Medical reservations, work infrastructure, personal information, and money. We list real-world impacts verified in primary sources and what remains unknown.
Research cutoff: 2026-10-28 13:18 JST. Event periods differ by case. This list is not limited to newly occurring incidents.
This is an AI translation by Codex and has not been reviewed by a native speaker. Check product names, versions, settings, and measures against the original text and official guidance.
Actual harm and business disruption confirmed
Business, medical and service disruption · Source updated: 2026-10-27
IDCF Cloud: disruption and encryption affecting 495 companies and municipalities.
Confirmed impact
VM shutdown and encryption across 4 zones in East Japan Region 1. Backup retrieval confirmed possible for 206 customers. Unauthorized queries affected portal registration information for up to 71 companies, with up to 4 unauthorized password changes.
What remains unknown
206 is not the number of completed recoveries. The company says data inside VMs was not exfiltrated and traces of registration-information exfiltration remain unconfirmed. Final recovery dates for all customers and total losses are undisclosed.
Recovery and user actions to check
Reset passwords. Support alternative-environment migration and backup retrieval.
infoQ: exfiltration of 89 ten-thousand and 4,082 records and unauthorized point exchanges
Confirmed impact
Exfiltration of 894,082 personal information records confirmed. 611 unauthorized exchanges totaling 2,869,500 yen. Service suspended since 10/3, also affecting some commissioned surveys.
What remains unknown
The initial maximum of 948,498 records is not a confirmed damage count. The vulnerability CVE, final recovery date, and total completed compensation remain unconfirmed in the text.
Recovery and user actions to check
All member passwords invalidated. Policy is to fully reimburse fraudulently exchanged points. Change passwords on other services where the same password is used.
Business, medical and service disruption · Source updated: 2026-10-28
Onamae.com: business environment shutdown and data exfiltration
Confirmed impact
Service suspended since 10/21. External exfiltration of customer information confirmed. Perpetrator site domain suspension confirmed around 04:00 on 10/28.
What remains unknown
Authenticity of published content, victim counts, and total unauthorized transaction amounts remain undetermined. Domain suspension does not mean full recovery of information or service restoration.
Recovery and user actions to check
The policy is to offer alternative services rather than restart the current infrastructure as is. Announced compensation for realized losses from confirmed unauthorized transactions and special relief payments.
Business, medical and service disruption · Source updated: 2026-10-28
@link: patient booking and related service suspension
Confirmed impact
Suspended since late night on 10/14. Database information acquisition and personal information leakage from late September (month 9) to mid-October (month 10) were confirmed. Patient apps, web reservations, and other functions remained suspended as of the 28th at 12:30.
What remains unknown
Leakage counts and the resumption date for all functions remain under investigation and verification. Starting beta testing at some medical institutions is not resumption of general availability.
Recovery and user actions to check
Block intrusion paths and disable related credentials. Contact medical institutions directly to change reservations. Set a new password upon resumption.
Business, medical and service disruption · Source updated: 2026-10-23
Aiiku Hospital: vaccination and postpartum care reservations disrupted
Confirmed impact
The Atlink suspension makes pediatric vaccination reservations, pediatric postpartum day care reservations, and consultation calling unavailable. Other web reservation systems remain available normally.
What remains unknown
This announcement does not confirm a complete clinical shutdown or harm to life. It is a user-side impact of the Atlink incident, not an independent separate attack.
Recovery and user actions to check
Check the hospital's alternative appointment guidance and contact the hospital directly about necessary procedures.
Business, medical and service disruption · Source updated: 2026-10-27
Railway: interrupted builds/deployments, suspended new registrations
Confirmed impact
There were interruptions to builds/deployments and periods when the dashboard/API/CLI/support were unavailable. New registrations remained suspended as of 10/27 15:19 UTC. Existing customer deployments are described as continuing to run.
What remains unknown
The maximum 1.85%, about 100,000 workspaces, is the potential scope of environment-variable exposure, not a confirmed count of people affected by leakage. Key-revocation notifications alone do not confirm compromise.
Recovery and user actions to check
Revoke and reissue stored secrets, and audit GitHub and registries. The next status update, scheduled for 10/28 16:00 UTC, is after this cutoff.
Personal information and secrets · Source updated: 2026-10-24
Piccoma: 100 ten-thousand and 2,404 recipient records leaked
Confirmed impact
Confirmed leakage of email addresses for 1,002,404 recipients of 1 newsletter mailing. Newsletter suspended.
What remains unknown
These are recipient counts, not global victim counts or counts across all Blastmail customers. Piccoma itself, passwords, and purchase information are described as unaffected, with normal use available.
Recovery and user actions to check
Individual notifications, regulatory reports, and changes to sender authentication settings. Watch for impersonation emails.
Business, medical and service disruption · Source updated: 2026-10-23
Ministry of the Environment: related newsletter delivery/management suspended
Confirmed impact
Delivery and management operations are unavailable for 6 related email newsletters. Management screens/API stopped at 10/21 00:30, and delivery stopped around 01:00.
