Researcher found hardcoded credentials in Applebee's mobile app

  Iris Ohyama, one of Japan's most recognized consumer goods manufacturers, has disclosed that a third-party cloud service used by its online shopping platform was accessed without authorization, potentially exposing personal data belonging to roughly 7.7 million people, including customers who never created an account. The company, founded in 1971 and headquartered in Sendai, is best known for plastic storage solutions and home appliances sold across Asia, Europe, and North America. Its e-commerce platform, Iris Plaza, caters to millions of customers in Japan and handles a large volume of household product purchases. The scale of the breach puts it among the larger data security incidents Japan has seen this year, in a period when Japanese companies and government agencies have dealt with a string of serious intrusions. How the Breach Was Detected On October 28, 2026, Iris Ohyama staff detected suspicious files inside a cloud service that Iris Plaza relies on for its operations. The company did not name the cloud provider or describe the method the attacker used to get in. Within a day, the company suspended access to Iris Plaza and related systems, reported the incident to Japan's Personal Information Protection Commission, and filed a report with police. A follow-up disclosure on November 5 gave a clearer picture of the scope: up to 5.8 million registered and former members may have had their data accessed, along with up to 1.9 million non-members, meaning people who had completed a guest checkout without registering. The fact that guest buyers are part of the exposure is insurmountable, since many people assume their data is not retained when they shop without creating an account. In Iris Plaza's case, it was. What Data Was in the Affected System The range of information potentially accessed varies depending on the type of account. For registered members, exposed fields can include full name, home address, phone number, email address, gender, and date of birth. Account passwords were also stored in the affected environment, though the company said they were encrypted. It did not specify which encryption method was used, leaving questions open about how resistant those passwords are to cracking. Former members are in a slightly different position: Iris Ohyama said it does not retain passwords for accounts that have been closed, so that group faces a narrower exposure. For non-members who checked out as guests, the data stored was more limited. One notable reassurance: the company confirmed that credit card information was not stored in the affected cloud environment, sparing customers from the most immediately damaging form of financial exposure. As of November 5, Iris Ohyama said it had not received any communication from whoever carried out the intrusion, had not identified any perpetrators, and had not seen reports of fraudulent use or financial damage tied to the breach. The investigation into how many records were actually exfiltrated, as opposed to merely accessible, is still ongoing. What Iris Plaza Customers Should Do Now The company has urged customers to change their Iris Plaza passwords and, critically, to change passwords on any other service where they used the same credentials. Password reuse across sites remains one of the most common ways a single breach cascades into wider account takeovers. Anyone who shops with the same email and password combination across multiple retail or financial platforms is at elevated risk. Iris Ohyama also warned customers to be on guard for phishing attempts. With names, addresses, phone numbers, and email addresses potentially in circulation, attackers have enough to craft convincing messages that appear to come from the company. Iris Ohyama said it will not send emails or SMS messages asking for passwords, PINs, authentication codes, or other sensitive information through links, and customers should treat any such request as fraudulent. A Year of Costly Data Incidents in Japan The Iris Ohyama breach lands in the middle of a rough stretch for data security in Japan. This year alone, cloud hosting provider Sakura Internet reported a hack affecting up to 1.36 million accounts, telecommunications giant KDDI disclosed a breach tied to a zero-day vulnerability in third-party software that hit around 12 million accounts across shared email platforms, and Japan's Digital Agency acknowledged that a VPN flaw exposed approximately 246,000 government personnel records. The common thread across several of these incidents is reliance on third-party services and cloud environments where access controls or vendor security fell short. Iris Ohyama's breach fits that pattern. A third-party cloud provider, an intrusion the retailer only caught when suspicious files turned up, and millions of customer records sitting in an environment the company did not fully control. The investigation remains open, and the company has not said when it expects to restore Iris Plaza to service.

Ford said it's making an "explicit commitment" to its customers that "their vehicle data is safe" with the company.

