The security incidents disclosed in September 2026 included a series of suspected unauthorized access and data leakage incidents, primarily involving the Digital Agency's Government Solution Service and corporate recruitment management and e-commerce systems. Several cases involved suspected external leakage of personal information or unauthorized access to internal data.
Among the major security incidents disclosed in September 2026, unauthorized access related to ApplyNow, a recruitment management platform provided by a subsidiary of きちりホールディングス, was found to have potentially resulted in the external leakage of customer and applicant personal data. The period in question is believed to have run from 9 August to 7 September 2026, and abnormal access logs have also been identified.
In a case disclosed by the Digital Agency, the Government Solution Service (GSS) is believed to have been breached by exploiting a vulnerability in a VPN. It was reported that approximately 246,000 pieces of personal information relating to employees and business operators of organizations using the service may have been leaked externally. General personal information is not believed to have been included.
In Rohto Pharmaceutical's mail-order system, the possibility of unauthorized access by a third party was identified. In a follow-up report on 15 September, the company disclosed that call audio data from its customer support system and other information may also have been obtained without authorization. It also indicated that the customer management system used by the company may have been affected.
Helpfeel, which provides Gyazo, disclosed that unauthorized access exploiting a vulnerability may have resulted in the leakage from its database of approximately 23.62 million user data records and approximately 490 million image metadata records. The company stated that payment information was not leaked.