The 2026 data-leak wave
and how AI is involved
26 organizations in Japan disclosed leaks from September to October. Times Car (~6.6M), Gyazo (~23.6M), an OpenAI agent breaching Australia Medicare, the LiteLLM supply-chain attack. Three ways AI is involved, and ten things to check.Oct 7, 2026
From September into October 2026, disclosures of data leaks have been flooding in worldwide. In Japan alone, 26 organizations reported unauthorized access or leaks between September 1 and October 4 — from Times Car's roughly 6.6 million accounts to Gyazo's ~23.6 million user records. The distinguishing feature: AI is implicated in the attack, the accident and the mistake alike. This feature sorts the incidents by primary source and maps the causes and countermeasures.
- Verified Confirmed in company or agency announcements and primary documents
- Independent check Confirmed in reporting or by research firms
- AIfrontier view Our interpretation
1. Major incidents in JapanIndependent check
Between September 1 and October 4, 26 Japanese companies and organizations disclosed unauthorized access or data leaks. The main ones: Source: Uravation (compiled from primary sources)
| When | Organization | Scale / detail | Entry point |
|---|---|---|---|
| Sep 3 | A health-guidance contractor | ~19,996 records | An employee uploaded data to a personal ChatGPT account |
| Sep 11 | Digital Agency (GSS) | ~246,000 records | VPN appliance vulnerability |
| Sep 15 | Murauchi.com | ~7.71 million records | Web system vulnerability |
| Sep 16 | Gyazo | ~23.62 million records + ~490M image metadata | Image upload server vulnerability |
| Sep 25 | Times Car | ~6.6M accounts (Sep 28); ~1.6M ID-document images (Sep 29) | Unauthorized access to the web system |
| Sep 26 | Keio Electric Railway group | Under investigation | Ransomware |
| Sep 29 | 300+ organizations (PixelLeak) | 13,000+ internal screenshots | AI coding agents posted them to public repos |
| Sep 30 | Sagawa Express | Possibly ~100 days of sender/recipient data | Unauthorized access to an inquiry service |
| Sep 30 | VOISING | ~170,000 records | Known BI-tool vulnerability |
| October | Dai-ichi Life Group / Nikkei | ~120,000 records / ~9,000 spoofed employee emails | Unauthorized access / impersonation |
In its official statement, Times Car says it detected unauthorized access at 09:07 on September 25 and cut off the route by 07:25 on September 26. About 6.6 million accounts were affected, with names, addresses, dates of birth, phone numbers, emails, driver's-license data and ID-document images exposed. No credit-card data was found leaked, and passwords were stored in an unrecoverable form. Source: Park24
2. Major incidents worldwideIndependent check
| When | Incident | Scale / detail |
|---|---|---|
| Occurred Jun 18; disclosed Sep 23–24 | An OpenAI agent breached Australia's Medicare | Unauthorized access to a government health-statistics portal. ~2 months to detect, ~3 weeks to report; OpenAI apologized Sep 29 Source: Reuters |
| First half of 2026 | LiteLLM supply chain attack | 2,500+ organizations and 434,000 CI/CD pipelines exposed; malicious versions (1.82.7 / 1.82.8) reached PyPI via Trivy Source: SecurityWeek |
| Sep 28–Oct 2 | US FBI | Recruitment portal vulnerability exposed names, SSNs and medical data |
| Oct 6 | Egypt | A breach affecting 60 million people announced Source: Bitsight |
On LiteLLM, CloudSEK cautions that the "2,500 organizations / 434,000 pipelines" figures describe reconstructed exposure, not proof that every listed organization was successfully compromised. SOCRadar further noted that many were likely affected earlier by the Trivy incident rather than LiteLLM itself.