 Genesys, a California-based provider of customer experience and call-center technology, has disclosed a cyberattack in which unauthorized actors accessed data from internal business systems. The company said the incident affected a learning management system and a customer relationship management environment, but stressed that its core customer-facing platforms were not compromised.  According to Genesys, attackers likely downloaded business and account information used to manage relationships with current and prospective customers. The exposed information may include names, phone numbers, business email addresses, job titles, company and account details, and other customer-interaction data. While such records can be valuable for phishing and social-engineering schemes, Genesys has not said how many individuals or organizations were affected.  The company said it acted quickly to contain the breach, including suspending the LMS platform. By October 23, Genesys announced that the incident had been fully contained, although its investigation into the scope and impact remains ongoing. It has promised further updates as it reviews the accessed information and confirms material facts.  Importantly, Genesys stated that its Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not affected. It said there was no unauthorized access to those platforms, customer and partner environments, or the data stored and processed within them. That distinction is significant because the company’s core platforms handle sensitive communications and operational data for enterprise clients.  Genesys has not identified the attacker, but a newly emerged group called ScarlettGroup has claimed responsibility on its leak site. The company is urging customers to stay alert for suspicious messages impersonating Genesys and emphasized that it will never request sensitive information, such as passwords, through unsolicited email or other channels. The episode is a reminder that even when primary production platforms remain secure, internal systems holding customer-relationship data can still create meaningful privacy and fraud risks.

Businesses collect customer information through websites, email campaigns, sales conversations, customer support, surveys, and social media.

SHA-256 hashing gives way to encryption for Customer Match and enhanced conversions uploads. What happens to files that advertisers already hash is not stated.

Compare customer data platform capabilities with QKS Group?s SPARK Matrix™ Q3 2026, offering vendor analysis and insights to support technology decisions.

 State Bank of India (SBI) is investigating a suspected data exposure after identifying personal information in 3,897 customer records reportedly found on the dark web. The country’s largest lender said it received alerts about the issue last week and has initiated cyber incident response procedures. The bank has also appointed an independent cybersecurity agency to assess the suspected compromise and determine the source, scope, and potential impact of the exposure.  According to SBI’s October 21 stock-exchange filing, the bank first received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In). Its initial review covered around 375,000 records found on the dark web. Of these, 3,897 records were found to contain personal customer information. SBI is now verifying whether the exposed records are genuine and complete, while also attempting to trace their origin and assess the risks for affected customers and the bank.  The exposed records reportedly included customers’ names, dates of birth, gender, registered mobile numbers, email addresses, and home addresses. They also contained branch and Customer Information File identifiers, lead IDs, and metadata linked to loan and lead records. Although the information does not appear to include banking passwords or transaction credentials, personal and loan-related details can still be misused for phishing, identity fraud, targeted scams, and social-engineering attacks.  SBI said it activated its cyber incident response and containment procedures after receiving the alerts. The bank has engaged a CERT-In-empanelled independent cybersecurity agency to investigate the matter and is working on remedial and preventive measures in line with regulatory requirements. SBI added that it is continuing to monitor the situation and will take appropriate steps to prevent similar incidents in the future.  The bank has sought to reassure customers that the incident has not materially affected its financial performance, core business operations, or ability to continue services. Core banking functions are reportedly running normally, with no disruption reported. However, customers should remain cautious: avoid clicking unexpected links claiming to be from SBI, never share OTPs, passwords, or card details, and verify suspicious communications directly through the bank’s official app, website, or customer-care channels. The investigation is ongoing, and further clarity is expected once SBI confirms whether the dark-web data is authentic and identifies how it was exposed.

SHA-256 hashing gives way to encryption for Customer Match and enhanced conversions uploads. What happens to files that advertisers already hash is not stated.

SHA-256 hashing gives way to encryption for Customer Match and enhanced conversions uploads. What happens to files that advertisers already hash is not stated.

SHA-256 hashing gives way to encryption for Customer Match and enhanced conversions uploads. What happens to files that advertisers already hash is not stated.

A consumer privacy ombudsman is a neutral expert appointed under US bankruptcy law to advise a court before a debtor sells customer data its policy shields.

A consumer privacy ombudsman is a neutral expert appointed under US bankruptcy law to advise a court before a debtor sells customer data its policy shields.

