",
      "status": "exploitation-confirmed",
      "category": "Exploited vulnerabilities",
      "as_of": "KEV2026.10.27 edition / source rechecked; overall recovery not established",
      "total_loss_jpy": null,
      "sources": [
        {
          "name": "CISA公式KEV",
          "url": "https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json"
        }
      ],
      "monitoring_status": "rechecked-source",
      "checked_at": "2026-10-29T05:01:25Z",
      "recovery_state": "not-established"
    },
    {
      "id": "php-exploitation",
      "title": "PHP: confirmed exploitation does not establish compromise of every website",
      "confirmed": "CISA KEV lists CVE-2026-109618 / CVE-2026-109619 as known exploited vulnerabilities.",
      "unknown": "This catalog does not establish individual affected organizations, people, actual losses, or the first attack time. Installation alone does not establish compromise.",
      "response": "Check fixes by product and series, and investigate compromise indicators separately from updates. Compare downstream embedded versions with supported versions.",
      "status": "exploitation-confirmed",
      "category": "Exploited vulnerabilities",
      "as_of": "KEV2026.10.27 edition / source rechecked; overall recovery not established",
      "total_loss_jpy": null,
      "sources": [
        {
          "name": "CISA公式KEV",
          "url": "https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json"
        }
      ],
      "monitoring_status": "rechecked-source",
      "checked_at": "2026-10-29T05:01:25Z",
      "recovery_state": "not-established"
    },
    {
      "id": "fireblocks-potential",
      "title": "Fireblocks mpc-lib: key-share hierarchy risks; actual theft unconfirmed",
      "confirmed": "CERT disclosed an issue potentially allowing access from a descendant share and chain code to an ancestor/root share of the same party.",
      "unknown": "The materials do not state actual asset theft or affected customer counts. They do not establish that a transfer key independently meeting the threshold can be obtained.",
      "response": "No fixed version is available. Protect chain codes as secrets and investigate the entire key-share hierarchy.",
      "status": "potential",
      "category": "Crypto assets and key management",
      "as_of": "Revised 10/27 14:45 UTC / source rechecked; overall recovery not established",
      "total_loss_jpy": null,
      "sources": [
        {
          "name": "CERT VU701544",
          "url": "https://kb.cert.org/vuls/id/701544"
        }
      ],
      "monitoring_status": "rechecked-source",
      "checked_at": "2026-10-29T05:01:25Z",
      "recovery_state": "not-established"
    },
    {
      "id": "sonet-real-impact",
      "title": "So-net: member information and some email passwords exposed",
      "confirmed": "Disclosure of 2,141,986 So-net member records and 443,495 plala (S course) member records. Email passwords in some mail services were also exposed and reset. Bank-account information: 16 records; notification information: 7 records.",
      "unknown": "Categories may overlap; do not add them as a count of people. Root cause and total losses remain undetermined. Distinguish member-account passwords from the affected email passwords.",
      "response": "Reset affected email passwords using official guidance and change reused passwords. Avoid links in unsolicited incident-related email.",
      "status": "confirmed-impact",
      "category": "Personal information and credentials",
      "sources": [
        {
          "name": "Sony Network Communications PDF",
          "url": "https://www.sonynetwork.co.jp/corporation/release/2026/v5e5u00000000zwj-att/20261027.pdf"
        }
      ],
      "event_date": "2026-10-19",
      "source_date": "2026-10-27",
      "as_of": "Source updated: 2026-10-27",
      "total_loss_jpy": null,
      "recovery_state": "response-in-progress",
      "monitoring_status": "newly-covered",
      "checked_at": "2026-10-29T05:01:25Z"
    },
    {
      "id": "unm-recovered-impact",
      "title": "UNM Health: clinical and academic recovery, with a warning about follow-on scams",
      "confirmed": "Ambulance diversion, interrupted outpatient surgery and appointments, and suspended classes on 10/26. The official 10/28 update confirms fully functional clinical services and resumed classes and research.",
      "unknown": "Disclosure counts and losses remain undetermined. The institution describes impact on some devices and denies penetration of core systems. Attacker claims are not confirmed disclosure.",
      "response": "Reschedule interrupted care through official channels. Do not engage with purported attackers or compensation offers.",
      "status": "confirmed-impact",
      "category": "Business, healthcare and service disruption",
      "sources": [
        {
          "name": "UNM HSC official update",
          "url": "https://hscnews.unm.edu/news/ambulance-traffic-diverted-clinical-appointments-cancelled-and-classes-cancelled-due-to-cybersecurity-issue-at-unm-hsc"
        }
      ],
      "event_date": "2026-10-26",
      "source_date": "2026-10-28",
      "as_of": "Source updated: 2026-10-28",
      "total_loss_jpy": null,
      "recovery_state": "restored-per-organization",
      "monitoring_status": "newly-covered",
      "checked_at": "2026-10-29T05:01:25Z"
    },
    {
      "id": "kernel-exploitation",
      "title": "KEV: Linux privilege escalation and missing ESX logging added",
      "confirmed": "CISA lists known exploitation of CVE-2026-46300 and chaining with PHP vulnerabilities.",
      "unknown": "Worldwide victim counts and losses are unknown. KEV listing does not establish compromise of every product or deployment.",
      "response": "Update kernels and embedded products, verify running versions, and investigate credentials and management infrastructure where compromise is suspected.",
      "status": "exploitation-confirmed",
      "category": "Known exploitation; impact scale unknown",
      "sources": [
        {
          "name": "CISA KEV",
          "url": "https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json"
        }
      ],
      "event_date": null,
      "source_date": "2026-10-28",
      "as_of": "Source updated: 2026-10-28",
      "total_loss_jpy": null,
      "recovery_state": "not-established",
      "monitoring_status": "newly-covered",
      "checked_at": "2026-10-29T05:01:25Z"
    }
  ],
  "cutoff_jst": "2026-10-29T14:01:25+09:00",
  "caveats": [
    "Selected examples. parent_incident indicates user-side effects of the same compromise and is not added as a separate incident. potential means actual acquisition is unconfirmed.",
    "A list of cases checked against primary sources, not worldwide damage statistics. These are not this run's new incident counts.",
    "Separate occurrence, disclosure, update, and retrieval times; preserve source units for money, people, and records. Undisclosed total losses do not mean 0 yen.",
    "Retrieved material reflects current revisions after the cutoff. All historical text on dynamic pages cannot be fully reconstructed.",
    "User-side impacts on the same infrastructure are linked through parent_incident. Do not add them as duplicate incidents.",
    "The newly covered healthcare recovery follows the institution’s official statement. Existing source dates remain; re-fetching does not make an incident new."
  ],
  "locale": "en",
  "translation": {
    "source_hash": "9c6901447998ef9bf043fcf53c15f5eb60ff57eb75fb975b586cc18804c34241",
    "register_hash": "55a4ba495639e9b9f53e0a350307c3fd50ab0d5aafb19b917e4eb163ee1c089e",
    "human_reviewed": false
  }
}