November 6, 2026: the Japan Network Security Association (JNSA) said unauthorised access to its information-security literacy check may have exposed up to 15,128 administrator and user records, including hashed passwords. The service is stopped. The catalog entry uses 15,128 as a published ceiling, not a confirmed take of every field for every person.
What is known
- JNSA confirmed the access on 4 November 2026. It says the window may have started around the night of 30 October. Path unpublished.
- Possible fields: administrator name, company, email; organisation location, headcount and industry; number of users; user IDs and hashed passwords. Test scores are not listed. Learners can be stored as IDs without real names.
- The service is down. JNSA will write to people once it finishes matching. It planned to report to Japan's Personal Information Protection Commission on 6 November. It will not send a mail with a link that asks you to type or change a password.
What is not known
- How many of the 15,128 rows actually left the system, and how many contain a name versus only an ID.
- The hash algorithm. "Hashed" is not the same as uncrackable, especially for reused or simple passwords.
- Whether this incident is connected to JNSA's separate Blastmail vendor pause (JNSA says its Blastmail file was emails only and was not in that vendor's confirmed leak).
15,128 is the association's maximum. Do not treat it as 15,128 named employees with cracked passwords.
Who is at risk
Workplace administrators who enrolled staff in the literacy check, and learners whose IDs and password hashes sat on the service. A security-association brand is catnip for phishing: "complete the literacy restart" pages that harvest the same password used on email or VPN.
What to do
- If you administered the JNSA check, change that password and any workplace password you reused. Prefer a password manager and phishing-resistant MFA.
- Tell enrolled staff that JNSA will not email a link asking for ID and password.
- Treat jnsa.org lookalikes, and "PPC follow-up" mail, as hostile until you open the real jnsa.org notice yourself.
- Wait for JNSA's individual letter to know whether you are in the matched set. Lack of a letter is not a clearance while matching is unfinished.
- If your organisation used Blastmail through JNSA, that is a different vendor notice — emails only, per JNSA, and not this 15,128-row file.
Sources
Sourcing note: 15,128 is JNSA's published maximum. We will update this post if a later report lowers the count or names the hash.