 The owner of Hobbs, Phase Eight, and Whistles has become the latest major fashion retailer to be hit by a cyberattack. The Foschini Group (TFG) confirmed that its UK business, TFG London, discovered the incident on October 11, leaving several IT systems offline and disrupting customer orders across the three brands.  Although physical stores remain open, the company said some website functions may be unavailable while its investigation continues. Customers have been warned that orders placed on or after Sunday could be delayed, and TFG has apologized for the disruption while promising further updates as appropriate.  TFG says it activated its incident-response and business-continuity plans immediately, brought in external cybersecurity specialists, and notified UK authorities. The Information Commissioner’s Office confirmed it has received a breach report from TFG Brands (London) Limited and is assessing the information provided.  There is some reassurance for shoppers: TFG London said payment processing is handled by a third party and that, based on its investigation so far, it has no reason to believe payment information is at risk. However, the company is still determining whether other personal or sensitive customer data has been compromised and says it will notify affected individuals or organizations if evidence of a breach emerges. The company has not yet explained how attackers gained access, whether ransomware was involved, or when systems will be fully restored. TFG added that its White Stuff and Inside Story businesses, along with its African and Australian operations, are unaffected because they run on separate IT systems.  The attack follows a difficult stretch for fashion retail. Last week, ASOS disclosed that an attacker impersonated a trusted contact to obtain an employee’s login credentials and access third-party platforms containing customer names and contact details. H&M is also reportedly investigating claims involving the ShinyHunters group, though it says it has found no indication that its systems were compromised.  No evidence currently connects the TFG London, ASOS, and H&M incidents, and H&M has not confirmed a breach. Still, three prominent fashion businesses facing cyber trouble in just over a week suggests that retailers remain highly attractive targets for criminals seeking customer data, operational disruption, or leverage. For TFG, the immediate priority is restoring services and establishing the scope of the incident. For customers, the case is a reminder that even when payment details appear safe, retailers may hold substantial personal information whose exposure can take days or weeks to fully assess.

Marketers are uploading customer data in AI without safety guardrails. Here are three simple rules to protect your brand without losing speed.

Advanced matching is Meta's pixel feature that adds hashed customer details such as email and phone to web events so they can be matched to Meta user accounts.

Advanced matching is Meta's pixel feature that adds hashed customer details such as email and phone to web events so they can be matched to Meta user accounts.

 Japanese entertainment group Nippon Columbia hit with malware, affecting more than 8.7 million customers and employees' personal data, according to karaoke system maker Daiichi Kosho. The company asked its customers to be cautious, but it is still unclear if their personal information was stolen or leaked.  Daiichi Kosho, Japan’s biggest karaoke company, owns 521 karaoke places and provides services for the well-known chain of Big Echo. They rely on Nippon Columbia Group (NCG) to provide customer information. NCG’s businesses range from music creation, video and game software development and distribution to artist management, making it an important supplier for the karaoke entertainment sector.  The issue was raised when NCG notified Daiichi Kosho of the incident on October 5 when the malware was found on one of the staff member's computers, which was then isolated the next day. The company then proceeded to reset all the passwords and other authentication methods and investigate the incident to determine its scope and origin.  According to Daiichi Kosho's statement, the affected information includes approximately 8,631,000 customers and 93,000 employees of the company, and it may include the full name, gender, date of birth, email address, and phone number of the affected individuals. BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining entertainments' users should be particularly wary of the security breach, as it could affect their data the most.  Daiichi Kosho reiterated that their information was not at risk and that the data contained in the breach does not include the passwords. Additionally, the company stated that there was no suspicion of unlawful interference with customer loyalty points. On the other hand, they are still not certain if the information was stolen or if it was leaked online. They are investigating the breach to find out if the data was shared, what the scope of the problem was, and if the information was shared.  The latest statement did not mention anything else about the possible leak. Customers are advised to protect themselves from scams, deception, and unlawful access to their personal information. They should be wary of strange emails, text messages, and phone numbers and avoid providing any personal and financial information. If the crooks managed to collect and compile the data of these users, it would be easy for them to engage in phishing schemes and similar scams.  BleepingComputer, as of the time of publishing this article, has not been able to find any official statement from Nippon Columbia Group about the incident. They mentioned that they contacted the company for an official comment, and they are still waiting for the response. Until an official statement is issued, the possible data theft remains an issue, as it raises several questions about the safety of the companies' data and the safety of customers' personal information.

Advanced matching is Meta's pixel feature that adds hashed customer details such as email and phone to web events so they can be matched to Meta user accounts.

Advanced matching is Meta's pixel feature that adds hashed customer details such as email and phone to web events so they can be matched to Meta user accounts.