3. Three ways AI is involvedAIfrontier view
| Type | Mechanism | Examples |
|---|---|---|
| 1. Agent misbehavior or escape | An autonomous agent reaches external systems, or exposes secrets, without intent | Australia Medicare breach, PixelLeak (13,000+ screenshots), the Hugging Face incident |
| 2. Supply-chain compromise | An AI dependency is compromised and credentials leak en masse | LiteLLM (via Trivy); AI infrastructure as a high-value junction |
| 3. Over-sharing with gen-AI | An employee pastes sensitive data into a personal generative-AI account | Health-guidance data uploaded to ChatGPT |
In Japanese surveys, nearly 80% of companies have experienced a generative-AI security incident, with the top concern being "leakage of confidential information" (25.8%), followed by "unintended actions by AI agents" (17.9%). Source: Nikkei
4. The scale in numbersIndependent check
- ITRC: 1,803 compromises in H1 2026 and 471.2 million victim notices — already more than all of 2025.
- IPA "Top 10 Threats 2026": threat candidates selected from the past year's incidents and attacks.
- PixelLeak: 900+ repositories, 300+ organizations, 13,000+ images; 93% were in repositories employees created under personal accounts. Glow Labs began notifying organizations on September 9.
Attackers are also using generative AI to work faster, and reporting points to damage spreading "in a short time and across a wide range."
5. Ten things to checkAIfrontier view
| # | Check |
|---|---|
| 1 | Is confidential data entering generative AI? Ban personal accounts and funnel use through a controlled path |
| 2 | Are AI agents running unattended? Require approval for sensitive actions |
| 3 | Are agents' outbound paths (public repos, external storage) blocked? |
| 4 | Are AI dependencies (e.g. LiteLLM) pinned, with fast revocation if compromised? |
| 5 | Are credentials, keys and tokens inventoried and rotated, including everything AI can touch? |
| 6 | Are known vulnerabilities in VPNs, BI tools and similar patched promptly? |
| 7 | Are logs retained so abnormal lateral movement or bulk extraction can be detected? |
| 8 | Are detection and reporting procedures and deadlines defined? (Australia took 2 months to detect, 3 weeks to report) |
| 9 | Are contractors and evaluation environments truly isolated from the network? |
| 10 | Is incident response left entirely "to the vendor"? |
6. Bottom lineAIfrontier view
This wave is not one giant breach but many leaks with diversifying entry points. Alongside traditional vulnerabilities, three new paths have appeared: agent misbehavior, AI supply-chain compromise and over-sharing with generative AI. The priority order is: (1) keep secrets out of generative AI; (2) don't run agents unattended; (3) inventory dependencies and keys; (4) define detection and reporting. Many companies have adopted the technology faster than their controls, and that gap is the biggest exposure.
Sources
- Uravation「2026年9月〜10月のサイバー攻撃・情報漏えい事例」 https://uravation.com/media/recent-cyberattack-incidents-ai-checklist-2026-10/
- パーク24「タイムズカーWebサイトへの不正アクセスによる個人情報漏えいの可能性について（第2報）」（9/28） https://www.park24.co.jp/news/2026/09/20260928-1.html
- CloudGate 週刊セキュリティニュース（2026/10/02） https://www.cloudgate.jp/security-news/2026/10/2/weekly-news
- 日本経済新聞「生成AIのセキュリティー事故、企業の8割弱が経験」 https://www.nikkei.com/article/DGXZQOUC298MN0Z20C26A9000000/
- Reuters「Australia says OpenAI agent breached Medicare」 https://www.reuters.com/world/asia-pacific/australia-pm-albanese-says-openai-breached-medicare-sydney-morning-herald-2026-09-23/
- SecurityWeek「Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack」 https://www.securityweek.com/over-2500-organizations-impacted-by-litellm-supply-chain-attack/
- CloudSEK「LiteLLM Supply Chain Attack」 https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines
- Help Net Security「AI coding agents leaked 13,000 internal screenshots」 https://www.helpnetsecurity.com/2026/09/30/ai-coding-agents-github-screenshot-leak/
- Glow Labs「How AI agents exposed developer screenshots」 https://www.glow.io/blogs/how-ai-agents-exposed-developer-screenshots-from-leading-tech-companies
- Bitsight Data Breach Tracker https://www.bitsight.com/underground/data-breaches
- IPA「情報セキュリティ10大脅威 2026」 https://www.ipa.go.jp/security/10threats/10threats2026.html