What remains unknown
Leakage of recipient information is unconfirmed. Do not generalize Piccoma's findings to the Ministry of the Environment. Affected counts are unspecified.
Recovery and user actions to check
Confirm whether leakage occurred based on the operator's investigation. Resumption timing is stated as undetermined.
Personal information and secrets · Source updated: 2026-10-20
Yotsuya Medical Cube: leakage of old appointment data
Confirmed impact
Unauthorized acquisition of reservation data through an intrusion on 9/21–22 into the former outsourced reservation system “Itsuaki.” Leakage of names, phone numbers, and email addresses confirmed.
What remains unknown
Dates of birth, gender, and additional reservation fields remain under investigation. Counts are undisclosed. Impact on the current reservation system used since March (month 3) 2025 and electronic medical records, and secondary harm, are unconfirmed.
Recovery and user actions to check
Fines is contacting affected individuals in sequence. The hospital requests authority reporting, recurrence prevention, and detailed investigation, and warns against opportunistic contacts.
Backups and business continuity · Updated 10/27 14:30 UTC
ConnectWise: backup restoration, monitoring, and management functions disrupted.
Confirmed impact
Unauthorized access to application credentials and service interruption were confirmed. Backup storage, archive access, restore, SaaS monitoring, and management functions are disrupted.
What remains unknown
Customer counts, damages, and full recovery time are undisclosed. Completion of preparations for phased recovery does not confirm restoration has started.
Recovery and user actions to check
Awaiting third-party validation as of 10/27 14:30 UTC. Keep affected connections disabled until individual guidance.
LiteLLM: malicious package distribution and environment rebuilding burden
Confirmed impact
Malicious 1.107.0 and containers were actually distributed on 10/21, confirming compromise of release infrastructure.
What remains unknown
Key leakage affecting all users, affected organization counts, and total theft are undisclosed. Do not reuse damage statistics from the separate incident in March (month 3).
Recovery and user actions to check
Investigate affected installations, isolate and rebuild environments. Revoke and reissue keys that were reachable. Check the risk of startup hooks executing again before performing a simple update.
Brotli: exploitation confirmed; total downstream-product harm unknown
Confirmed impact
CISA KEV lists CVE-2026-111497 as a known exploited vulnerability.
What remains unknown
This catalog does not establish individual affected organizations, people, actual losses, or the first attack time. Installation alone does not establish compromise.
Recovery and user actions to check
Check fixes by product and series, and investigate compromise indicators separately from updates. Compare downstream embedded versions with supported versions.
Adobe Commerce: increased priority for existing fixes
Confirmed impact
CISA KEV lists CVE-2026-48356 as a known exploited vulnerability.
What remains unknown
This catalog does not establish individual affected organizations, people, actual losses, or the first attack time. Installation alone does not establish compromise.
Recovery and user actions to check
Check fixes by product and series, and investigate compromise indicators separately from updates. Compare downstream embedded versions with supported versions.
PHP: confirmed exploitation does not establish compromise of every website
Confirmed impact
CISA KEV lists CVE-2026-109618 / CVE-2026-109619 as known exploited vulnerabilities.
What remains unknown
This catalog does not establish individual affected organizations, people, actual losses, or the first attack time. Installation alone does not establish compromise.
Recovery and user actions to check
Check fixes by product and series, and investigate compromise indicators separately from updates. Compare downstream embedded versions with supported versions.
Personal information and secrets · Source updated: 2026-10-28
Studio: externally retrievable information and notification/key-rotation burdens.
Confirmed impact
Intrusion from 9/30 to 10/1; data remained externally retrievable until 10/14. Decryption keys were also read, potentially revealing form contents, API keys, and other information.
What remains unknown
Actual acquisition of information is unconfirmed. Affected counts and secondary harm are under investigation. Alteration/deletion is unconfirmed.
Recovery and user actions to check
Fix paths and rotate keys. Revoke external API keys with their issuers. The 10/28 00:30 update schedules joint-report acceptance for early November (month 11); individual notification is separate.
Crypto assets and key management · Revised 10/27 14:45 UTC
Fireblocks mpc-lib: key-share hierarchy risks; actual theft unconfirmed
Confirmed impact
CERT disclosed an issue potentially allowing access from a descendant share and chain code to an ancestor/root share of the same party.
What remains unknown
The materials do not state actual asset theft or affected customer counts. They do not establish that a transfer key independently meeting the threshold can be obtained.
Recovery and user actions to check
No fixed version is available. Protect chain codes as secrets and investigate the entire key-share hierarchy.
Selected examples. parent_incident indicates user-side effects of the same compromise and is not added as a separate incident. potential means actual acquisition is unconfirmed.
A list of cases checked against primary sources, not worldwide damage statistics. These are not this run's new incident counts.
Separate occurrence, disclosure, update, and retrieval times; preserve source units for money, people, and records. Undisclosed total losses do not mean 0 yen.
Retrieved material reflects current revisions after the cutoff. All historical text on dynamic pages cannot be fully reconstructed.
User-side impacts on the same infrastructure are linked through parent_incident. Do not add them as duplicate incidents.